| | | | | | | | |
|
| | Log Name | Event Type | Category | Generated On | User | Source | Description
|
| | Application | Warning | 1 | 2025-11-29 04:09:07 | | Windows Search Service | 1008: The Windows Search Service is starting up and attempting to remove the old search index {Reason: Full Index Reset}.
|
| | Application | Error | None | 2025-11-29 04:09:09 | | SecurityCenter | 16: Error while updating Windows Defender status to SECURITY_PRODUCT_STATE_ON.
|
| | Application | Warning | None | 2025-11-29 04:09:55 | 1332 | Microsoft-Windows-AppModel-State | 23: Data error (cyclic redundancy check).
|
| | Application | Warning | None | 2025-11-29 04:09:55 | 1332 | Microsoft-Windows-AppModel-State | 24: The program issued a command but the command length is incorrect.
|
| | Application | Warning | None | 2025-11-29 04:09:57 | 1332 | Microsoft-Windows-AppModel-State | 23: Data error (cyclic redundancy check).
|
| | Application | Warning | None | 2025-11-29 04:09:57 | 1332 | Microsoft-Windows-AppModel-State | 24: The program issued a command but the command length is incorrect.
|
| | Application | Warning | None | 2025-11-29 04:09:57 | 1332 | Microsoft-Windows-AppModel-State | 23: Data error (cyclic redundancy check).
|
| | Application | Warning | None | 2025-11-29 04:09:57 | 1332 | Microsoft-Windows-AppModel-State | 24: The program issued a command but the command length is incorrect.
|
| | Application | Error | None | 2025-11-29 04:11:31 | | Software Protection Platform Service | 8198: License Activation (slui.exe) failed with the following error code: hr=0x800704CF Command-line arguments: RuleId=31e71c49-8da7-4a2f-ad92-45d98a1c79ba;Action=AutoActivate;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=4de7cb65-cdf1-4de9-8ae8-e3cce27b9f2c;NotificationInterval=1440;Trigger=TimerEvent
|
| | Application | Warning | None | 2025-11-29 04:28:13 | 1332 | Microsoft-Windows-AppModel-State | 23: Data error (cyclic redundancy check).
|
| | Application | Warning | None | 2025-11-29 04:28:13 | 1332 | Microsoft-Windows-AppModel-State | 24: The program issued a command but the command length is incorrect.
|
| | Application | Warning | None | 2025-11-29 04:29:00 | CogiArt | Microsoft-Windows-AppModel-State | 23: Data error (cyclic redundancy check).
|
| | Application | Warning | None | 2025-11-29 04:29:01 | CogiArt | Microsoft-Windows-AppModel-State | 24: The program issued a command but the command length is incorrect.
|
| | Application | Warning | None | 2025-11-29 04:29:02 | CogiArt | Microsoft-Windows-AppModel-State | 23: Data error (cyclic redundancy check).
|
| | Application | Warning | None | 2025-11-29 04:29:02 | CogiArt | Microsoft-Windows-AppModel-State | 24: The program issued a command but the command length is incorrect.
|
| | Application | Warning | None | 2025-11-29 04:29:03 | CogiArt | Microsoft-Windows-AppModel-State | 23: Data error (cyclic redundancy check).
|
| | Application | Warning | None | 2025-11-29 04:29:03 | CogiArt | Microsoft-Windows-AppModel-State | 24: The program issued a command but the command length is incorrect.
|
| | Application | Warning | None | 2025-11-29 04:29:03 | CogiArt | Microsoft-Windows-AppModel-State | 23: Data error (cyclic redundancy check).
|
| | Application | Warning | None | 2025-11-29 04:29:03 | CogiArt | Microsoft-Windows-AppModel-State | 24: The program issued a command but the command length is incorrect.
|
| | Application | Error | None | 2025-11-29 04:30:09 | | Software Protection Platform Service | 8198: License Activation (slui.exe) failed with the following error code: hr=0x800704CF Command-line arguments: RuleId=31e71c49-8da7-4a2f-ad92-45d98a1c79ba;Action=AutoActivate;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=4de7cb65-cdf1-4de9-8ae8-e3cce27b9f2c;NotificationInterval=1440;Trigger=UserLogon;SessionId=2
|
| | Application | Error | None | 2025-11-29 04:32:07 | | Software Protection Platform Service | 8198: License Activation (slui.exe) failed with the following error code: hr=0x800704CF Command-line arguments: RuleId=31e71c49-8da7-4a2f-ad92-45d98a1c79ba;Action=AutoActivate;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=4de7cb65-cdf1-4de9-8ae8-e3cce27b9f2c;NotificationInterval=1440;Trigger=UserLogon;SessionId=1
|
| | Application | Warning | None | 2025-11-29 04:32:12 | CogiArt | Microsoft-Windows-AppModel-State | 23: Data error (cyclic redundancy check).
|
| | Application | Warning | None | 2025-11-29 04:32:12 | CogiArt | Microsoft-Windows-AppModel-State | 24: The program issued a command but the command length is incorrect.
|
| | Application | Error | None | 2025-11-29 04:33:08 | | Software Protection Platform Service | 8198: License Activation (slui.exe) failed with the following error code: hr=0x800704CF Command-line arguments: RuleId=31e71c49-8da7-4a2f-ad92-45d98a1c79ba;Action=AutoActivate;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=4de7cb65-cdf1-4de9-8ae8-e3cce27b9f2c;NotificationInterval=1440;Trigger=NetworkAvailable
|
| | Application | Error | None | 2025-11-29 04:33:20 | | Software Protection Platform Service | 8198: License Activation (slui.exe) failed with the following error code: hr=0x803F7001 Command-line arguments: RuleId=31e71c49-8da7-4a2f-ad92-45d98a1c79ba;Action=AutoActivate;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=4de7cb65-cdf1-4de9-8ae8-e3cce27b9f2c;NotificationInterval=1440;Trigger=NetworkAvailable
|
| | Application | Error | None | 2025-11-29 04:44:08 | | Software Protection Platform Service | 8198: License Activation (slui.exe) failed with the following error code: hr=0x80072EE7 Command-line arguments: RuleId=31e71c49-8da7-4a2f-ad92-45d98a1c79ba;Action=AutoActivate;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=4de7cb65-cdf1-4de9-8ae8-e3cce27b9f2c;NotificationInterval=1440;Trigger=NetworkAvailable
|
| | Application | Error | None | 2025-11-29 04:44:13 | | Software Protection Platform Service | 8198: License Activation (slui.exe) failed with the following error code: hr=0x803F7001 Command-line arguments: RuleId=31e71c49-8da7-4a2f-ad92-45d98a1c79ba;Action=AutoActivate;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=4de7cb65-cdf1-4de9-8ae8-e3cce27b9f2c;NotificationInterval=1440;Trigger=NetworkAvailable
|
| | Application | Error | None | 2025-11-29 04:49:52 | | Software Protection Platform Service | 8198: License Activation (slui.exe) failed with the following error code: hr=0x80072EE7 Command-line arguments: RuleId=31e71c49-8da7-4a2f-ad92-45d98a1c79ba;Action=AutoActivate;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=4de7cb65-cdf1-4de9-8ae8-e3cce27b9f2c;NotificationInterval=1440;Trigger=NetworkAvailable
|
| | Application | Error | None | 2025-11-29 04:49:57 | | Software Protection Platform Service | 8198: License Activation (slui.exe) failed with the following error code: hr=0x803F7001 Command-line arguments: RuleId=31e71c49-8da7-4a2f-ad92-45d98a1c79ba;Action=AutoActivate;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=4de7cb65-cdf1-4de9-8ae8-e3cce27b9f2c;NotificationInterval=1440;Trigger=NetworkAvailable
|
| | Application | Error | None | 2025-11-29 04:51:20 | | Software Protection Platform Service | 8198: License Activation (slui.exe) failed with the following error code: hr=0x8007139F Command-line arguments: RuleId=31e71c49-8da7-4a2f-ad92-45d98a1c79ba;Action=AutoActivate;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=4de7cb65-cdf1-4de9-8ae8-e3cce27b9f2c;NotificationInterval=1440;Trigger=NetworkAvailable
|
| | Application | Error | None | 2025-11-29 04:51:28 | | Software Protection Platform Service | 8198: License Activation (slui.exe) failed with the following error code: hr=0x803F7001 Command-line arguments: RuleId=31e71c49-8da7-4a2f-ad92-45d98a1c79ba;Action=AutoActivate;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=4de7cb65-cdf1-4de9-8ae8-e3cce27b9f2c;NotificationInterval=1440;Trigger=UserLogon;SessionId=1
|
| | Application | Warning | None | 2025-11-29 04:57:20 | CogiArt | Microsoft-Windows-AppModel-State | 23: Data error (cyclic redundancy check).
|
| | Application | Warning | None | 2025-11-29 04:57:20 | CogiArt | Microsoft-Windows-AppModel-State | 24: The program issued a command but the command length is incorrect.
|
| | Application | Error | 101 | 2025-11-29 09:43:56 | SYSTEM | Application Hang | 1002: The program SystemSettings.exe version 10.0.26100.4652 stopped interacting with Windows and was closed. To see if more information about the problem is available, check the problem history in the Security and Maintenance control panel.
|
| | Application | Warning | None | 2025-11-29 09:48:21 | | Wlclntfy | 6004: The winlogon notification subscriber <TrustedInstaller> failed a critical notification event.
|
| | Application | Warning | None | 2025-11-29 10:58:15 | CogiArt | Microsoft-Windows-RestartManager | 10010: Application 'C:\Program Files\AMD\Performance Profile Client\AUEPMaster.exe' (pid 6192) cannot be restarted - 1.
|
| | Application | Warning | None | 2025-11-29 10:58:15 | CogiArt | Microsoft-Windows-RestartManager | 10010: Application 'C:\Program Files\AMD\CNext\CNext\AMDRSServ.exe' (pid 6684) cannot be restarted - 1.
|
| | Application | Warning | None | 2025-11-29 10:58:15 | CogiArt | Microsoft-Windows-RestartManager | 10010: Application 'C:\Program Files\PerformanceTest\PerformanceTest64.exe' (pid 8504) cannot be restarted - 1.
|
| | Application | Warning | None | 2025-11-29 10:58:15 | CogiArt | Microsoft-Windows-RestartManager | 10010: Application 'C:\Program Files\AMD\CNext\CNext\RadeonSoftware.exe' (pid 10780) cannot be restarted - 1.
|
| | Application | Warning | None | 2025-11-29 10:58:15 | CogiArt | Microsoft-Windows-RestartManager | 10010: Application 'C:\Program Files\AMD\CNext\CNext\cncmd.exe' (pid 2940) cannot be restarted - 1.
|
| | Application | Warning | None | 2025-11-29 10:58:15 | CogiArt | Microsoft-Windows-RestartManager | 10010: Application 'C:\Program Files\AMD\CNext\CNext\AMDRSSrcExt.exe' (pid 7508) cannot be restarted - 1.
|
| | Application | Warning | None | 2025-11-29 10:58:15 | CogiArt | Microsoft-Windows-RestartManager | 10010: Application 'C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe' (pid 8484) cannot be restarted - 1.
|
| | Application | Warning | None | 2025-11-29 10:58:15 | CogiArt | Microsoft-Windows-RestartManager | 10010: Application 'C:\Program Files\AMD\CNext\CNext\amdow.exe' (pid 4708) cannot be restarted - 1.
|
| | Application | Warning | None | 2025-11-29 10:58:15 | CogiArt | Microsoft-Windows-RestartManager | 10010: Application 'C:\Program Files\AMD\CNext\CNext\RadeonSoftware.exe' (pid 10780) cannot be restarted - 1.
|
| | Application | Warning | None | 2025-11-29 10:58:15 | CogiArt | Microsoft-Windows-RestartManager | 10010: Application 'C:\Program Files\AMD\CNext\CNext\cncmd.exe' (pid 2940) cannot be restarted - 1.
|
| | Application | Warning | None | 2025-11-29 10:58:15 | CogiArt | Microsoft-Windows-RestartManager | 10010: Application 'C:\Program Files\AMD\CNext\CNext\AMDRSSrcExt.exe' (pid 7508) cannot be restarted - 1.
|
| | Application | Warning | None | 2025-11-29 10:58:15 | CogiArt | Microsoft-Windows-RestartManager | 10010: Application 'C:\Program Files\AMD\Performance Profile Client\AUEPMaster.exe' (pid 6192) cannot be restarted - 1.
|
| | Application | Warning | None | 2025-11-29 10:58:15 | CogiArt | Microsoft-Windows-RestartManager | 10010: Application 'C:\Program Files\AMD\CNext\CNext\AMDRSServ.exe' (pid 6684) cannot be restarted - 1.
|
| | Application | Warning | None | 2025-11-29 10:58:15 | CogiArt | Microsoft-Windows-RestartManager | 10010: Application 'C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe' (pid 8484) cannot be restarted - 1.
|
| | Application | Warning | None | 2025-11-29 10:58:15 | CogiArt | Microsoft-Windows-RestartManager | 10010: Application 'C:\Program Files\PerformanceTest\PerformanceTest64.exe' (pid 8504) cannot be restarted - 1.
|
| | Application | Warning | None | 2025-11-29 10:58:15 | CogiArt | Microsoft-Windows-RestartManager | 10010: Application 'C:\Program Files\AMD\CNext\CNext\amdow.exe' (pid 4708) cannot be restarted - 1.
|
| | Application | Warning | 1 | 2025-11-30 01:03:05 | | ESENT | 901: taskhostw C:\Users\CogiArt\AppData\Local\Microsoft\Windows\WebCache\V01.chk (,,,10.0.26200.0) Tag: ASSERTTRACKTAG:HUNGIO_Low:COSFileSystem::ErrFileOpen. Internal trace: osfs.cxx(3915) ().
|
| | Application | Warning | 1 | 2025-11-30 01:03:05 | | ESENT | 533: taskhostw (5172,D,0,0) WebCacheLocal: A request to write to the file "C:\Users\CogiArt\AppData\Local\Microsoft\Windows\WebCache\V01.chk" at offset 0 (0x0000000000000000) for 0 (0x00000000) bytes has not completed for 36 second(s). This problem is likely due to faulty hardware. Please contact your hardware vendor for further assistance diagnosing the problem.
|
| | Application | Warning | 1 | 2025-11-30 01:03:43 | | ESENT | 901: svchost C:\WINDOWS\system32\SRU\SRU.chk (,,,10.0.26200.0) Tag: ASSERTTRACKTAG:HUNGIO_Low:COSFileSystem::ErrFileOpen. Internal trace: osfs.cxx(3915) ().
|
| | Application | Warning | 1 | 2025-11-30 01:03:43 | | ESENT | 533: svchost (4244,T,0,0) SRUJet: A request to write to the file "C:\WINDOWS\system32\SRU\SRU.chk" at offset 0 (0x0000000000000000) for 0 (0x00000000) bytes has not completed for 36 second(s). This problem is likely due to faulty hardware. Please contact your hardware vendor for further assistance diagnosing the problem.
|
| | Application | Warning | 1 | 2025-11-30 01:08:22 | | ESENT | 901: svchost C:\WINDOWS\system32\SRU\SRU.chk (,,,10.0.26200.0) Tag: ASSERTTRACKTAG:HUNGIO_Low:COSFileSystem::ErrFileOpen. Internal trace: osfs.cxx(3915) ().
|
| | Application | Warning | 1 | 2025-11-30 01:08:22 | | ESENT | 533: svchost (4244,R,0,0) SRUJet: A request to write to the file "C:\WINDOWS\system32\SRU\SRU.chk" at offset 0 (0x0000000000000000) for 0 (0x00000000) bytes has not completed for 36 second(s). This problem is likely due to faulty hardware. Please contact your hardware vendor for further assistance diagnosing the problem.
|
| | Security | Audit Success | 13312 | 2025-11-29 04:06:05 | | Microsoft-Windows-Security-Auditing | 4688: A new process has been created. Creator Subject: Security ID: S-1-5-18 Account Name: - Account Domain: - Logon ID: 0x3e7 Target Subject: Security ID: S-1-0-0 Account Name: - Account Domain: - Logon ID: 0x0 Process Information: New Process ID: 0x16c New Process Name: R Token Elevation Type: %%1936 Mandatory Label: S-1-16-16384 Creator Process ID: 0x4 Creator Process Name: Process Command Line: Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
|
| | Security | Audit Success | 13312 | 2025-11-29 04:06:05 | | Microsoft-Windows-Security-Auditing | 4696: A primary token was assigned to process. Subject: Security ID: S-1-5-18 Account Name: - Account Domain: - Logon ID: 0x3e7 Process Information: Process ID: 0x4 Process Name: Target Process: Target Process ID: 0x16c Target Process Name: Registry New Token Information: Security ID: S-1-0-0 Account Name: - Account Domain: - Logon ID: 0x3e7
|
| | Security | Audit Success | 13573 | 2025-11-29 04:06:05 | | Microsoft-Windows-Security-Auditing | 4826: Boot Configuration Data loaded. Subject: Security ID: S-1-5-18 Account Name: - Account Domain: - Logon ID: 0x3e7 General Settings: Load Options: - Advanced Options: %%1843 Configuration Access Policy: %%1846 System Event Logging: %%1843 Kernel Debugging: %%1843 VSM Launch Type: %%1848 Signature Settings: Test Signing: %%1843 Flight Signing: %%1843 Disable Integrity Checks: %%1843 HyperVisor Settings: HyperVisor Load Options: - HyperVisor Launch Type: %%1848 HyperVisor Debugging: %%1843
|
| | Security | Audit Success | 13312 | 2025-11-29 04:06:06 | | Microsoft-Windows-Security-Auditing | 4688: A new process has been created. Creator Subject: Security ID: S-1-5-18 Account Name: - Account Domain: - Logon ID: 0x3e7 Target Subject: Security ID: S-1-0-0 Account Name: - Account Domain: - Logon ID: 0x0 Process Information: New Process ID: 0x38c New Process Name: C Token Elevation Type: %%1936 Mandatory Label: S-1-16-16384 Creator Process ID: 0x4 Creator Process Name: Process Command Line: Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
|
| | Security | Audit Success | 13312 | 2025-11-29 04:06:07 | | Microsoft-Windows-Security-Auditing | 4688: A new process has been created. Creator Subject: Security ID: S-1-5-18 Account Name: - Account Domain: - Logon ID: 0x3e7 Target Subject: Security ID: S-1-0-0 Account Name: - Account Domain: - Logon ID: 0x0 Process Information: New Process ID: 0x3b8 New Process Name: C Token Elevation Type: %%1936 Mandatory Label: S-1-16-16384 Creator Process ID: 0x38c Creator Process Name: C Process Command Line: Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
|
| | Security | Audit Success | 13312 | 2025-11-29 04:06:08 | | Microsoft-Windows-Security-Auditing | 4688: A new process has been created. Creator Subject: Security ID: S-1-5-18 Account Name: - Account Domain: - Logon ID: 0x3e7 Target Subject: Security ID: S-1-0-0 Account Name: - Account Domain: - Logon ID: 0x0 Process Information: New Process ID: 0x444 New Process Name: C Token Elevation Type: %%1936 Mandatory Label: S-1-16-16384 Creator Process ID: 0x38c Creator Process Name: C Process Command Line: Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
|
| | Security | Audit Success | 12288 | 2025-11-29 04:06:14 | | Microsoft-Windows-Security-Auditing | 4608: Windows is starting up. This event is logged when LSASS.EXE starts and the auditing subsystem is initialized.
|
| | Security | Audit Success | 12290 | 2025-11-29 04:06:14 | | Microsoft-Windows-Security-Auditing | 6417: The FIPS mode crypto selftests succeeded. Process ID: 0x550 Process Name: C:\Windows\System32\lsass.exe
|
| | Security | Audit Success | 12544 | 2025-11-29 04:06:14 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-0-0 Account Name: - Account Domain: - Logon ID: 0x0 Logon Information: Logon Type: 0 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: - New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4 Process Name: Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: - Authentication Package: - Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-29 04:06:14 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: MINWINPC$ Account Domain: Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x53c Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12548 | 2025-11-29 04:06:14 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 13312 | 2025-11-29 04:06:14 | | Microsoft-Windows-Security-Auditing | 4688: A new process has been created. Creator Subject: Security ID: S-1-5-18 Account Name: - Account Domain: - Logon ID: 0x3e7 Target Subject: Security ID: S-1-0-0 Account Name: - Account Domain: - Logon ID: 0x0 Process Information: New Process ID: 0x4ac New Process Name: C Token Elevation Type: %%1936 Mandatory Label: S-1-16-16384 Creator Process ID: 0x45c Creator Process Name: C Process Command Line: Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
|
| | Security | Audit Success | 13312 | 2025-11-29 04:06:14 | | Microsoft-Windows-Security-Auditing | 4688: A new process has been created. Creator Subject: Security ID: S-1-5-18 Account Name: - Account Domain: - Logon ID: 0x3e7 Target Subject: Security ID: S-1-0-0 Account Name: - Account Domain: - Logon ID: 0x0 Process Information: New Process ID: 0x4b4 New Process Name: C Token Elevation Type: %%1936 Mandatory Label: S-1-16-16384 Creator Process ID: 0x4a4 Creator Process Name: C Process Command Line: Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
|
| | Security | Audit Success | 13312 | 2025-11-29 04:06:14 | | Microsoft-Windows-Security-Auditing | 4688: A new process has been created. Creator Subject: Security ID: S-1-5-18 Account Name: - Account Domain: - Logon ID: 0x3e7 Target Subject: Security ID: S-1-0-0 Account Name: - Account Domain: - Logon ID: 0x0 Process Information: New Process ID: 0x504 New Process Name: C Token Elevation Type: %%1936 Mandatory Label: S-1-16-16384 Creator Process ID: 0x4a4 Creator Process Name: C Process Command Line: Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
|
| | Security | Audit Success | 13312 | 2025-11-29 04:06:14 | | Microsoft-Windows-Security-Auditing | 4688: A new process has been created. Creator Subject: Security ID: S-1-5-18 Account Name: - Account Domain: - Logon ID: 0x3e7 Target Subject: Security ID: S-1-0-0 Account Name: - Account Domain: - Logon ID: 0x0 Process Information: New Process ID: 0x53c New Process Name: C Token Elevation Type: %%1936 Mandatory Label: S-1-16-16384 Creator Process ID: 0x4ac Creator Process Name: C Process Command Line: Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
|
| | Security | Audit Success | 13312 | 2025-11-29 04:06:14 | | Microsoft-Windows-Security-Auditing | 4688: A new process has been created. Creator Subject: Security ID: S-1-5-18 Account Name: - Account Domain: - Logon ID: 0x3e7 Target Subject: Security ID: S-1-0-0 Account Name: - Account Domain: - Logon ID: 0x0 Process Information: New Process ID: 0x550 New Process Name: C Token Elevation Type: %%1936 Mandatory Label: S-1-16-16384 Creator Process ID: 0x4ac Creator Process Name: C Process Command Line: Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
|
| | Security | Audit Success | 13312 | 2025-11-29 04:06:14 | | Microsoft-Windows-Security-Auditing | 4688: A new process has been created. Creator Subject: Security ID: S-1-5-18 Account Name: - Account Domain: - Logon ID: 0x3e7 Target Subject: Security ID: S-1-0-0 Account Name: - Account Domain: - Logon ID: 0x0 Process Information: New Process ID: 0x45c New Process Name: C Token Elevation Type: %%1936 Mandatory Label: S-1-16-16384 Creator Process ID: 0x38c Creator Process Name: C Process Command Line: Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
|
| | Security | Audit Success | 13312 | 2025-11-29 04:06:14 | | Microsoft-Windows-Security-Auditing | 4688: A new process has been created. Creator Subject: Security ID: S-1-5-18 Account Name: - Account Domain: - Logon ID: 0x3e7 Target Subject: Security ID: S-1-0-0 Account Name: - Account Domain: - Logon ID: 0x0 Process Information: New Process ID: 0x464 New Process Name: C Token Elevation Type: %%1936 Mandatory Label: S-1-16-16384 Creator Process ID: 0x45c Creator Process Name: C Process Command Line: Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
|
| | Security | Audit Success | 13312 | 2025-11-29 04:06:14 | | Microsoft-Windows-Security-Auditing | 4688: A new process has been created. Creator Subject: Security ID: S-1-5-18 Account Name: - Account Domain: - Logon ID: 0x3e7 Target Subject: Security ID: S-1-0-0 Account Name: - Account Domain: - Logon ID: 0x0 Process Information: New Process ID: 0x4a4 New Process Name: C Token Elevation Type: %%1936 Mandatory Label: S-1-16-16384 Creator Process ID: 0x38c Creator Process Name: C Process Command Line: Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
|
| | Security | Audit Success | 13568 | 2025-11-29 04:06:14 | | Microsoft-Windows-Security-Auditing | 4902: The Per-user audit policy table was created. Number of Elements: 0 Policy ID: 0x61443
|
| | Security | Audit Success | 13569 | 2025-11-29 04:06:14 | | Microsoft-Windows-Security-Auditing | 4717: System security access was granted to an account. Subject: Security ID: S-1-5-18 Account Name: MINWINPC$ Account Domain: Logon ID: 0x3e7 Account Modified: Account Name: S-1-5-80-3169285310-278349998-1452333686-3865143136-4212226833 Access Granted: Access Right: SeServiceLogonRight
|
| | Security | Audit Success | 13824 | 2025-11-29 04:06:14 | | Microsoft-Windows-Security-Auditing | 4720: A user account was created. Subject: Security ID: S-1-5-18 Account Name: MINWINPC$ Account Domain: Logon ID: 0x3e7 New Account: Security ID: S-1-5-21-2954332259-1466799094-2054226798-504 Account Name: WDAGUtilityAccount Account Domain: MINWINPC Attributes: SAM Account Name: WDAGUtilityAccount Display Name: %%1793 User Principal Name: - Home Directory: %%1793 Home Drive: %%1793 Script Path: %%1793 Profile Path: %%1793 User Workstations: %%1793 Password Last Set: %%1794 Account Expires: %%1794 Primary Group ID: 513 Allowed To Delegate To: - Old UAC Value: 0x0 New UAC Value: 0x15 User Account Control: %%2080 %%2082 %%2084 User Parameters: %%1793 SID History: - Logon Hours: %%1797 Additional Information: Privileges -
|
| | Security | Audit Success | 13824 | 2025-11-29 04:06:14 | | Microsoft-Windows-Security-Auditing | 4738: A user account was changed. Subject: Security ID: S-1-5-18 Account Name: MINWINPC$ Account Domain: Logon ID: 0x3e7 Target Account: Security ID: S-1-5-21-2954332259-1466799094-2054226798-504 Account Name: WDAGUtilityAccount Account Domain: MINWINPC Changed Attributes: SAM Account Name: - Display Name: - User Principal Name: - Home Directory: - Home Drive: - Script Path: - Profile Path: - User Workstations: - Password Last Set: - Account Expires: - Primary Group ID: - AllowedToDelegateTo: - Old UAC Value: 0x15 New UAC Value: 0x11 User Account Control: %%2050 User Parameters: - SID History: - Logon Hours: - Additional Information: Privileges: -
|
| | Security | Audit Success | 13824 | 2025-11-29 04:06:14 | | Microsoft-Windows-Security-Auditing | 4738: A user account was changed. Subject: Security ID: S-1-5-18 Account Name: MINWINPC$ Account Domain: Logon ID: 0x3e7 Target Account: Security ID: S-1-5-21-2954332259-1466799094-2054226798-504 Account Name: WDAGUtilityAccount Account Domain: MINWINPC Changed Attributes: SAM Account Name: - Display Name: - User Principal Name: - Home Directory: - Home Drive: - Script Path: - Profile Path: - User Workstations: - Password Last Set: - Account Expires: - Primary Group ID: - AllowedToDelegateTo: - Old UAC Value: - New UAC Value: - User Account Control: - User Parameters: - SID History: - Logon Hours: - Additional Information: Privileges: -
|
| | Security | Audit Success | 13824 | 2025-11-29 04:06:14 | | Microsoft-Windows-Security-Auditing | 4738: A user account was changed. Subject: Security ID: S-1-5-18 Account Name: MINWINPC$ Account Domain: Logon ID: 0x3e7 Target Account: Security ID: S-1-5-21-2954332259-1466799094-2054226798-504 Account Name: WDAGUtilityAccount Account Domain: MINWINPC Changed Attributes: SAM Account Name: - Display Name: - User Principal Name: - Home Directory: - Home Drive: - Script Path: - Profile Path: - User Workstations: - Password Last Set: - Account Expires: - Primary Group ID: - AllowedToDelegateTo: - Old UAC Value: - New UAC Value: - User Account Control: - User Parameters: - SID History: - Logon Hours: - Additional Information: Privileges: -
|
| | Security | Audit Success | 13826 | 2025-11-29 04:06:14 | | Microsoft-Windows-Security-Auditing | 4731: A security-enabled local group was created. Subject: Security ID: S-1-5-18 Account Name: MINWINPC$ Account Domain: Logon ID: 0x3e7 New Group: Security ID: S-1-5-32-551 Group Name: Backup Operators Group Domain: Builtin Attributes: SAM Account Name: Backup Operators SID History: - Additional Information: Privileges: -
|
| | Security | Audit Success | 13826 | 2025-11-29 04:06:14 | | Microsoft-Windows-Security-Auditing | 4735: A security-enabled local group was changed. Subject: Security ID: S-1-5-18 Account Name: MINWINPC$ Account Domain: Logon ID: 0x3e7 Group: Security ID: S-1-5-32-551 Group Name: Backup Operators Group Domain: Builtin Changed Attributes: SAM Account Name: - SID History: - Additional Information: Privileges: -
|
| | Security | Audit Success | 13826 | 2025-11-29 04:06:14 | | Microsoft-Windows-Security-Auditing | 4731: A security-enabled local group was created. Subject: Security ID: S-1-5-18 Account Name: MINWINPC$ Account Domain: Logon ID: 0x3e7 New Group: Security ID: S-1-5-32-552 Group Name: Replicator Group Domain: Builtin Attributes: SAM Account Name: Replicator SID History: - Additional Information: Privileges: -
|
| | Security | Audit Success | 13826 | 2025-11-29 04:06:14 | | Microsoft-Windows-Security-Auditing | 4735: A security-enabled local group was changed. Subject: Security ID: S-1-5-18 Account Name: MINWINPC$ Account Domain: Logon ID: 0x3e7 Group: Security ID: S-1-5-32-552 Group Name: Replicator Group Domain: Builtin Changed Attributes: SAM Account Name: - SID History: - Additional Information: Privileges: -
|
| | Security | Audit Success | 13826 | 2025-11-29 04:06:14 | | Microsoft-Windows-Security-Auditing | 4731: A security-enabled local group was created. Subject: Security ID: S-1-5-18 Account Name: MINWINPC$ Account Domain: Logon ID: 0x3e7 New Group: Security ID: S-1-5-32-555 Group Name: Remote Desktop Users Group Domain: Builtin Attributes: SAM Account Name: Remote Desktop Users SID History: - Additional Information: Privileges: -
|
| | Security | Audit Success | 13826 | 2025-11-29 04:06:14 | | Microsoft-Windows-Security-Auditing | 4735: A security-enabled local group was changed. Subject: Security ID: S-1-5-18 Account Name: MINWINPC$ Account Domain: Logon ID: 0x3e7 Group: Security ID: S-1-5-32-555 Group Name: Remote Desktop Users Group Domain: Builtin Changed Attributes: SAM Account Name: - SID History: - Additional Information: Privileges: -
|
| | Security | Audit Success | 13826 | 2025-11-29 04:06:14 | | Microsoft-Windows-Security-Auditing | 4731: A security-enabled local group was created. Subject: Security ID: S-1-5-18 Account Name: MINWINPC$ Account Domain: Logon ID: 0x3e7 New Group: Security ID: S-1-5-32-556 Group Name: Network Configuration Operators Group Domain: Builtin Attributes: SAM Account Name: Network Configuration Operators SID History: - Additional Information: Privileges: -
|
| | Security | Audit Success | 13826 | 2025-11-29 04:06:14 | | Microsoft-Windows-Security-Auditing | 4735: A security-enabled local group was changed. Subject: Security ID: S-1-5-18 Account Name: MINWINPC$ Account Domain: Logon ID: 0x3e7 Group: Security ID: S-1-5-32-556 Group Name: Network Configuration Operators Group Domain: Builtin Changed Attributes: SAM Account Name: - SID History: - Additional Information: Privileges: -
|
| | Security | Audit Success | 13826 | 2025-11-29 04:06:14 | | Microsoft-Windows-Security-Auditing | 4731: A security-enabled local group was created. Subject: Security ID: S-1-5-18 Account Name: MINWINPC$ Account Domain: Logon ID: 0x3e7 New Group: Security ID: S-1-5-32-558 Group Name: Performance Monitor Users Group Domain: Builtin Attributes: SAM Account Name: Performance Monitor Users SID History: - Additional Information: Privileges: -
|
| | Security | Audit Success | 13826 | 2025-11-29 04:06:14 | | Microsoft-Windows-Security-Auditing | 4735: A security-enabled local group was changed. Subject: Security ID: S-1-5-18 Account Name: MINWINPC$ Account Domain: Logon ID: 0x3e7 Group: Security ID: S-1-5-32-558 Group Name: Performance Monitor Users Group Domain: Builtin Changed Attributes: SAM Account Name: - SID History: - Additional Information: Privileges: -
|
| | Security | Audit Success | 13826 | 2025-11-29 04:06:14 | | Microsoft-Windows-Security-Auditing | 4731: A security-enabled local group was created. Subject: Security ID: S-1-5-18 Account Name: MINWINPC$ Account Domain: Logon ID: 0x3e7 New Group: Security ID: S-1-5-32-559 Group Name: Performance Log Users Group Domain: Builtin Attributes: SAM Account Name: Performance Log Users SID History: - Additional Information: Privileges: -
|
| | Security | Audit Success | 13826 | 2025-11-29 04:06:14 | | Microsoft-Windows-Security-Auditing | 4735: A security-enabled local group was changed. Subject: Security ID: S-1-5-18 Account Name: MINWINPC$ Account Domain: Logon ID: 0x3e7 Group: Security ID: S-1-5-32-559 Group Name: Performance Log Users Group Domain: Builtin Changed Attributes: SAM Account Name: - SID History: - Additional Information: Privileges: -
|
| | Security | Audit Success | 13826 | 2025-11-29 04:06:14 | | Microsoft-Windows-Security-Auditing | 4731: A security-enabled local group was created. Subject: Security ID: S-1-5-18 Account Name: MINWINPC$ Account Domain: Logon ID: 0x3e7 New Group: Security ID: S-1-5-32-562 Group Name: Distributed COM Users Group Domain: Builtin Attributes: SAM Account Name: Distributed COM Users SID History: - Additional Information: Privileges: -
|
| | Security | Audit Success | 13826 | 2025-11-29 04:06:14 | | Microsoft-Windows-Security-Auditing | 4735: A security-enabled local group was changed. Subject: Security ID: S-1-5-18 Account Name: MINWINPC$ Account Domain: Logon ID: 0x3e7 Group: Security ID: S-1-5-32-562 Group Name: Distributed COM Users Group Domain: Builtin Changed Attributes: SAM Account Name: - SID History: - Additional Information: Privileges: -
|
| | Security | Audit Success | 13826 | 2025-11-29 04:06:14 | | Microsoft-Windows-Security-Auditing | 4731: A security-enabled local group was created. Subject: Security ID: S-1-5-18 Account Name: MINWINPC$ Account Domain: Logon ID: 0x3e7 New Group: Security ID: S-1-5-32-568 Group Name: IIS_IUSRS Group Domain: Builtin Attributes: SAM Account Name: IIS_IUSRS SID History: - Additional Information: Privileges: -
|
| | Security | Audit Success | 13826 | 2025-11-29 04:06:14 | | Microsoft-Windows-Security-Auditing | 4735: A security-enabled local group was changed. Subject: Security ID: S-1-5-18 Account Name: MINWINPC$ Account Domain: Logon ID: 0x3e7 Group: Security ID: S-1-5-32-568 Group Name: IIS_IUSRS Group Domain: Builtin Changed Attributes: SAM Account Name: - SID History: - Additional Information: Privileges: -
|
| | Security | Audit Success | 13826 | 2025-11-29 04:06:14 | | Microsoft-Windows-Security-Auditing | 4731: A security-enabled local group was created. Subject: Security ID: S-1-5-18 Account Name: MINWINPC$ Account Domain: Logon ID: 0x3e7 New Group: Security ID: S-1-5-32-569 Group Name: Cryptographic Operators Group Domain: Builtin Attributes: SAM Account Name: Cryptographic Operators SID History: - Additional Information: Privileges: -
|
| | Security | Audit Success | 13826 | 2025-11-29 04:06:14 | | Microsoft-Windows-Security-Auditing | 4735: A security-enabled local group was changed. Subject: Security ID: S-1-5-18 Account Name: MINWINPC$ Account Domain: Logon ID: 0x3e7 Group: Security ID: S-1-5-32-569 Group Name: Cryptographic Operators Group Domain: Builtin Changed Attributes: SAM Account Name: - SID History: - Additional Information: Privileges: -
|
| | Security | Audit Success | 13826 | 2025-11-29 04:06:14 | | Microsoft-Windows-Security-Auditing | 4732: A member was added to a security-enabled local group. Subject: Security ID: S-1-5-18 Account Name: MINWINPC$ Account Domain: Logon ID: 0x3e7 Member: Security ID: S-1-5-17 Account Name: - Group: Security ID: S-1-5-32-568 Group Name: IIS_IUSRS Group Domain: Builtin Additional Information: Privileges: - Expiration time: (null)
|
| | Security | Audit Success | 13826 | 2025-11-29 04:06:14 | | Microsoft-Windows-Security-Auditing | 4731: A security-enabled local group was created. Subject: Security ID: S-1-5-18 Account Name: MINWINPC$ Account Domain: Logon ID: 0x3e7 New Group: Security ID: S-1-5-32-573 Group Name: Event Log Readers Group Domain: Builtin Attributes: SAM Account Name: Event Log Readers SID History: - Additional Information: Privileges: -
|
| | Security | Audit Success | 13826 | 2025-11-29 04:06:14 | | Microsoft-Windows-Security-Auditing | 4735: A security-enabled local group was changed. Subject: Security ID: S-1-5-18 Account Name: MINWINPC$ Account Domain: Logon ID: 0x3e7 Group: Security ID: S-1-5-32-573 Group Name: Event Log Readers Group Domain: Builtin Changed Attributes: SAM Account Name: - SID History: - Additional Information: Privileges: -
|
| | Security | Audit Success | 13826 | 2025-11-29 04:06:14 | | Microsoft-Windows-Security-Auditing | 4731: A security-enabled local group was created. Subject: Security ID: S-1-5-18 Account Name: MINWINPC$ Account Domain: Logon ID: 0x3e7 New Group: Security ID: S-1-5-32-578 Group Name: Hyper-V Administrators Group Domain: Builtin Attributes: SAM Account Name: Hyper-V Administrators SID History: - Additional Information: Privileges: -
|
| | Security | Audit Success | 13826 | 2025-11-29 04:06:14 | | Microsoft-Windows-Security-Auditing | 4735: A security-enabled local group was changed. Subject: Security ID: S-1-5-18 Account Name: MINWINPC$ Account Domain: Logon ID: 0x3e7 Group: Security ID: S-1-5-32-578 Group Name: Hyper-V Administrators Group Domain: Builtin Changed Attributes: SAM Account Name: - SID History: - Additional Information: Privileges: -
|
| | Security | Audit Success | 13826 | 2025-11-29 04:06:14 | | Microsoft-Windows-Security-Auditing | 4731: A security-enabled local group was created. Subject: Security ID: S-1-5-18 Account Name: MINWINPC$ Account Domain: Logon ID: 0x3e7 New Group: Security ID: S-1-5-32-579 Group Name: Access Control Assistance Operators Group Domain: Builtin Attributes: SAM Account Name: Access Control Assistance Operators SID History: - Additional Information: Privileges: -
|
| | Security | Audit Success | 13826 | 2025-11-29 04:06:14 | | Microsoft-Windows-Security-Auditing | 4735: A security-enabled local group was changed. Subject: Security ID: S-1-5-18 Account Name: MINWINPC$ Account Domain: Logon ID: 0x3e7 Group: Security ID: S-1-5-32-579 Group Name: Access Control Assistance Operators Group Domain: Builtin Changed Attributes: SAM Account Name: - SID History: - Additional Information: Privileges: -
|
| | Security | Audit Success | 13826 | 2025-11-29 04:06:14 | | Microsoft-Windows-Security-Auditing | 4731: A security-enabled local group was created. Subject: Security ID: S-1-5-18 Account Name: MINWINPC$ Account Domain: Logon ID: 0x3e7 New Group: Security ID: S-1-5-32-580 Group Name: Remote Management Users Group Domain: Builtin Attributes: SAM Account Name: Remote Management Users SID History: - Additional Information: Privileges: -
|
| | Security | Audit Success | 13826 | 2025-11-29 04:06:14 | | Microsoft-Windows-Security-Auditing | 4735: A security-enabled local group was changed. Subject: Security ID: S-1-5-18 Account Name: MINWINPC$ Account Domain: Logon ID: 0x3e7 Group: Security ID: S-1-5-32-580 Group Name: Remote Management Users Group Domain: Builtin Changed Attributes: SAM Account Name: - SID History: - Additional Information: Privileges: -
|
| | Security | Audit Success | 13826 | 2025-11-29 04:06:14 | | Microsoft-Windows-Security-Auditing | 4728: A member was added to a security-enabled global group. Subject: Security ID: S-1-5-18 Account Name: MINWINPC$ Account Domain: Logon ID: 0x3e7 Member: Security ID: S-1-5-21-2954332259-1466799094-2054226798-504 Account Name: - Group: Security ID: S-1-5-21-2954332259-1466799094-2054226798-513 Group Name: None Group Domain: MINWINPC Additional Information: Privileges: - Expiration time: (null)
|
| | Security | Audit Success | 13826 | 2025-11-29 04:06:14 | | Microsoft-Windows-Security-Auditing | 4731: A security-enabled local group was created. Subject: Security ID: S-1-5-18 Account Name: MINWINPC$ Account Domain: Logon ID: 0x3e7 New Group: Security ID: S-1-5-32-585 Group Name: OpenSSH Users Group Domain: Builtin Attributes: SAM Account Name: OpenSSH Users SID History: - Additional Information: Privileges: -
|
| | Security | Audit Success | 13826 | 2025-11-29 04:06:14 | | Microsoft-Windows-Security-Auditing | 4735: A security-enabled local group was changed. Subject: Security ID: S-1-5-18 Account Name: MINWINPC$ Account Domain: Logon ID: 0x3e7 Group: Security ID: S-1-5-32-585 Group Name: OpenSSH Users Group Domain: Builtin Changed Attributes: SAM Account Name: - SID History: - Additional Information: Privileges: -
|
| | Security | Audit Success | 12544 | 2025-11-29 04:06:15 | | Microsoft-Windows-Security-Auditing | 4648: A logon was attempted using explicit credentials. Subject: Security ID: S-1-5-18 Account Name: MINWINPC$ Account Domain: Logon ID: 0x3e7 Logon GUID: {00000000-0000-0000-0000-000000000000} Account Whose Credentials Were Used: Account Name: UMFD-0 Account Domain: Font Driver Host Logon GUID: {00000000-0000-0000-0000-000000000000} Target Server: Target Server Name: localhost Additional Information: localhost Process Information: Process ID: 0x4ac Process Name: C:\Windows\System32\wininit.exe Network Information: Network Address: - Port: - This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
|
| | Security | Audit Success | 12544 | 2025-11-29 04:06:15 | | Microsoft-Windows-Security-Auditing | 4648: A logon was attempted using explicit credentials. Subject: Security ID: S-1-5-18 Account Name: MINWINPC$ Account Domain: Logon ID: 0x3e7 Logon GUID: {00000000-0000-0000-0000-000000000000} Account Whose Credentials Were Used: Account Name: UMFD-1 Account Domain: Font Driver Host Logon GUID: {00000000-0000-0000-0000-000000000000} Target Server: Target Server Name: localhost Additional Information: localhost Process Information: Process ID: 0x504 Process Name: C:\Windows\System32\winlogon.exe Network Information: Network Address: - Port: - This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
|
| | Security | Audit Success | 12544 | 2025-11-29 04:06:15 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: MINWINPC$ Account Domain: Logon ID: 0x3e7 Logon Information: Logon Type: 2 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1842 Elevated Token: %%1843 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-96-0-0 Account Name: UMFD-0 Account Domain: Font Driver Host Logon ID: 0x61d09 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4ac Process Name: C:\Windows\System32\wininit.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-29 04:06:15 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: MINWINPC$ Account Domain: Logon ID: 0x3e7 Logon Information: Logon Type: 2 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1842 Elevated Token: %%1843 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-96-0-1 Account Name: UMFD-1 Account Domain: Font Driver Host Logon ID: 0x61d04 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x504 Process Name: C:\Windows\System32\winlogon.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-29 04:06:15 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: MINWINPC$ Account Domain: Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-20 Account Name: NETWORK SERVICE Account Domain: NT AUTHORITY Logon ID: 0x3e4 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x53c Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-29 04:06:15 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: MINWINPC$ Account Domain: Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x53c Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-29 04:06:15 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: MINWINPC$ Account Domain: Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x53c Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-29 04:06:15 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: MINWINPC$ Account Domain: Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x53c Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-29 04:06:15 | | Microsoft-Windows-Security-Auditing | 4648: A logon was attempted using explicit credentials. Subject: Security ID: S-1-5-18 Account Name: MINWINPC$ Account Domain: Logon ID: 0x3e7 Logon GUID: {00000000-0000-0000-0000-000000000000} Account Whose Credentials Were Used: Account Name: DWM-1 Account Domain: Window Manager Logon GUID: {00000000-0000-0000-0000-000000000000} Target Server: Target Server Name: localhost Additional Information: localhost Process Information: Process ID: 0x504 Process Name: C:\Windows\System32\winlogon.exe Network Information: Network Address: - Port: - This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
|
| | Security | Audit Success | 12544 | 2025-11-29 04:06:15 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: MINWINPC$ Account Domain: Logon ID: 0x3e7 Logon Information: Logon Type: 2 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1842 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-90-0-1 Account Name: DWM-1 Account Domain: Window Manager Logon ID: 0x69ddc Linked Logon ID: 0x69dfa Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x504 Process Name: C:\Windows\System32\winlogon.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-29 04:06:15 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: MINWINPC$ Account Domain: Logon ID: 0x3e7 Logon Information: Logon Type: 2 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1842 Elevated Token: %%1843 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-90-0-1 Account Name: DWM-1 Account Domain: Window Manager Logon ID: 0x69dfa Linked Logon ID: 0x69ddc Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x504 Process Name: C:\Windows\System32\winlogon.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-29 04:06:15 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: MINWINPC$ Account Domain: Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-19 Account Name: LOCAL SERVICE Account Domain: NT AUTHORITY Logon ID: 0x3e5 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x53c Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12548 | 2025-11-29 04:06:15 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-20 Account Name: NETWORK SERVICE Account Domain: NT AUTHORITY Logon ID: 0x3e4 Privileges: SeAssignPrimaryTokenPrivilege SeAuditPrivilege SeImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-29 04:06:15 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-29 04:06:15 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-29 04:06:15 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-29 04:06:15 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-90-0-1 Account Name: DWM-1 Account Domain: Window Manager Logon ID: 0x69ddc Privileges: SeAssignPrimaryTokenPrivilege SeAuditPrivilege SeImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-29 04:06:15 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-90-0-1 Account Name: DWM-1 Account Domain: Window Manager Logon ID: 0x69dfa Privileges: SeAssignPrimaryTokenPrivilege SeAuditPrivilege
|
| | Security | Audit Success | 12548 | 2025-11-29 04:06:15 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-19 Account Name: LOCAL SERVICE Account Domain: NT AUTHORITY Logon ID: 0x3e5 Privileges: SeAssignPrimaryTokenPrivilege SeAuditPrivilege SeImpersonatePrivilege
|
| | Security | Audit Success | 12544 | 2025-11-29 04:06:18 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: MINWINPC$ Account Domain: Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x53c Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-29 04:06:18 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: MINWINPC$ Account Domain: Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x53c Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12548 | 2025-11-29 04:06:18 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-29 04:06:18 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12544 | 2025-11-29 04:06:29 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: MINWINPC$ Account Domain: Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x53c Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12548 | 2025-11-29 04:06:29 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12544 | 2025-11-29 04:06:30 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: MINWINPC$ Account Domain: Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x53c Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-29 04:06:30 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: MINWINPC$ Account Domain: Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x53c Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12548 | 2025-11-29 04:06:30 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-29 04:06:30 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12544 | 2025-11-29 04:06:40 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: MINWINPC$ Account Domain: Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x53c Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12548 | 2025-11-29 04:06:40 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 13569 | 2025-11-29 04:06:47 | | Microsoft-Windows-Security-Auditing | 4717: System security access was granted to an account. Subject: Security ID: S-1-5-18 Account Name: MINWINPC$ Account Domain: Logon ID: 0x3e7 Account Modified: Account Name: S-1-5-21-2954332259-1466799094-2054226798-501 Access Granted: Access Right: SeDenyInteractiveLogonRight
|
| | Security | Audit Success | 13569 | 2025-11-29 04:06:47 | | Microsoft-Windows-Security-Auditing | 4717: System security access was granted to an account. Subject: Security ID: S-1-5-18 Account Name: MINWINPC$ Account Domain: Logon ID: 0x3e7 Account Modified: Account Name: S-1-5-21-2954332259-1466799094-2054226798-501 Access Granted: Access Right: SeDenyNetworkLogonRight
|
| | Security | Audit Success | 13569 | 2025-11-29 04:06:47 | | Microsoft-Windows-Security-Auditing | 4718: System security access was removed from an account. Subject: Security ID: S-1-5-18 Account Name: MINWINPC$ Account Domain: Logon ID: 0x3e7 Account Modified: Account Name: S-1-5-90-0 Access Removed: Access Right: SeInteractiveLogonRight
|
| | Security | Audit Success | 13569 | 2025-11-29 04:06:47 | | Microsoft-Windows-Security-Auditing | 4717: System security access was granted to an account. Subject: Security ID: S-1-5-18 Account Name: MINWINPC$ Account Domain: Logon ID: 0x3e7 Account Modified: Account Name: S-1-5-32-555 Access Granted: Access Right: SeRemoteInteractiveLogonRight
|
| | Security | Audit Success | 13569 | 2025-11-29 04:06:47 | | Microsoft-Windows-Security-Auditing | 4717: System security access was granted to an account. Subject: Security ID: S-1-5-18 Account Name: MINWINPC$ Account Domain: Logon ID: 0x3e7 Account Modified: Account Name: S-1-5-80-0 Access Granted: Access Right: SeServiceLogonRight
|
| | Security | Audit Success | 13569 | 2025-11-29 04:06:47 | | Microsoft-Windows-Security-Auditing | 4739: Domain Policy was changed. Change Type: Password Policy modified Subject: Security ID: S-1-5-18 Account Name: MINWINPC$ Account Domain: Logon ID: 0x3e7 Domain: Domain Name: MINWINPC Domain ID: S-1-5-21-2954332259-1466799094-2054226798 Changed Attributes: Min. Password Age: unavailable Max. Password Age: 42:00:00:00 Force Logoff: - Lockout Threshold: - Lockout Observation Window: - Lockout Duration: - Password Properties: 8 Min. Password Length: 0 Password History Length: 0 Machine Account Quota: - Mixed Domain Mode: - Domain Behavior Version: - OEM Information: - Additional Information: Privileges: -
|
| | Security | Audit Success | 13569 | 2025-11-29 04:06:47 | | Microsoft-Windows-Security-Auditing | 4718: System security access was removed from an account. Subject: Security ID: S-1-5-18 Account Name: MINWINPC$ Account Domain: Logon ID: 0x3e7 Account Modified: Account Name: S-1-5-32-546 Access Removed: Access Right: SeInteractiveLogonRight
|
| | Security | Audit Success | 13569 | 2025-11-29 04:06:47 | | Microsoft-Windows-Security-Auditing | 4718: System security access was removed from an account. Subject: Security ID: S-1-5-18 Account Name: MINWINPC$ Account Domain: Logon ID: 0x3e7 Account Modified: Account Name: S-1-5-32-581 Access Removed: Access Right: SeInteractiveLogonRight
|
| | Security | Audit Success | 13569 | 2025-11-29 04:06:47 | | Microsoft-Windows-Security-Auditing | 4718: System security access was removed from an account. Subject: Security ID: S-1-5-18 Account Name: MINWINPC$ Account Domain: Logon ID: 0x3e7 Account Modified: Account Name: S-1-5-32-581 Access Removed: Access Right: SeNetworkLogonRight
|
| | Security | Audit Success | 13569 | 2025-11-29 04:06:47 | | Microsoft-Windows-Security-Auditing | 4718: System security access was removed from an account. Subject: Security ID: S-1-5-18 Account Name: MINWINPC$ Account Domain: Logon ID: 0x3e7 Account Modified: Account Name: S-1-5-32-583 Access Removed: Access Right: SeInteractiveLogonRight
|
| | Security | Audit Success | 13569 | 2025-11-29 04:06:47 | | Microsoft-Windows-Security-Auditing | 4718: System security access was removed from an account. Subject: Security ID: S-1-5-18 Account Name: MINWINPC$ Account Domain: Logon ID: 0x3e7 Account Modified: Account Name: S-1-5-32-583 Access Removed: Access Right: SeNetworkLogonRight
|
| | Security | Audit Success | 13569 | 2025-11-29 04:06:47 | | Microsoft-Windows-Security-Auditing | 4718: System security access was removed from an account. Subject: Security ID: S-1-5-18 Account Name: MINWINPC$ Account Domain: Logon ID: 0x3e7 Account Modified: Account Name: S-1-5-80-3169285310-278349998-1452333686-3865143136-4212226833 Access Removed: Access Right: SeServiceLogonRight
|
| | Security | Audit Success | 13569 | 2025-11-29 04:06:47 | | Microsoft-Windows-Security-Auditing | 4717: System security access was granted to an account. Subject: Security ID: S-1-5-18 Account Name: MINWINPC$ Account Domain: Logon ID: 0x3e7 Account Modified: Account Name: S-1-5-32-544 Access Granted: Access Right: SeRemoteInteractiveLogonRight
|
| | Security | Audit Success | 13569 | 2025-11-29 04:06:47 | | Microsoft-Windows-Security-Auditing | 4717: System security access was granted to an account. Subject: Security ID: S-1-5-18 Account Name: MINWINPC$ Account Domain: Logon ID: 0x3e7 Account Modified: Account Name: S-1-5-32-551 Access Granted: Access Right: SeNetworkLogonRight
|
| | Security | Audit Success | 13569 | 2025-11-29 04:06:47 | | Microsoft-Windows-Security-Auditing | 4717: System security access was granted to an account. Subject: Security ID: S-1-5-18 Account Name: MINWINPC$ Account Domain: Logon ID: 0x3e7 Account Modified: Account Name: S-1-5-32-551 Access Granted: Access Right: SeBatchLogonRight
|
| | Security | Audit Success | 13569 | 2025-11-29 04:06:47 | | Microsoft-Windows-Security-Auditing | 4717: System security access was granted to an account. Subject: Security ID: S-1-5-18 Account Name: MINWINPC$ Account Domain: Logon ID: 0x3e7 Account Modified: Account Name: S-1-5-32-559 Access Granted: Access Right: SeBatchLogonRight
|
| | Security | Audit Success | 13569 | 2025-11-29 04:06:47 | | Microsoft-Windows-Security-Auditing | 4718: System security access was removed from an account. Subject: Security ID: S-1-5-18 Account Name: MINWINPC$ Account Domain: Logon ID: 0x3e7 Account Modified: Account Name: S-1-1-0 Access Removed: Access Right: SeInteractiveLogonRight
|
| | Security | Audit Success | 13569 | 2025-11-29 04:06:47 | | Microsoft-Windows-Security-Auditing | 4718: System security access was removed from an account. Subject: Security ID: S-1-5-18 Account Name: MINWINPC$ Account Domain: Logon ID: 0x3e7 Account Modified: Account Name: S-1-1-0 Access Removed: Access Right: SeRemoteInteractiveLogonRight
|
| | Security | Audit Success | 13569 | 2025-11-29 04:06:47 | | Microsoft-Windows-Security-Auditing | 4717: System security access was granted to an account. Subject: Security ID: S-1-5-18 Account Name: MINWINPC$ Account Domain: Logon ID: 0x3e7 Account Modified: Account Name: S-1-5-21-2954332259-1466799094-2054226798-501 Access Granted: Access Right: SeInteractiveLogonRight
|
| | Security | Audit Success | 13824 | 2025-11-29 04:06:47 | | Microsoft-Windows-Security-Auditing | 4725: A user account was disabled. Subject: Security ID: S-1-5-18 Account Name: MINWINPC$ Account Domain: Logon ID: 0x3e7 Target Account: Security ID: S-1-5-21-2954332259-1466799094-2054226798-500 Account Name: Administrator Account Domain: MINWINPC
|
| | Security | Audit Success | 13824 | 2025-11-29 04:06:47 | | Microsoft-Windows-Security-Auditing | 4738: A user account was changed. Subject: Security ID: S-1-5-18 Account Name: MINWINPC$ Account Domain: Logon ID: 0x3e7 Target Account: Security ID: S-1-5-21-2954332259-1466799094-2054226798-500 Account Name: Administrator Account Domain: MINWINPC Changed Attributes: SAM Account Name: - Display Name: - User Principal Name: - Home Directory: - Home Drive: - Script Path: - Profile Path: - User Workstations: - Password Last Set: - Account Expires: - Primary Group ID: - AllowedToDelegateTo: - Old UAC Value: 0x210 New UAC Value: 0x211 User Account Control: %%2080 User Parameters: - SID History: - Logon Hours: - Additional Information: Privileges: -
|
| | Security | Audit Success | 13826 | 2025-11-29 04:06:47 | | Microsoft-Windows-Security-Auditing | 4799: A security-enabled local group membership was enumerated. Subject: Security ID: S-1-5-18 Account Name: MINWINPC$ Account Domain: Logon ID: 0x3e7 Group: Security ID: S-1-5-32-545 Group Name: Users Group Domain: Builtin Process Information: Process ID: 0x53c Process Name: C:\Windows\System32\services.exe
|
| | Security | Audit Success | 13826 | 2025-11-29 04:06:47 | | Microsoft-Windows-Security-Auditing | 4732: A member was added to a security-enabled local group. Subject: Security ID: S-1-5-18 Account Name: MINWINPC$ Account Domain: Logon ID: 0x3e7 Member: Security ID: S-1-5-4 Account Name: - Group: Security ID: S-1-5-32-545 Group Name: Users Group Domain: Builtin Additional Information: Privileges: - Expiration time: (null)
|
| | Security | Audit Success | 13826 | 2025-11-29 04:06:47 | | Microsoft-Windows-Security-Auditing | 4732: A member was added to a security-enabled local group. Subject: Security ID: S-1-5-18 Account Name: MINWINPC$ Account Domain: Logon ID: 0x3e7 Member: Security ID: S-1-5-11 Account Name: - Group: Security ID: S-1-5-32-545 Group Name: Users Group Domain: Builtin Additional Information: Privileges: - Expiration time: (null)
|
| | Security | Audit Success | 12544 | 2025-11-29 04:06:48 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: MINWINPC$ Account Domain: Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x53c Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-29 04:06:48 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: MINWINPC$ Account Domain: Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x53c Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-29 04:06:48 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: MINWINPC$ Account Domain: Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x53c Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-29 04:06:48 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: MINWINPC$ Account Domain: Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x53c Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-29 04:06:48 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: MINWINPC$ Account Domain: Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x53c Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12548 | 2025-11-29 04:06:48 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-29 04:06:48 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-29 04:06:48 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-29 04:06:48 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-29 04:06:48 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 13824 | 2025-11-29 04:06:48 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-18 Account Name: MINWINPC$ Account Domain: Logon ID: 0x3e7 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:06:48 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-18 Account Name: MINWINPC$ Account Domain: Logon ID: 0x3e7 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 12544 | 2025-11-29 04:06:49 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: MINWINPC$ Account Domain: Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x53c Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-29 04:06:49 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: MINWINPC$ Account Domain: Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x53c Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-29 04:06:49 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: MINWINPC$ Account Domain: Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x53c Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-29 04:06:49 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: MINWINPC$ Account Domain: Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x53c Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-29 04:06:49 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: MINWINPC$ Account Domain: Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x53c Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-29 04:06:49 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: MINWINPC$ Account Domain: Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x53c Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-29 04:06:49 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: MINWINPC$ Account Domain: Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x53c Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-29 04:06:49 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: MINWINPC$ Account Domain: Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x53c Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-29 04:06:49 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: MINWINPC$ Account Domain: Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x53c Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-29 04:06:49 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: MINWINPC$ Account Domain: Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x53c Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12548 | 2025-11-29 04:06:49 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-29 04:06:49 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-29 04:06:49 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-29 04:06:49 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-29 04:06:49 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-29 04:06:49 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-29 04:06:49 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-29 04:06:49 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-29 04:06:49 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-29 04:06:49 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 13824 | 2025-11-29 04:06:49 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-18 Account Name: MINWINPC$ Account Domain: Logon ID: 0x3e7 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:06:49 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-18 Account Name: MINWINPC$ Account Domain: Logon ID: 0x3e7 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 12292 | 2025-11-29 04:06:50 | | Microsoft-Windows-Security-Auditing | 5033: The Windows Firewall Driver started successfully.
|
| | Security | Audit Success | 12544 | 2025-11-29 04:06:50 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: MINWINPC$ Account Domain: Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x53c Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-29 04:06:50 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: MINWINPC$ Account Domain: Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x53c Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-29 04:06:50 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: MINWINPC$ Account Domain: Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x53c Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-29 04:06:50 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: MINWINPC$ Account Domain: Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x53c Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-29 04:06:50 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: MINWINPC$ Account Domain: Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x53c Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-29 04:06:50 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: MINWINPC$ Account Domain: Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x53c Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-29 04:06:50 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: MINWINPC$ Account Domain: Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x53c Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-29 04:06:50 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: MINWINPC$ Account Domain: Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x53c Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12548 | 2025-11-29 04:06:50 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-29 04:06:50 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-29 04:06:50 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-29 04:06:50 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-29 04:06:50 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-29 04:06:50 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-29 04:06:50 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-29 04:06:50 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12292 | 2025-11-29 04:06:51 | | Microsoft-Windows-Security-Auditing | 5024: The Windows Firewall service started successfully.
|
| | Security | Audit Success | 12544 | 2025-11-29 04:06:51 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: MINWINPC$ Account Domain: Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x53c Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-29 04:06:51 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: MINWINPC$ Account Domain: Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x53c Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12548 | 2025-11-29 04:06:51 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-29 04:06:51 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12544 | 2025-11-29 04:07:01 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: MINWINPC$ Account Domain: Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x53c Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12548 | 2025-11-29 04:07:01 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12544 | 2025-11-29 04:07:10 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: MINWINPC$ Account Domain: Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x53c Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12548 | 2025-11-29 04:07:10 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12544 | 2025-11-29 04:07:11 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: MINWINPC$ Account Domain: Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x53c Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12548 | 2025-11-29 04:07:11 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 13826 | 2025-11-29 04:07:20 | | Microsoft-Windows-Security-Auditing | 4799: A security-enabled local group membership was enumerated. Subject: Security ID: S-1-5-18 Account Name: MINWINPC$ Account Domain: Logon ID: 0x3e7 Group: Security ID: S-1-5-32-545 Group Name: Users Group Domain: Builtin Process Information: Process ID: 0x17b4 Process Name: C:\Program Files (x86)\Microsoft\Edge\Application\140.0.3485.66\Installer\setup.exe
|
| | Security | Audit Success | 12544 | 2025-11-29 04:07:21 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: MINWINPC$ Account Domain: Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x53c Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12548 | 2025-11-29 04:07:21 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12544 | 2025-11-29 04:07:22 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: MINWINPC$ Account Domain: Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x53c Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12548 | 2025-11-29 04:07:22 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12544 | 2025-11-29 04:08:01 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: MINWINPC$ Account Domain: Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x53c Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12548 | 2025-11-29 04:08:01 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12544 | 2025-11-29 04:08:52 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: MINWINPC$ Account Domain: Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x53c Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12548 | 2025-11-29 04:08:52 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 13824 | 2025-11-29 04:08:52 | | Microsoft-Windows-Security-Auditing | 4738: A user account was changed. Subject: Security ID: S-1-5-18 Account Name: MINWINPC$ Account Domain: Logon ID: 0x3e7 Target Account: Security ID: S-1-5-21-2954332259-1466799094-2054226798-500 Account Name: Administrator Account Domain: MINWINPC Changed Attributes: SAM Account Name: - Display Name: - User Principal Name: - Home Directory: - Home Drive: - Script Path: - Profile Path: - User Workstations: - Password Last Set: - Account Expires: - Primary Group ID: - AllowedToDelegateTo: - Old UAC Value: 0x211 New UAC Value: 0x211 User Account Control: - User Parameters: - SID History: - Logon Hours: - Additional Information: Privileges: -
|
| | Security | Audit Success | 12544 | 2025-11-29 04:08:53 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: MINWINPC$ Account Domain: Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x53c Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12548 | 2025-11-29 04:08:53 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12544 | 2025-11-29 04:08:54 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: MINWINPC$ Account Domain: Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x53c Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-29 04:08:54 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: MINWINPC$ Account Domain: Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x53c Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12548 | 2025-11-29 04:08:54 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-29 04:08:54 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12544 | 2025-11-29 04:08:55 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: MINWINPC$ Account Domain: Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x53c Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12548 | 2025-11-29 04:08:55 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12544 | 2025-11-29 04:08:56 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: MINWINPC$ Account Domain: Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x53c Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12548 | 2025-11-29 04:08:56 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Failure | 12290 | 2025-11-29 04:09:07 | | Microsoft-Windows-Security-Auditing | 5061: Cryptographic operation. Subject: Security ID: S-1-5-19 Account Name: LOCAL SERVICE Account Domain: NT AUTHORITY Logon ID: 0x3e5 Cryptographic Parameters: Provider Name: Microsoft Software Key Storage Provider Algorithm Name: UNKNOWN Key Name: Microsoft Connected Devices Platform device certificate Key Type: %%2500 Cryptographic Operation: Operation: %%2480 Return Code: 0x80090016
|
| | Security | Audit Failure | 12290 | 2025-11-29 04:09:07 | | Microsoft-Windows-Security-Auditing | 5061: Cryptographic operation. Subject: Security ID: S-1-5-19 Account Name: LOCAL SERVICE Account Domain: NT AUTHORITY Logon ID: 0x3e5 Cryptographic Parameters: Provider Name: Microsoft Software Key Storage Provider Algorithm Name: UNKNOWN Key Name: Microsoft Connected Devices Platform device certificate Key Type: %%2500 Cryptographic Operation: Operation: %%2480 Return Code: 0x80090016
|
| | Security | Audit Failure | 12290 | 2025-11-29 04:09:07 | | Microsoft-Windows-Security-Auditing | 5061: Cryptographic operation. Subject: Security ID: S-1-5-19 Account Name: LOCAL SERVICE Account Domain: NT AUTHORITY Logon ID: 0x3e5 Cryptographic Parameters: Provider Name: Microsoft Software Key Storage Provider Algorithm Name: UNKNOWN Key Name: Microsoft Connected Devices Platform device certificate Key Type: %%2500 Cryptographic Operation: Operation: %%2480 Return Code: 0x80090016
|
| | Security | Audit Success | 12290 | 2025-11-29 04:09:07 | | Microsoft-Windows-Security-Auditing | 5061: Cryptographic operation. Subject: Security ID: S-1-5-19 Account Name: LOCAL SERVICE Account Domain: NT AUTHORITY Logon ID: 0x3e5 Cryptographic Parameters: Provider Name: Microsoft Software Key Storage Provider Algorithm Name: ECDSA_P256 Key Name: Microsoft Connected Devices Platform device certificate Key Type: %%2500 Cryptographic Operation: Operation: %%2481 Return Code: 0x0
|
| | Security | Audit Success | 12290 | 2025-11-29 04:09:07 | | Microsoft-Windows-Security-Auditing | 5061: Cryptographic operation. Subject: Security ID: S-1-5-19 Account Name: LOCAL SERVICE Account Domain: NT AUTHORITY Logon ID: 0x3e5 Cryptographic Parameters: Provider Name: Microsoft Software Key Storage Provider Algorithm Name: ECDSA_P256 Key Name: Microsoft Connected Devices Platform device certificate Key Type: %%2500 Cryptographic Operation: Operation: %%2480 Return Code: 0x0
|
| | Security | Audit Success | 12292 | 2025-11-29 04:09:07 | | Microsoft-Windows-Security-Auditing | 5058: Key file operation. Subject: Security ID: S-1-5-19 Account Name: LOCAL SERVICE Account Domain: NT AUTHORITY Logon ID: 0x3e5 Process Information: Process ID: 5848 Process Creation Time: 2025-11-29T12:09:07.1847608Z Cryptographic Parameters: Provider Name: Microsoft Software Key Storage Provider Algorithm Name: ECDSA_P256 Key Name: Microsoft Connected Devices Platform device certificate Key Type: %%2500 Key File Operation Information: File Path: C:\WINDOWS\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Crypto\Keys\de7cf8a7901d2ad13e5c67c29e5d1662_9ee7012e-fa60-42be-b8b4-8dc8b4e1280d Operation: %%2459 Return Code: 0x0
|
| | Security | Audit Success | 12292 | 2025-11-29 04:09:07 | | Microsoft-Windows-Security-Auditing | 5058: Key file operation. Subject: Security ID: S-1-5-19 Account Name: LOCAL SERVICE Account Domain: NT AUTHORITY Logon ID: 0x3e5 Process Information: Process ID: 5848 Process Creation Time: 2025-11-29T12:09:07.1847608Z Cryptographic Parameters: Provider Name: Microsoft Software Key Storage Provider Algorithm Name: UNKNOWN Key Name: Microsoft Connected Devices Platform device certificate Key Type: %%2500 Key File Operation Information: File Path: C:\WINDOWS\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Crypto\Keys\de7cf8a7901d2ad13e5c67c29e5d1662_9ee7012e-fa60-42be-b8b4-8dc8b4e1280d Operation: %%2458 Return Code: 0x0
|
| | Security | Audit Success | 12292 | 2025-11-29 04:09:07 | | Microsoft-Windows-Security-Auditing | 5059: Key migration operation. Subject: Security ID: S-1-5-19 Account Name: LOCAL SERVICE Account Domain: NT AUTHORITY Logon ID: 0x3e5 Process Information: Process ID: 5848 Process Creation Time: 2025-11-29T12:09:07.1847608Z Cryptographic Parameters: Provider Name: Microsoft Software Key Storage Provider Algorithm Name: ECDSA_P256 Key Name: Microsoft Connected Devices Platform device certificate Key Type: %%2500 Additional Information: Operation: %%2464 Return Code: 0x0
|
| | Security | Audit Success | 12292 | 2025-11-29 04:09:07 | | Microsoft-Windows-Security-Auditing | 5059: Key migration operation. Subject: Security ID: S-1-5-19 Account Name: LOCAL SERVICE Account Domain: NT AUTHORITY Logon ID: 0x3e5 Process Information: Process ID: 5848 Process Creation Time: 2025-11-29T12:09:07.1847608Z Cryptographic Parameters: Provider Name: Microsoft Software Key Storage Provider Algorithm Name: ECDSA_P256 Key Name: Microsoft Connected Devices Platform device certificate Key Type: %%2500 Additional Information: Operation: %%2464 Return Code: 0x0
|
| | Security | Audit Success | 12292 | 2025-11-29 04:09:07 | | Microsoft-Windows-Security-Auditing | 5059: Key migration operation. Subject: Security ID: S-1-5-19 Account Name: LOCAL SERVICE Account Domain: NT AUTHORITY Logon ID: 0x3e5 Process Information: Process ID: 5848 Process Creation Time: 2025-11-29T12:09:07.1847608Z Cryptographic Parameters: Provider Name: Microsoft Software Key Storage Provider Algorithm Name: ECDSA_P256 Key Name: Microsoft Connected Devices Platform device certificate Key Type: %%2500 Additional Information: Operation: %%2464 Return Code: 0x0
|
| | Security | Audit Success | 12544 | 2025-11-29 04:09:07 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: MINWINPC$ Account Domain: Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x53c Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-29 04:09:07 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: MINWINPC$ Account Domain: Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x53c Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-29 04:09:07 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: MINWINPC$ Account Domain: Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x53c Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-29 04:09:07 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: MINWINPC$ Account Domain: Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x53c Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-29 04:09:07 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: MINWINPC$ Account Domain: Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x53c Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12548 | 2025-11-29 04:09:07 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-29 04:09:07 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-29 04:09:07 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-29 04:09:07 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-29 04:09:07 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 13826 | 2025-11-29 04:09:08 | | Microsoft-Windows-Security-Auditing | 4799: A security-enabled local group membership was enumerated. Subject: Security ID: S-1-5-18 Account Name: MINWINPC$ Account Domain: Logon ID: 0x3e7 Group: Security ID: S-1-5-32-544 Group Name: Administrators Group Domain: Builtin Process Information: Process ID: 0x448 Process Name: C:\Windows\System32\SearchIndexer.exe
|
| | Security | Audit Success | 13826 | 2025-11-29 04:09:08 | | Microsoft-Windows-Security-Auditing | 4799: A security-enabled local group membership was enumerated. Subject: Security ID: S-1-5-18 Account Name: MINWINPC$ Account Domain: Logon ID: 0x3e7 Group: Security ID: S-1-5-32-551 Group Name: Backup Operators Group Domain: Builtin Process Information: Process ID: 0x448 Process Name: C:\Windows\System32\SearchIndexer.exe
|
| | Security | Audit Success | 103 | 2025-11-29 04:09:10 | | Microsoft-Windows-Eventlog | 1100: The event logging service has shut down.
|
| | Security | Audit Success | 13312 | 2025-11-29 04:09:18 | | Microsoft-Windows-Security-Auditing | 4688: A new process has been created. Creator Subject: Security ID: S-1-5-18 Account Name: - Account Domain: - Logon ID: 0x3e7 Target Subject: Security ID: S-1-0-0 Account Name: - Account Domain: - Logon ID: 0x0 Process Information: New Process ID: 0x16c New Process Name: R Token Elevation Type: %%1936 Mandatory Label: S-1-16-16384 Creator Process ID: 0x4 Creator Process Name: Process Command Line: Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
|
| | Security | Audit Success | 13312 | 2025-11-29 04:09:18 | | Microsoft-Windows-Security-Auditing | 4696: A primary token was assigned to process. Subject: Security ID: S-1-5-18 Account Name: - Account Domain: - Logon ID: 0x3e7 Process Information: Process ID: 0x4 Process Name: Target Process: Target Process ID: 0x16c Target Process Name: Registry New Token Information: Security ID: S-1-0-0 Account Name: - Account Domain: - Logon ID: 0x3e7
|
| | Security | Audit Success | 13312 | 2025-11-29 04:09:18 | | Microsoft-Windows-Security-Auditing | 4688: A new process has been created. Creator Subject: Security ID: S-1-5-18 Account Name: - Account Domain: - Logon ID: 0x3e7 Target Subject: Security ID: S-1-0-0 Account Name: - Account Domain: - Logon ID: 0x0 Process Information: New Process ID: 0x374 New Process Name: C Token Elevation Type: %%1936 Mandatory Label: S-1-16-16384 Creator Process ID: 0x4 Creator Process Name: Process Command Line: Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
|
| | Security | Audit Success | 13573 | 2025-11-29 04:09:18 | | Microsoft-Windows-Security-Auditing | 4826: Boot Configuration Data loaded. Subject: Security ID: S-1-5-18 Account Name: - Account Domain: - Logon ID: 0x3e7 General Settings: Load Options: - Advanced Options: %%1843 Configuration Access Policy: %%1846 System Event Logging: %%1843 Kernel Debugging: %%1843 VSM Launch Type: %%1848 Signature Settings: Test Signing: %%1843 Flight Signing: %%1843 Disable Integrity Checks: %%1843 HyperVisor Settings: HyperVisor Load Options: - HyperVisor Launch Type: %%1848 HyperVisor Debugging: %%1843
|
| | Security | Audit Success | 13312 | 2025-11-29 04:09:19 | | Microsoft-Windows-Security-Auditing | 4688: A new process has been created. Creator Subject: Security ID: S-1-5-18 Account Name: - Account Domain: - Logon ID: 0x3e7 Target Subject: Security ID: S-1-0-0 Account Name: - Account Domain: - Logon ID: 0x0 Process Information: New Process ID: 0x390 New Process Name: C Token Elevation Type: %%1936 Mandatory Label: S-1-16-16384 Creator Process ID: 0x374 Creator Process Name: C Process Command Line: Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
|
| | Security | Audit Success | 13312 | 2025-11-29 04:09:25 | | Microsoft-Windows-Security-Auditing | 4688: A new process has been created. Creator Subject: Security ID: S-1-5-18 Account Name: - Account Domain: - Logon ID: 0x3e7 Target Subject: Security ID: S-1-0-0 Account Name: - Account Domain: - Logon ID: 0x0 Process Information: New Process ID: 0x334 New Process Name: C Token Elevation Type: %%1936 Mandatory Label: S-1-16-16384 Creator Process ID: 0x374 Creator Process Name: C Process Command Line: Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
|
| | Security | Audit Success | 13312 | 2025-11-29 04:09:27 | | Microsoft-Windows-Security-Auditing | 4688: A new process has been created. Creator Subject: Security ID: S-1-5-18 Account Name: - Account Domain: - Logon ID: 0x3e7 Target Subject: Security ID: S-1-0-0 Account Name: - Account Domain: - Logon ID: 0x0 Process Information: New Process ID: 0x420 New Process Name: C Token Elevation Type: %%1936 Mandatory Label: S-1-16-16384 Creator Process ID: 0x334 Creator Process Name: C Process Command Line: Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
|
| | Security | Audit Success | 13312 | 2025-11-29 04:09:27 | | Microsoft-Windows-Security-Auditing | 4688: A new process has been created. Creator Subject: Security ID: S-1-5-18 Account Name: - Account Domain: - Logon ID: 0x3e7 Target Subject: Security ID: S-1-0-0 Account Name: - Account Domain: - Logon ID: 0x0 Process Information: New Process ID: 0x460 New Process Name: C Token Elevation Type: %%1936 Mandatory Label: S-1-16-16384 Creator Process ID: 0x374 Creator Process Name: C Process Command Line: Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
|
| | Security | Audit Success | 13312 | 2025-11-29 04:09:27 | | Microsoft-Windows-Security-Auditing | 4688: A new process has been created. Creator Subject: Security ID: S-1-5-18 Account Name: - Account Domain: - Logon ID: 0x3e7 Target Subject: Security ID: S-1-0-0 Account Name: - Account Domain: - Logon ID: 0x0 Process Information: New Process ID: 0x468 New Process Name: C Token Elevation Type: %%1936 Mandatory Label: S-1-16-16384 Creator Process ID: 0x334 Creator Process Name: C Process Command Line: Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
|
| | Security | Audit Success | 13312 | 2025-11-29 04:09:27 | | Microsoft-Windows-Security-Auditing | 4688: A new process has been created. Creator Subject: Security ID: S-1-5-18 Account Name: - Account Domain: - Logon ID: 0x3e7 Target Subject: Security ID: S-1-0-0 Account Name: - Account Domain: - Logon ID: 0x0 Process Information: New Process ID: 0x470 New Process Name: C Token Elevation Type: %%1936 Mandatory Label: S-1-16-16384 Creator Process ID: 0x460 Creator Process Name: C Process Command Line: Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
|
| | Security | Audit Success | 12288 | 2025-11-29 04:09:28 | | Microsoft-Windows-Security-Auditing | 4608: Windows is starting up. This event is logged when LSASS.EXE starts and the auditing subsystem is initialized.
|
| | Security | Audit Success | 12290 | 2025-11-29 04:09:28 | | Microsoft-Windows-Security-Auditing | 6417: The FIPS mode crypto selftests succeeded. Process ID: 0x50c Process Name: C:\Windows\System32\lsass.exe
|
| | Security | Audit Success | 12544 | 2025-11-29 04:09:28 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-0-0 Account Name: - Account Domain: - Logon ID: 0x0 Logon Information: Logon Type: 0 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: - New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4 Process Name: Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: - Authentication Package: - Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-29 04:09:28 | | Microsoft-Windows-Security-Auditing | 4648: A logon was attempted using explicit credentials. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon GUID: {00000000-0000-0000-0000-000000000000} Account Whose Credentials Were Used: Account Name: UMFD-1 Account Domain: Font Driver Host Logon GUID: {00000000-0000-0000-0000-000000000000} Target Server: Target Server Name: localhost Additional Information: localhost Process Information: Process ID: 0x4b0 Process Name: C:\Windows\System32\winlogon.exe Network Information: Network Address: - Port: - This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
|
| | Security | Audit Success | 12544 | 2025-11-29 04:09:28 | | Microsoft-Windows-Security-Auditing | 4648: A logon was attempted using explicit credentials. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon GUID: {00000000-0000-0000-0000-000000000000} Account Whose Credentials Were Used: Account Name: UMFD-0 Account Domain: Font Driver Host Logon GUID: {00000000-0000-0000-0000-000000000000} Target Server: Target Server Name: localhost Additional Information: localhost Process Information: Process ID: 0x468 Process Name: C:\Windows\System32\wininit.exe Network Information: Network Address: - Port: - This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
|
| | Security | Audit Success | 12544 | 2025-11-29 04:09:28 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4f8 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-29 04:09:28 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 2 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1842 Elevated Token: %%1843 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-96-0-1 Account Name: UMFD-1 Account Domain: Font Driver Host Logon ID: 0xd1bc Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4b0 Process Name: C:\Windows\System32\winlogon.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-29 04:09:28 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 2 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1842 Elevated Token: %%1843 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-96-0-0 Account Name: UMFD-0 Account Domain: Font Driver Host Logon ID: 0xd1bb Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x468 Process Name: C:\Windows\System32\wininit.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-29 04:09:28 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-20 Account Name: NETWORK SERVICE Account Domain: NT AUTHORITY Logon ID: 0x3e4 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4f8 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12548 | 2025-11-29 04:09:28 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-29 04:09:28 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-20 Account Name: NETWORK SERVICE Account Domain: NT AUTHORITY Logon ID: 0x3e4 Privileges: SeAssignPrimaryTokenPrivilege SeAuditPrivilege SeImpersonatePrivilege
|
| | Security | Audit Success | 13312 | 2025-11-29 04:09:28 | | Microsoft-Windows-Security-Auditing | 4688: A new process has been created. Creator Subject: Security ID: S-1-5-18 Account Name: - Account Domain: - Logon ID: 0x3e7 Target Subject: Security ID: S-1-0-0 Account Name: - Account Domain: - Logon ID: 0x0 Process Information: New Process ID: 0x4b0 New Process Name: C Token Elevation Type: %%1936 Mandatory Label: S-1-16-16384 Creator Process ID: 0x460 Creator Process Name: C Process Command Line: Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
|
| | Security | Audit Success | 13312 | 2025-11-29 04:09:28 | | Microsoft-Windows-Security-Auditing | 4688: A new process has been created. Creator Subject: Security ID: S-1-5-18 Account Name: - Account Domain: - Logon ID: 0x3e7 Target Subject: Security ID: S-1-0-0 Account Name: - Account Domain: - Logon ID: 0x0 Process Information: New Process ID: 0x4f8 New Process Name: C Token Elevation Type: %%1936 Mandatory Label: S-1-16-16384 Creator Process ID: 0x468 Creator Process Name: C Process Command Line: Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
|
| | Security | Audit Success | 13312 | 2025-11-29 04:09:28 | | Microsoft-Windows-Security-Auditing | 4688: A new process has been created. Creator Subject: Security ID: S-1-5-18 Account Name: - Account Domain: - Logon ID: 0x3e7 Target Subject: Security ID: S-1-0-0 Account Name: - Account Domain: - Logon ID: 0x0 Process Information: New Process ID: 0x50c New Process Name: C Token Elevation Type: %%1936 Mandatory Label: S-1-16-16384 Creator Process ID: 0x468 Creator Process Name: C Process Command Line: Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
|
| | Security | Audit Success | 13568 | 2025-11-29 04:09:28 | | Microsoft-Windows-Security-Auditing | 4902: The Per-user audit policy table was created. Number of Elements: 0 Policy ID: 0xcccf
|
| | Security | Audit Success | 12544 | 2025-11-29 04:09:29 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4f8 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-29 04:09:29 | | Microsoft-Windows-Security-Auditing | 4648: A logon was attempted using explicit credentials. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon GUID: {00000000-0000-0000-0000-000000000000} Account Whose Credentials Were Used: Account Name: DWM-1 Account Domain: Window Manager Logon GUID: {00000000-0000-0000-0000-000000000000} Target Server: Target Server Name: localhost Additional Information: localhost Process Information: Process ID: 0x4b0 Process Name: C:\Windows\System32\winlogon.exe Network Information: Network Address: - Port: - This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
|
| | Security | Audit Success | 12544 | 2025-11-29 04:09:29 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 2 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1842 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-90-0-1 Account Name: DWM-1 Account Domain: Window Manager Logon ID: 0x12ddf Linked Logon ID: 0x12dfc Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4b0 Process Name: C:\Windows\System32\winlogon.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-29 04:09:29 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 2 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1842 Elevated Token: %%1843 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-90-0-1 Account Name: DWM-1 Account Domain: Window Manager Logon ID: 0x12dfc Linked Logon ID: 0x12ddf Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4b0 Process Name: C:\Windows\System32\winlogon.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-29 04:09:29 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4f8 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-29 04:09:29 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4f8 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-29 04:09:29 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-19 Account Name: LOCAL SERVICE Account Domain: NT AUTHORITY Logon ID: 0x3e5 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4f8 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-29 04:09:29 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4f8 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-29 04:09:29 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4f8 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12548 | 2025-11-29 04:09:29 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-29 04:09:29 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-90-0-1 Account Name: DWM-1 Account Domain: Window Manager Logon ID: 0x12ddf Privileges: SeAssignPrimaryTokenPrivilege SeAuditPrivilege SeImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-29 04:09:29 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-90-0-1 Account Name: DWM-1 Account Domain: Window Manager Logon ID: 0x12dfc Privileges: SeAssignPrimaryTokenPrivilege SeAuditPrivilege
|
| | Security | Audit Success | 12548 | 2025-11-29 04:09:29 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-29 04:09:29 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-29 04:09:29 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-19 Account Name: LOCAL SERVICE Account Domain: NT AUTHORITY Logon ID: 0x3e5 Privileges: SeAssignPrimaryTokenPrivilege SeAuditPrivilege SeImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-29 04:09:29 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-29 04:09:29 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12544 | 2025-11-29 04:09:36 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4f8 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-29 04:09:36 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4f8 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12548 | 2025-11-29 04:09:36 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-29 04:09:36 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12544 | 2025-11-29 04:09:37 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4f8 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12548 | 2025-11-29 04:09:37 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 13824 | 2025-11-29 04:09:37 | | Microsoft-Windows-Security-Auditing | 4720: A user account was created. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 New Account: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1000 Account Name: defaultuser0 Account Domain: DESKTOP-0JV7HJV Attributes: SAM Account Name: defaultuser0 Display Name: %%1793 User Principal Name: - Home Directory: %%1793 Home Drive: %%1793 Script Path: %%1793 Profile Path: %%1793 User Workstations: %%1793 Password Last Set: %%1794 Account Expires: %%1794 Primary Group ID: 513 Allowed To Delegate To: - Old UAC Value: 0x0 New UAC Value: 0x15 User Account Control: %%2080 %%2082 %%2084 User Parameters: %%1793 SID History: - Logon Hours: %%1797 Additional Information: Privileges -
|
| | Security | Audit Success | 13824 | 2025-11-29 04:09:37 | | Microsoft-Windows-Security-Auditing | 4722: A user account was enabled. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Target Account: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1000 Account Name: defaultuser0 Account Domain: DESKTOP-0JV7HJV
|
| | Security | Audit Success | 13824 | 2025-11-29 04:09:37 | | Microsoft-Windows-Security-Auditing | 4738: A user account was changed. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Target Account: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1000 Account Name: defaultuser0 Account Domain: DESKTOP-0JV7HJV Changed Attributes: SAM Account Name: defaultuser0 Display Name: %%1793 User Principal Name: - Home Directory: %%1793 Home Drive: %%1793 Script Path: %%1793 Profile Path: %%1793 User Workstations: %%1793 Password Last Set: %%1794 Account Expires: %%1794 Primary Group ID: 513 AllowedToDelegateTo: - Old UAC Value: 0x15 New UAC Value: 0x14 User Account Control: %%2048 User Parameters: %%1793 SID History: - Logon Hours: %%1797 Additional Information: Privileges: -
|
| | Security | Audit Success | 13826 | 2025-11-29 04:09:37 | | Microsoft-Windows-Security-Auditing | 4728: A member was added to a security-enabled global group. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Member: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1000 Account Name: - Group: Security ID: S-1-5-21-2954332259-1466799094-2054226798-513 Group Name: None Group Domain: DESKTOP-0JV7HJV Additional Information: Privileges: - Expiration time: (null)
|
| | Security | Audit Success | 13826 | 2025-11-29 04:09:37 | | Microsoft-Windows-Security-Auditing | 4732: A member was added to a security-enabled local group. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Member: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1000 Account Name: - Group: Security ID: S-1-5-32-545 Group Name: Users Group Domain: Builtin Additional Information: Privileges: - Expiration time: (null)
|
| | Security | Audit Success | 12290 | 2025-11-29 04:09:38 | | Microsoft-Windows-Security-Auditing | 5061: Cryptographic operation. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Cryptographic Parameters: Provider Name: Microsoft Software Key Storage Provider Algorithm Name: RSA Key Name: f8df15d9-56fa-0cb3-682b-838ed74af121 Key Type: %%2500 Cryptographic Operation: Operation: %%2481 Return Code: 0x0
|
| | Security | Audit Success | 12290 | 2025-11-29 04:09:38 | | Microsoft-Windows-Security-Auditing | 5061: Cryptographic operation. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Cryptographic Parameters: Provider Name: Microsoft Software Key Storage Provider Algorithm Name: RSA Key Name: f8df15d9-56fa-0cb3-682b-838ed74af121 Key Type: %%2500 Cryptographic Operation: Operation: %%2480 Return Code: 0x0
|
| | Security | Audit Success | 12292 | 2025-11-29 04:09:38 | | Microsoft-Windows-Security-Auditing | 5033: The Windows Firewall Driver started successfully.
|
| | Security | Audit Success | 12292 | 2025-11-29 04:09:38 | | Microsoft-Windows-Security-Auditing | 5058: Key file operation. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Process Information: Process ID: 2332 Process Creation Time: 2025-11-29T12:09:37.8811167Z Cryptographic Parameters: Provider Name: Microsoft Software Key Storage Provider Algorithm Name: RSA Key Name: f8df15d9-56fa-0cb3-682b-838ed74af121 Key Type: %%2500 Key File Operation Information: File Path: C:\ProgramData\Microsoft\Crypto\SystemKeys\8bb43a3e92c2eb4c420c9abd6e278936_9ee7012e-fa60-42be-b8b4-8dc8b4e1280d Operation: %%2459 Return Code: 0x0
|
| | Security | Audit Success | 12292 | 2025-11-29 04:09:38 | | Microsoft-Windows-Security-Auditing | 5058: Key file operation. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Process Information: Process ID: 2332 Process Creation Time: 2025-11-29T12:09:37.8811167Z Cryptographic Parameters: Provider Name: Microsoft Software Key Storage Provider Algorithm Name: UNKNOWN Key Name: f8df15d9-56fa-0cb3-682b-838ed74af121 Key Type: %%2500 Key File Operation Information: File Path: C:\ProgramData\Microsoft\Crypto\SystemKeys\8bb43a3e92c2eb4c420c9abd6e278936_9ee7012e-fa60-42be-b8b4-8dc8b4e1280d Operation: %%2458 Return Code: 0x0
|
| | Security | Audit Success | 12292 | 2025-11-29 04:09:38 | | Microsoft-Windows-Security-Auditing | 5059: Key migration operation. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Process Information: Process ID: 2332 Process Creation Time: 2025-11-29T12:09:37.8811167Z Cryptographic Parameters: Provider Name: Microsoft Software Key Storage Provider Algorithm Name: RSA Key Name: f8df15d9-56fa-0cb3-682b-838ed74af121 Key Type: %%2500 Additional Information: Operation: %%2464 Return Code: 0x0
|
| | Security | Audit Success | 12544 | 2025-11-29 04:09:38 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4f8 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-29 04:09:38 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4f8 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-29 04:09:38 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4f8 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-29 04:09:38 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4f8 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-29 04:09:38 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4f8 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-29 04:09:38 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4f8 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-29 04:09:38 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4f8 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-29 04:09:38 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4f8 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-29 04:09:38 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4f8 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-29 04:09:38 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4f8 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-29 04:09:38 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4f8 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-29 04:09:38 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4f8 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-29 04:09:38 | | Microsoft-Windows-Security-Auditing | 4648: A logon was attempted using explicit credentials. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon GUID: {00000000-0000-0000-0000-000000000000} Account Whose Credentials Were Used: Account Name: defaultuser0 Account Domain: DESKTOP-0JV7HJV Logon GUID: {00000000-0000-0000-0000-000000000000} Target Server: Target Server Name: localhost Additional Information: localhost Process Information: Process ID: 0x848 Process Name: C:\Windows\System32\oobe\msoobe.exe Network Information: Network Address: - Port: - This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
|
| | Security | Audit Success | 12544 | 2025-11-29 04:09:38 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 2 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1000 Account Name: defaultuser0 Account Domain: DESKTOP-0JV7HJV Logon ID: 0x23921 Linked Logon ID: 0x23a18 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x848 Process Name: C:\Windows\System32\oobe\msoobe.exe Network Information: Workstation Name: WIN-GH7MCVI2372 Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-29 04:09:38 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 2 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1843 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1000 Account Name: defaultuser0 Account Domain: DESKTOP-0JV7HJV Logon ID: 0x23a18 Linked Logon ID: 0x23921 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x848 Process Name: C:\Windows\System32\oobe\msoobe.exe Network Information: Workstation Name: WIN-GH7MCVI2372 Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-29 04:09:38 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4f8 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-29 04:09:38 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4f8 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-29 04:09:38 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4f8 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-29 04:09:38 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4f8 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-29 04:09:38 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4f8 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-29 04:09:38 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4f8 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-29 04:09:38 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4f8 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-29 04:09:38 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4f8 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-29 04:09:38 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4f8 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-29 04:09:38 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4f8 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-29 04:09:38 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4f8 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-29 04:09:38 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4f8 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12548 | 2025-11-29 04:09:38 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-29 04:09:38 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-29 04:09:38 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-29 04:09:38 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-29 04:09:38 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-29 04:09:38 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-29 04:09:38 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-29 04:09:38 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-29 04:09:38 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-29 04:09:38 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-29 04:09:38 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-29 04:09:38 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-29 04:09:38 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1000 Account Name: defaultuser0 Account Domain: DESKTOP-0JV7HJV Logon ID: 0x23921 Privileges: SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-29 04:09:38 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-29 04:09:38 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-29 04:09:38 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-29 04:09:38 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-29 04:09:38 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-29 04:09:38 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-29 04:09:38 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-29 04:09:38 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-29 04:09:38 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-29 04:09:38 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-29 04:09:38 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-29 04:09:38 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 13824 | 2025-11-29 04:09:38 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:09:38 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:09:38 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:09:38 | | Microsoft-Windows-Security-Auditing | 4738: A user account was changed. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Target Account: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1000 Account Name: defaultuser0 Account Domain: DESKTOP-0JV7HJV Changed Attributes: SAM Account Name: defaultuser0 Display Name: %%1793 User Principal Name: - Home Directory: %%1793 Home Drive: %%1793 Script Path: %%1793 Profile Path: %%1793 User Workstations: %%1793 Password Last Set: 11/29/2025 4:09:38 AM Account Expires: %%1794 Primary Group ID: 513 AllowedToDelegateTo: - Old UAC Value: 0x14 New UAC Value: 0x14 User Account Control: - User Parameters: - SID History: - Logon Hours: %%1797 Additional Information: Privileges: -
|
| | Security | Audit Success | 13824 | 2025-11-29 04:09:38 | | Microsoft-Windows-Security-Auditing | 4724: An attempt was made to reset an account's password. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Target Account: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1000 Account Name: defaultuser0 Account Domain: DESKTOP-0JV7HJV
|
| | Security | Audit Success | 13824 | 2025-11-29 04:09:38 | | Microsoft-Windows-Security-Auditing | 4738: A user account was changed. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Target Account: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1000 Account Name: defaultuser0 Account Domain: DESKTOP-0JV7HJV Changed Attributes: SAM Account Name: defaultuser0 Display Name: %%1793 User Principal Name: - Home Directory: %%1793 Home Drive: %%1793 Script Path: %%1793 Profile Path: %%1793 User Workstations: %%1793 Password Last Set: 11/29/2025 4:09:38 AM Account Expires: %%1794 Primary Group ID: 513 AllowedToDelegateTo: - Old UAC Value: 0x14 New UAC Value: 0x214 User Account Control: %%2089 User Parameters: - SID History: - Logon Hours: %%1797 Additional Information: Privileges: -
|
| | Security | Audit Success | 13824 | 2025-11-29 04:09:38 | | Microsoft-Windows-Security-Auditing | 4724: An attempt was made to reset an account's password. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Target Account: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1000 Account Name: defaultuser0 Account Domain: DESKTOP-0JV7HJV
|
| | Security | Audit Success | 13824 | 2025-11-29 04:09:38 | | Microsoft-Windows-Security-Auditing | 4781: The name of an account was changed: Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Target Account: Security ID: S-1-5-32-544 Account Domain: Builtin Old Account Name: Administrators New Account Name: Administrators Additional Information: Privileges: -
|
| | Security | Audit Success | 13824 | 2025-11-29 04:09:38 | | Microsoft-Windows-Security-Auditing | 4781: The name of an account was changed: Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Target Account: Security ID: S-1-5-32-545 Account Domain: Builtin Old Account Name: Users New Account Name: Users Additional Information: Privileges: -
|
| | Security | Audit Success | 13824 | 2025-11-29 04:09:38 | | Microsoft-Windows-Security-Auditing | 4781: The name of an account was changed: Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Target Account: Security ID: S-1-5-32-546 Account Domain: Builtin Old Account Name: Guests New Account Name: Guests Additional Information: Privileges: -
|
| | Security | Audit Success | 13824 | 2025-11-29 04:09:38 | | Microsoft-Windows-Security-Auditing | 4781: The name of an account was changed: Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Target Account: Security ID: S-1-5-32-551 Account Domain: Builtin Old Account Name: Backup Operators New Account Name: Backup Operators Additional Information: Privileges: -
|
| | Security | Audit Success | 13824 | 2025-11-29 04:09:38 | | Microsoft-Windows-Security-Auditing | 4781: The name of an account was changed: Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Target Account: Security ID: S-1-5-32-552 Account Domain: Builtin Old Account Name: Replicator New Account Name: Replicator Additional Information: Privileges: -
|
| | Security | Audit Success | 13824 | 2025-11-29 04:09:38 | | Microsoft-Windows-Security-Auditing | 4781: The name of an account was changed: Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Target Account: Security ID: S-1-5-32-555 Account Domain: Builtin Old Account Name: Remote Desktop Users New Account Name: Remote Desktop Users Additional Information: Privileges: -
|
| | Security | Audit Success | 13824 | 2025-11-29 04:09:38 | | Microsoft-Windows-Security-Auditing | 4781: The name of an account was changed: Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Target Account: Security ID: S-1-5-32-556 Account Domain: Builtin Old Account Name: Network Configuration Operators New Account Name: Network Configuration Operators Additional Information: Privileges: -
|
| | Security | Audit Success | 13824 | 2025-11-29 04:09:38 | | Microsoft-Windows-Security-Auditing | 4781: The name of an account was changed: Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Target Account: Security ID: S-1-5-32-547 Account Domain: Builtin Old Account Name: Power Users New Account Name: Power Users Additional Information: Privileges: -
|
| | Security | Audit Success | 13824 | 2025-11-29 04:09:38 | | Microsoft-Windows-Security-Auditing | 4781: The name of an account was changed: Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Target Account: Security ID: S-1-5-32-558 Account Domain: Builtin Old Account Name: Performance Monitor Users New Account Name: Performance Monitor Users Additional Information: Privileges: -
|
| | Security | Audit Success | 13824 | 2025-11-29 04:09:38 | | Microsoft-Windows-Security-Auditing | 4781: The name of an account was changed: Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Target Account: Security ID: S-1-5-32-559 Account Domain: Builtin Old Account Name: Performance Log Users New Account Name: Performance Log Users Additional Information: Privileges: -
|
| | Security | Audit Success | 13824 | 2025-11-29 04:09:38 | | Microsoft-Windows-Security-Auditing | 4781: The name of an account was changed: Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Target Account: Security ID: S-1-5-32-562 Account Domain: Builtin Old Account Name: Distributed COM Users New Account Name: Distributed COM Users Additional Information: Privileges: -
|
| | Security | Audit Success | 13824 | 2025-11-29 04:09:38 | | Microsoft-Windows-Security-Auditing | 4781: The name of an account was changed: Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Target Account: Security ID: S-1-5-32-568 Account Domain: Builtin Old Account Name: IIS_IUSRS New Account Name: IIS_IUSRS Additional Information: Privileges: -
|
| | Security | Audit Success | 13824 | 2025-11-29 04:09:38 | | Microsoft-Windows-Security-Auditing | 4781: The name of an account was changed: Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Target Account: Security ID: S-1-5-32-569 Account Domain: Builtin Old Account Name: Cryptographic Operators New Account Name: Cryptographic Operators Additional Information: Privileges: -
|
| | Security | Audit Success | 13824 | 2025-11-29 04:09:38 | | Microsoft-Windows-Security-Auditing | 4781: The name of an account was changed: Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Target Account: Security ID: S-1-5-32-573 Account Domain: Builtin Old Account Name: Event Log Readers New Account Name: Event Log Readers Additional Information: Privileges: -
|
| | Security | Audit Success | 13824 | 2025-11-29 04:09:38 | | Microsoft-Windows-Security-Auditing | 4781: The name of an account was changed: Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Target Account: Security ID: S-1-5-32-578 Account Domain: Builtin Old Account Name: Hyper-V Administrators New Account Name: Hyper-V Administrators Additional Information: Privileges: -
|
| | Security | Audit Success | 13824 | 2025-11-29 04:09:38 | | Microsoft-Windows-Security-Auditing | 4781: The name of an account was changed: Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Target Account: Security ID: S-1-5-32-579 Account Domain: Builtin Old Account Name: Access Control Assistance Operators New Account Name: Access Control Assistance Operators Additional Information: Privileges: -
|
| | Security | Audit Success | 13824 | 2025-11-29 04:09:38 | | Microsoft-Windows-Security-Auditing | 4781: The name of an account was changed: Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Target Account: Security ID: S-1-5-32-580 Account Domain: Builtin Old Account Name: Remote Management Users New Account Name: Remote Management Users Additional Information: Privileges: -
|
| | Security | Audit Success | 13824 | 2025-11-29 04:09:38 | | Microsoft-Windows-Security-Auditing | 4781: The name of an account was changed: Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Target Account: Security ID: S-1-5-32-581 Account Domain: Builtin Old Account Name: System Managed Accounts Group New Account Name: System Managed Accounts Group Additional Information: Privileges: -
|
| | Security | Audit Success | 13824 | 2025-11-29 04:09:38 | | Microsoft-Windows-Security-Auditing | 4781: The name of an account was changed: Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Target Account: Security ID: S-1-5-32-583 Account Domain: Builtin Old Account Name: Device Owners New Account Name: Device Owners Additional Information: Privileges: -
|
| | Security | Audit Success | 13824 | 2025-11-29 04:09:38 | | Microsoft-Windows-Security-Auditing | 4781: The name of an account was changed: Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Target Account: Security ID: S-1-5-32-584 Account Domain: Builtin Old Account Name: User Mode Hardware Operators New Account Name: User Mode Hardware Operators Additional Information: Privileges: -
|
| | Security | Audit Success | 13824 | 2025-11-29 04:09:38 | | Microsoft-Windows-Security-Auditing | 4781: The name of an account was changed: Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Target Account: Security ID: S-1-5-32-585 Account Domain: Builtin Old Account Name: OpenSSH Users New Account Name: OpenSSH Users Additional Information: Privileges: -
|
| | Security | Audit Success | 13824 | 2025-11-29 04:09:38 | | Microsoft-Windows-Security-Auditing | 4738: A user account was changed. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Target Account: Security ID: S-1-5-21-2954332259-1466799094-2054226798-500 Account Name: Administrator Account Domain: DESKTOP-0JV7HJV Changed Attributes: SAM Account Name: Administrator Display Name: %%1793 User Principal Name: - Home Directory: %%1793 Home Drive: %%1793 Script Path: %%1793 Profile Path: %%1793 User Workstations: %%1793 Password Last Set: %%1794 Account Expires: %%1794 Primary Group ID: 513 AllowedToDelegateTo: - Old UAC Value: 0x211 New UAC Value: 0x211 User Account Control: - User Parameters: %%1793 SID History: - Logon Hours: %%1797 Additional Information: Privileges: -
|
| | Security | Audit Success | 13824 | 2025-11-29 04:09:38 | | Microsoft-Windows-Security-Auditing | 4738: A user account was changed. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Target Account: Security ID: S-1-5-21-2954332259-1466799094-2054226798-500 Account Name: Administrator Account Domain: DESKTOP-0JV7HJV Changed Attributes: SAM Account Name: Administrator Display Name: %%1793 User Principal Name: - Home Directory: %%1793 Home Drive: %%1793 Script Path: %%1793 Profile Path: %%1793 User Workstations: %%1793 Password Last Set: %%1794 Account Expires: %%1794 Primary Group ID: 513 AllowedToDelegateTo: - Old UAC Value: 0x211 New UAC Value: 0x211 User Account Control: - User Parameters: %%1793 SID History: - Logon Hours: %%1797 Additional Information: Privileges: -
|
| | Security | Audit Success | 13824 | 2025-11-29 04:09:38 | | Microsoft-Windows-Security-Auditing | 4738: A user account was changed. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Target Account: Security ID: S-1-5-21-2954332259-1466799094-2054226798-501 Account Name: Guest Account Domain: DESKTOP-0JV7HJV Changed Attributes: SAM Account Name: Guest Display Name: %%1793 User Principal Name: - Home Directory: %%1793 Home Drive: %%1793 Script Path: %%1793 Profile Path: %%1793 User Workstations: %%1793 Password Last Set: %%1794 Account Expires: %%1794 Primary Group ID: 513 AllowedToDelegateTo: - Old UAC Value: 0x215 New UAC Value: 0x215 User Account Control: - User Parameters: %%1793 SID History: - Logon Hours: %%1797 Additional Information: Privileges: -
|
| | Security | Audit Success | 13824 | 2025-11-29 04:09:38 | | Microsoft-Windows-Security-Auditing | 4738: A user account was changed. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Target Account: Security ID: S-1-5-21-2954332259-1466799094-2054226798-501 Account Name: Guest Account Domain: DESKTOP-0JV7HJV Changed Attributes: SAM Account Name: Guest Display Name: %%1793 User Principal Name: - Home Directory: %%1793 Home Drive: %%1793 Script Path: %%1793 Profile Path: %%1793 User Workstations: %%1793 Password Last Set: %%1794 Account Expires: %%1794 Primary Group ID: 513 AllowedToDelegateTo: - Old UAC Value: 0x215 New UAC Value: 0x215 User Account Control: - User Parameters: %%1793 SID History: - Logon Hours: %%1797 Additional Information: Privileges: -
|
| | Security | Audit Success | 13824 | 2025-11-29 04:09:38 | | Microsoft-Windows-Security-Auditing | 4738: A user account was changed. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Target Account: Security ID: S-1-5-21-2954332259-1466799094-2054226798-503 Account Name: DefaultAccount Account Domain: DESKTOP-0JV7HJV Changed Attributes: SAM Account Name: DefaultAccount Display Name: %%1793 User Principal Name: - Home Directory: %%1793 Home Drive: %%1793 Script Path: %%1793 Profile Path: %%1793 User Workstations: %%1793 Password Last Set: %%1794 Account Expires: %%1794 Primary Group ID: 513 AllowedToDelegateTo: - Old UAC Value: 0x215 New UAC Value: 0x215 User Account Control: - User Parameters: %%1793 SID History: - Logon Hours: %%1797 Additional Information: Privileges: -
|
| | Security | Audit Success | 13824 | 2025-11-29 04:09:38 | | Microsoft-Windows-Security-Auditing | 4738: A user account was changed. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Target Account: Security ID: S-1-5-21-2954332259-1466799094-2054226798-503 Account Name: DefaultAccount Account Domain: DESKTOP-0JV7HJV Changed Attributes: SAM Account Name: DefaultAccount Display Name: %%1793 User Principal Name: - Home Directory: %%1793 Home Drive: %%1793 Script Path: %%1793 Profile Path: %%1793 User Workstations: %%1793 Password Last Set: %%1794 Account Expires: %%1794 Primary Group ID: 513 AllowedToDelegateTo: - Old UAC Value: 0x215 New UAC Value: 0x215 User Account Control: - User Parameters: %%1793 SID History: - Logon Hours: %%1797 Additional Information: Privileges: -
|
| | Security | Audit Success | 13824 | 2025-11-29 04:09:38 | | Microsoft-Windows-Security-Auditing | 4738: A user account was changed. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Target Account: Security ID: S-1-5-21-2954332259-1466799094-2054226798-504 Account Name: WDAGUtilityAccount Account Domain: DESKTOP-0JV7HJV Changed Attributes: SAM Account Name: WDAGUtilityAccount Display Name: %%1793 User Principal Name: - Home Directory: %%1793 Home Drive: %%1793 Script Path: %%1793 Profile Path: %%1793 User Workstations: %%1793 Password Last Set: 11/29/2025 4:06:14 AM Account Expires: %%1794 Primary Group ID: 513 AllowedToDelegateTo: - Old UAC Value: 0x11 New UAC Value: 0x11 User Account Control: - User Parameters: %%1793 SID History: - Logon Hours: %%1797 Additional Information: Privileges: -
|
| | Security | Audit Success | 13824 | 2025-11-29 04:09:38 | | Microsoft-Windows-Security-Auditing | 4738: A user account was changed. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Target Account: Security ID: S-1-5-21-2954332259-1466799094-2054226798-504 Account Name: WDAGUtilityAccount Account Domain: DESKTOP-0JV7HJV Changed Attributes: SAM Account Name: WDAGUtilityAccount Display Name: %%1793 User Principal Name: - Home Directory: %%1793 Home Drive: %%1793 Script Path: %%1793 Profile Path: %%1793 User Workstations: %%1793 Password Last Set: 11/29/2025 4:06:14 AM Account Expires: %%1794 Primary Group ID: 513 AllowedToDelegateTo: - Old UAC Value: 0x11 New UAC Value: 0x11 User Account Control: - User Parameters: %%1793 SID History: - Logon Hours: %%1797 Additional Information: Privileges: -
|
| | Security | Audit Success | 13824 | 2025-11-29 04:09:38 | | Microsoft-Windows-Security-Auditing | 4781: The name of an account was changed: Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Target Account: Security ID: S-1-5-21-2954332259-1466799094-2054226798-513 Account Domain: DESKTOP-0JV7HJV Old Account Name: None New Account Name: None Additional Information: Privileges: -
|
| | Security | Audit Success | 13824 | 2025-11-29 04:09:38 | | Microsoft-Windows-Security-Auditing | 4798: A user's local group membership was enumerated. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 User: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1000 Account Name: defaultuser0 Account Domain: DESKTOP-0JV7HJV Process Information: Process ID: 0x50c Process Name: C:\Windows\System32\lsass.exe
|
| | Security | Audit Success | 13824 | 2025-11-29 04:09:38 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13826 | 2025-11-29 04:09:38 | | Microsoft-Windows-Security-Auditing | 4735: A security-enabled local group was changed. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Group: Security ID: S-1-5-32-544 Group Name: Administrators Group Domain: Builtin Changed Attributes: SAM Account Name: - SID History: - Additional Information: Privileges: -
|
| | Security | Audit Success | 13826 | 2025-11-29 04:09:38 | | Microsoft-Windows-Security-Auditing | 4735: A security-enabled local group was changed. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Group: Security ID: S-1-5-32-544 Group Name: Administrators Group Domain: Builtin Changed Attributes: SAM Account Name: Administrators SID History: - Additional Information: Privileges: -
|
| | Security | Audit Success | 13826 | 2025-11-29 04:09:38 | | Microsoft-Windows-Security-Auditing | 4735: A security-enabled local group was changed. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Group: Security ID: S-1-5-32-545 Group Name: Users Group Domain: Builtin Changed Attributes: SAM Account Name: - SID History: - Additional Information: Privileges: -
|
| | Security | Audit Success | 13826 | 2025-11-29 04:09:38 | | Microsoft-Windows-Security-Auditing | 4735: A security-enabled local group was changed. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Group: Security ID: S-1-5-32-545 Group Name: Users Group Domain: Builtin Changed Attributes: SAM Account Name: Users SID History: - Additional Information: Privileges: -
|
| | Security | Audit Success | 13826 | 2025-11-29 04:09:38 | | Microsoft-Windows-Security-Auditing | 4735: A security-enabled local group was changed. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Group: Security ID: S-1-5-32-546 Group Name: Guests Group Domain: Builtin Changed Attributes: SAM Account Name: - SID History: - Additional Information: Privileges: -
|
| | Security | Audit Success | 13826 | 2025-11-29 04:09:38 | | Microsoft-Windows-Security-Auditing | 4735: A security-enabled local group was changed. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Group: Security ID: S-1-5-32-546 Group Name: Guests Group Domain: Builtin Changed Attributes: SAM Account Name: Guests SID History: - Additional Information: Privileges: -
|
| | Security | Audit Success | 13826 | 2025-11-29 04:09:38 | | Microsoft-Windows-Security-Auditing | 4735: A security-enabled local group was changed. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Group: Security ID: S-1-5-32-551 Group Name: Backup Operators Group Domain: Builtin Changed Attributes: SAM Account Name: - SID History: - Additional Information: Privileges: -
|
| | Security | Audit Success | 13826 | 2025-11-29 04:09:38 | | Microsoft-Windows-Security-Auditing | 4735: A security-enabled local group was changed. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Group: Security ID: S-1-5-32-551 Group Name: Backup Operators Group Domain: Builtin Changed Attributes: SAM Account Name: Backup Operators SID History: - Additional Information: Privileges: -
|
| | Security | Audit Success | 13826 | 2025-11-29 04:09:38 | | Microsoft-Windows-Security-Auditing | 4735: A security-enabled local group was changed. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Group: Security ID: S-1-5-32-552 Group Name: Replicator Group Domain: Builtin Changed Attributes: SAM Account Name: - SID History: - Additional Information: Privileges: -
|
| | Security | Audit Success | 13826 | 2025-11-29 04:09:38 | | Microsoft-Windows-Security-Auditing | 4735: A security-enabled local group was changed. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Group: Security ID: S-1-5-32-552 Group Name: Replicator Group Domain: Builtin Changed Attributes: SAM Account Name: Replicator SID History: - Additional Information: Privileges: -
|
| | Security | Audit Success | 13826 | 2025-11-29 04:09:38 | | Microsoft-Windows-Security-Auditing | 4735: A security-enabled local group was changed. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Group: Security ID: S-1-5-32-555 Group Name: Remote Desktop Users Group Domain: Builtin Changed Attributes: SAM Account Name: - SID History: - Additional Information: Privileges: -
|
| | Security | Audit Success | 13826 | 2025-11-29 04:09:38 | | Microsoft-Windows-Security-Auditing | 4735: A security-enabled local group was changed. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Group: Security ID: S-1-5-32-555 Group Name: Remote Desktop Users Group Domain: Builtin Changed Attributes: SAM Account Name: Remote Desktop Users SID History: - Additional Information: Privileges: -
|
| | Security | Audit Success | 13826 | 2025-11-29 04:09:38 | | Microsoft-Windows-Security-Auditing | 4735: A security-enabled local group was changed. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Group: Security ID: S-1-5-32-556 Group Name: Network Configuration Operators Group Domain: Builtin Changed Attributes: SAM Account Name: - SID History: - Additional Information: Privileges: -
|
| | Security | Audit Success | 13826 | 2025-11-29 04:09:38 | | Microsoft-Windows-Security-Auditing | 4735: A security-enabled local group was changed. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Group: Security ID: S-1-5-32-556 Group Name: Network Configuration Operators Group Domain: Builtin Changed Attributes: SAM Account Name: Network Configuration Operators SID History: - Additional Information: Privileges: -
|
| | Security | Audit Success | 13826 | 2025-11-29 04:09:38 | | Microsoft-Windows-Security-Auditing | 4735: A security-enabled local group was changed. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Group: Security ID: S-1-5-32-547 Group Name: Power Users Group Domain: Builtin Changed Attributes: SAM Account Name: - SID History: - Additional Information: Privileges: -
|
| | Security | Audit Success | 13826 | 2025-11-29 04:09:38 | | Microsoft-Windows-Security-Auditing | 4735: A security-enabled local group was changed. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Group: Security ID: S-1-5-32-547 Group Name: Power Users Group Domain: Builtin Changed Attributes: SAM Account Name: Power Users SID History: - Additional Information: Privileges: -
|
| | Security | Audit Success | 13826 | 2025-11-29 04:09:38 | | Microsoft-Windows-Security-Auditing | 4799: A security-enabled local group membership was enumerated. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Group: Security ID: S-1-5-32-544 Group Name: Administrators Group Domain: Builtin Process Information: Process ID: 0x848 Process Name: C:\Windows\System32\oobe\msoobe.exe
|
| | Security | Audit Success | 13826 | 2025-11-29 04:09:38 | | Microsoft-Windows-Security-Auditing | 4735: A security-enabled local group was changed. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Group: Security ID: S-1-5-32-558 Group Name: Performance Monitor Users Group Domain: Builtin Changed Attributes: SAM Account Name: - SID History: - Additional Information: Privileges: -
|
| | Security | Audit Success | 13826 | 2025-11-29 04:09:38 | | Microsoft-Windows-Security-Auditing | 4799: A security-enabled local group membership was enumerated. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Group: Security ID: S-1-5-32-544 Group Name: Administrators Group Domain: Builtin Process Information: Process ID: 0x848 Process Name: C:\Windows\System32\oobe\msoobe.exe
|
| | Security | Audit Success | 13826 | 2025-11-29 04:09:38 | | Microsoft-Windows-Security-Auditing | 4735: A security-enabled local group was changed. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Group: Security ID: S-1-5-32-558 Group Name: Performance Monitor Users Group Domain: Builtin Changed Attributes: SAM Account Name: Performance Monitor Users SID History: - Additional Information: Privileges: -
|
| | Security | Audit Success | 13826 | 2025-11-29 04:09:38 | | Microsoft-Windows-Security-Auditing | 4735: A security-enabled local group was changed. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Group: Security ID: S-1-5-32-559 Group Name: Performance Log Users Group Domain: Builtin Changed Attributes: SAM Account Name: - SID History: - Additional Information: Privileges: -
|
| | Security | Audit Success | 13826 | 2025-11-29 04:09:38 | | Microsoft-Windows-Security-Auditing | 4735: A security-enabled local group was changed. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Group: Security ID: S-1-5-32-559 Group Name: Performance Log Users Group Domain: Builtin Changed Attributes: SAM Account Name: Performance Log Users SID History: - Additional Information: Privileges: -
|
| | Security | Audit Success | 13826 | 2025-11-29 04:09:38 | | Microsoft-Windows-Security-Auditing | 4735: A security-enabled local group was changed. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Group: Security ID: S-1-5-32-562 Group Name: Distributed COM Users Group Domain: Builtin Changed Attributes: SAM Account Name: - SID History: - Additional Information: Privileges: -
|
| | Security | Audit Success | 13826 | 2025-11-29 04:09:38 | | Microsoft-Windows-Security-Auditing | 4735: A security-enabled local group was changed. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Group: Security ID: S-1-5-32-562 Group Name: Distributed COM Users Group Domain: Builtin Changed Attributes: SAM Account Name: Distributed COM Users SID History: - Additional Information: Privileges: -
|
| | Security | Audit Success | 13826 | 2025-11-29 04:09:38 | | Microsoft-Windows-Security-Auditing | 4735: A security-enabled local group was changed. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Group: Security ID: S-1-5-32-568 Group Name: IIS_IUSRS Group Domain: Builtin Changed Attributes: SAM Account Name: - SID History: - Additional Information: Privileges: -
|
| | Security | Audit Success | 13826 | 2025-11-29 04:09:38 | | Microsoft-Windows-Security-Auditing | 4735: A security-enabled local group was changed. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Group: Security ID: S-1-5-32-568 Group Name: IIS_IUSRS Group Domain: Builtin Changed Attributes: SAM Account Name: IIS_IUSRS SID History: - Additional Information: Privileges: -
|
| | Security | Audit Success | 13826 | 2025-11-29 04:09:38 | | Microsoft-Windows-Security-Auditing | 4735: A security-enabled local group was changed. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Group: Security ID: S-1-5-32-569 Group Name: Cryptographic Operators Group Domain: Builtin Changed Attributes: SAM Account Name: - SID History: - Additional Information: Privileges: -
|
| | Security | Audit Success | 13826 | 2025-11-29 04:09:38 | | Microsoft-Windows-Security-Auditing | 4735: A security-enabled local group was changed. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Group: Security ID: S-1-5-32-569 Group Name: Cryptographic Operators Group Domain: Builtin Changed Attributes: SAM Account Name: Cryptographic Operators SID History: - Additional Information: Privileges: -
|
| | Security | Audit Success | 13826 | 2025-11-29 04:09:38 | | Microsoft-Windows-Security-Auditing | 4735: A security-enabled local group was changed. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Group: Security ID: S-1-5-32-573 Group Name: Event Log Readers Group Domain: Builtin Changed Attributes: SAM Account Name: - SID History: - Additional Information: Privileges: -
|
| | Security | Audit Success | 13826 | 2025-11-29 04:09:38 | | Microsoft-Windows-Security-Auditing | 4735: A security-enabled local group was changed. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Group: Security ID: S-1-5-32-573 Group Name: Event Log Readers Group Domain: Builtin Changed Attributes: SAM Account Name: Event Log Readers SID History: - Additional Information: Privileges: -
|
| | Security | Audit Success | 13826 | 2025-11-29 04:09:38 | | Microsoft-Windows-Security-Auditing | 4735: A security-enabled local group was changed. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Group: Security ID: S-1-5-32-578 Group Name: Hyper-V Administrators Group Domain: Builtin Changed Attributes: SAM Account Name: - SID History: - Additional Information: Privileges: -
|
| | Security | Audit Success | 13826 | 2025-11-29 04:09:38 | | Microsoft-Windows-Security-Auditing | 4735: A security-enabled local group was changed. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Group: Security ID: S-1-5-32-578 Group Name: Hyper-V Administrators Group Domain: Builtin Changed Attributes: SAM Account Name: Hyper-V Administrators SID History: - Additional Information: Privileges: -
|
| | Security | Audit Success | 13826 | 2025-11-29 04:09:38 | | Microsoft-Windows-Security-Auditing | 4735: A security-enabled local group was changed. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Group: Security ID: S-1-5-32-579 Group Name: Access Control Assistance Operators Group Domain: Builtin Changed Attributes: SAM Account Name: - SID History: - Additional Information: Privileges: -
|
| | Security | Audit Success | 13826 | 2025-11-29 04:09:38 | | Microsoft-Windows-Security-Auditing | 4735: A security-enabled local group was changed. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Group: Security ID: S-1-5-32-579 Group Name: Access Control Assistance Operators Group Domain: Builtin Changed Attributes: SAM Account Name: Access Control Assistance Operators SID History: - Additional Information: Privileges: -
|
| | Security | Audit Success | 13826 | 2025-11-29 04:09:38 | | Microsoft-Windows-Security-Auditing | 4735: A security-enabled local group was changed. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Group: Security ID: S-1-5-32-580 Group Name: Remote Management Users Group Domain: Builtin Changed Attributes: SAM Account Name: - SID History: - Additional Information: Privileges: -
|
| | Security | Audit Success | 13826 | 2025-11-29 04:09:38 | | Microsoft-Windows-Security-Auditing | 4735: A security-enabled local group was changed. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Group: Security ID: S-1-5-32-580 Group Name: Remote Management Users Group Domain: Builtin Changed Attributes: SAM Account Name: Remote Management Users SID History: - Additional Information: Privileges: -
|
| | Security | Audit Success | 13826 | 2025-11-29 04:09:38 | | Microsoft-Windows-Security-Auditing | 4732: A member was added to a security-enabled local group. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Member: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1000 Account Name: - Group: Security ID: S-1-5-32-544 Group Name: Administrators Group Domain: Builtin Additional Information: Privileges: - Expiration time: (null)
|
| | Security | Audit Success | 13826 | 2025-11-29 04:09:38 | | Microsoft-Windows-Security-Auditing | 4735: A security-enabled local group was changed. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Group: Security ID: S-1-5-32-581 Group Name: System Managed Accounts Group Group Domain: Builtin Changed Attributes: SAM Account Name: - SID History: - Additional Information: Privileges: -
|
| | Security | Audit Success | 13826 | 2025-11-29 04:09:38 | | Microsoft-Windows-Security-Auditing | 4735: A security-enabled local group was changed. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Group: Security ID: S-1-5-32-581 Group Name: System Managed Accounts Group Group Domain: Builtin Changed Attributes: SAM Account Name: System Managed Accounts Group SID History: - Additional Information: Privileges: -
|
| | Security | Audit Success | 13826 | 2025-11-29 04:09:38 | | Microsoft-Windows-Security-Auditing | 4735: A security-enabled local group was changed. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Group: Security ID: S-1-5-32-583 Group Name: Device Owners Group Domain: Builtin Changed Attributes: SAM Account Name: - SID History: - Additional Information: Privileges: -
|
| | Security | Audit Success | 13826 | 2025-11-29 04:09:38 | | Microsoft-Windows-Security-Auditing | 4735: A security-enabled local group was changed. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Group: Security ID: S-1-5-32-583 Group Name: Device Owners Group Domain: Builtin Changed Attributes: SAM Account Name: Device Owners SID History: - Additional Information: Privileges: -
|
| | Security | Audit Success | 13826 | 2025-11-29 04:09:38 | | Microsoft-Windows-Security-Auditing | 4735: A security-enabled local group was changed. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Group: Security ID: S-1-5-32-584 Group Name: User Mode Hardware Operators Group Domain: Builtin Changed Attributes: SAM Account Name: - SID History: - Additional Information: Privileges: -
|
| | Security | Audit Success | 13826 | 2025-11-29 04:09:38 | | Microsoft-Windows-Security-Auditing | 4735: A security-enabled local group was changed. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Group: Security ID: S-1-5-32-584 Group Name: User Mode Hardware Operators Group Domain: Builtin Changed Attributes: SAM Account Name: User Mode Hardware Operators SID History: - Additional Information: Privileges: -
|
| | Security | Audit Success | 13826 | 2025-11-29 04:09:38 | | Microsoft-Windows-Security-Auditing | 4735: A security-enabled local group was changed. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Group: Security ID: S-1-5-32-585 Group Name: OpenSSH Users Group Domain: Builtin Changed Attributes: SAM Account Name: - SID History: - Additional Information: Privileges: -
|
| | Security | Audit Success | 13826 | 2025-11-29 04:09:38 | | Microsoft-Windows-Security-Auditing | 4735: A security-enabled local group was changed. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Group: Security ID: S-1-5-32-585 Group Name: OpenSSH Users Group Domain: Builtin Changed Attributes: SAM Account Name: OpenSSH Users SID History: - Additional Information: Privileges: -
|
| | Security | Audit Success | 13826 | 2025-11-29 04:09:38 | | Microsoft-Windows-Security-Auditing | 4799: A security-enabled local group membership was enumerated. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Group: Security ID: S-1-5-32-544 Group Name: Administrators Group Domain: Builtin Process Information: Process ID: 0x848 Process Name: C:\Windows\System32\oobe\msoobe.exe
|
| | Security | Audit Success | 13826 | 2025-11-29 04:09:38 | | Microsoft-Windows-Security-Auditing | 4799: A security-enabled local group membership was enumerated. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Group: Security ID: S-1-5-32-544 Group Name: Administrators Group Domain: Builtin Process Information: Process ID: 0x848 Process Name: C:\Windows\System32\oobe\msoobe.exe
|
| | Security | Audit Success | 13826 | 2025-11-29 04:09:38 | | Microsoft-Windows-Security-Auditing | 4737: A security-enabled global group was changed. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Group: Security ID: S-1-5-21-2954332259-1466799094-2054226798-513 Group Name: None Group Domain: DESKTOP-0JV7HJV Changed Attributes: SAM Account Name: - SID History: - Additional Information: Privileges: -
|
| | Security | Audit Success | 13826 | 2025-11-29 04:09:38 | | Microsoft-Windows-Security-Auditing | 4737: A security-enabled global group was changed. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Group: Security ID: S-1-5-21-2954332259-1466799094-2054226798-513 Group Name: None Group Domain: DESKTOP-0JV7HJV Changed Attributes: SAM Account Name: None SID History: - Additional Information: Privileges: -
|
| | Security | Audit Success | 13826 | 2025-11-29 04:09:38 | | Microsoft-Windows-Security-Auditing | 4799: A security-enabled local group membership was enumerated. Subject: Security ID: S-1-5-20 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e4 Group: Security ID: S-1-5-32-544 Group Name: Administrators Group Domain: Builtin Process Information: Process ID: 0xa70 Process Name: C:\Windows\System32\svchost.exe
|
| | Security | Audit Success | 13826 | 2025-11-29 04:09:38 | | Microsoft-Windows-Security-Auditing | 4799: A security-enabled local group membership was enumerated. Subject: Security ID: S-1-5-20 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e4 Group: Security ID: S-1-5-32-551 Group Name: Backup Operators Group Domain: Builtin Process Information: Process ID: 0xa70 Process Name: C:\Windows\System32\svchost.exe
|
| | Security | Audit Success | 12292 | 2025-11-29 04:09:39 | | Microsoft-Windows-Security-Auditing | 5024: The Windows Firewall service started successfully.
|
| | Security | Audit Success | 12544 | 2025-11-29 04:09:39 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4f8 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12545 | 2025-11-29 04:09:39 | | Microsoft-Windows-Security-Auditing | 4634: An account was logged off. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1000 Account Name: defaultuser0 Account Domain: DESKTOP-0JV7HJV Logon ID: 0x23a18 Logon Type: 2 This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
|
| | Security | Audit Success | 12545 | 2025-11-29 04:09:39 | | Microsoft-Windows-Security-Auditing | 4634: An account was logged off. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1000 Account Name: defaultuser0 Account Domain: DESKTOP-0JV7HJV Logon ID: 0x23921 Logon Type: 2 This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
|
| | Security | Audit Success | 12548 | 2025-11-29 04:09:39 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 13568 | 2025-11-29 04:09:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\Temp\winre\ExtractedFromWim Handle ID: 0x924 Process Information: Process ID: 0x848 Process Name: C:\Windows\System32\oobe\msoobe.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13826 | 2025-11-29 04:09:39 | | Microsoft-Windows-Security-Auditing | 4799: A security-enabled local group membership was enumerated. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Group: Security ID: S-1-5-32-544 Group Name: Administrators Group Domain: Builtin Process Information: Process ID: 0x750 Process Name: C:\Windows\System32\svchost.exe
|
| | Security | Audit Success | 12544 | 2025-11-29 04:09:42 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4f8 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-29 04:09:42 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4f8 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12548 | 2025-11-29 04:09:42 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-29 04:09:42 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 13826 | 2025-11-29 04:09:42 | | Microsoft-Windows-Security-Auditing | 4799: A security-enabled local group membership was enumerated. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Group: Security ID: S-1-5-32-544 Group Name: Administrators Group Domain: Builtin Process Information: Process ID: 0xa38 Process Name: C:\Windows\System32\SearchIndexer.exe
|
| | Security | Audit Success | 13826 | 2025-11-29 04:09:42 | | Microsoft-Windows-Security-Auditing | 4799: A security-enabled local group membership was enumerated. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Group: Security ID: S-1-5-32-551 Group Name: Backup Operators Group Domain: Builtin Process Information: Process ID: 0xa38 Process Name: C:\Windows\System32\SearchIndexer.exe
|
| | Security | Audit Success | 12544 | 2025-11-29 04:09:47 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4f8 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12548 | 2025-11-29 04:09:47 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 13826 | 2025-11-29 04:09:48 | | Microsoft-Windows-Security-Auditing | 4799: A security-enabled local group membership was enumerated. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Group: Security ID: S-1-5-32-544 Group Name: Administrators Group Domain: Builtin Process Information: Process ID: 0x1038 Process Name: C:\Windows\System32\svchost.exe
|
| | Security | Audit Success | 13826 | 2025-11-29 04:09:48 | | Microsoft-Windows-Security-Auditing | 4799: A security-enabled local group membership was enumerated. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Group: Security ID: S-1-5-32-551 Group Name: Backup Operators Group Domain: Builtin Process Information: Process ID: 0x1038 Process Name: C:\Windows\System32\svchost.exe
|
| | Security | Audit Success | 12544 | 2025-11-29 04:09:50 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4f8 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12548 | 2025-11-29 04:09:50 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12544 | 2025-11-29 04:09:51 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4f8 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-29 04:09:51 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4f8 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12548 | 2025-11-29 04:09:51 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-29 04:09:51 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 13824 | 2025-11-29 04:09:51 | | Microsoft-Windows-Security-Auditing | 4798: A user's local group membership was enumerated. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 User: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1000 Account Name: defaultuser0 Account Domain: DESKTOP-0JV7HJV Process Information: Process ID: 0x16c4 Process Name: C:\Windows\System32\DeviceCensus.exe
|
| | Security | Audit Success | 12544 | 2025-11-29 04:09:52 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4f8 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-29 04:09:52 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4f8 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-29 04:09:52 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4f8 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-29 04:09:52 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4f8 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-29 04:09:52 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4f8 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12548 | 2025-11-29 04:09:52 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-29 04:09:52 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-29 04:09:52 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-29 04:09:52 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-29 04:09:52 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 13824 | 2025-11-29 04:09:52 | | Microsoft-Windows-Security-Auditing | 5382: Vault credentials were read. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 This event occurs when a user reads a stored vault credential.
|
| | Security | Audit Success | 12544 | 2025-11-29 04:09:53 | | Microsoft-Windows-Security-Auditing | 4648: A logon was attempted using explicit credentials. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon GUID: {00000000-0000-0000-0000-000000000000} Account Whose Credentials Were Used: Account Name: defaultuser0 Account Domain: DESKTOP-0JV7HJV Logon GUID: {00000000-0000-0000-0000-000000000000} Target Server: Target Server Name: localhost Additional Information: localhost Process Information: Process ID: 0x7a8 Process Name: C:\Windows\System32\svchost.exe Network Information: Network Address: 127.0.0.1 Port: 0 This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
|
| | Security | Audit Success | 12544 | 2025-11-29 04:09:53 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 2 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1000 Account Name: defaultuser0 Account Domain: DESKTOP-0JV7HJV Logon ID: 0x65ee4 Linked Logon ID: 0x65f81 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x7a8 Process Name: C:\Windows\System32\svchost.exe Network Information: Workstation Name: WIN-GH7MCVI2372 Source Network Address: 127.0.0.1 Source Port: 0 Detailed Authentication Information: Logon Process: User32 Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-29 04:09:53 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 2 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1843 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1000 Account Name: defaultuser0 Account Domain: DESKTOP-0JV7HJV Logon ID: 0x65f81 Linked Logon ID: 0x65ee4 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x7a8 Process Name: C:\Windows\System32\svchost.exe Network Information: Workstation Name: WIN-GH7MCVI2372 Source Network Address: 127.0.0.1 Source Port: 0 Detailed Authentication Information: Logon Process: User32 Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12548 | 2025-11-29 04:09:53 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1000 Account Name: defaultuser0 Account Domain: DESKTOP-0JV7HJV Logon ID: 0x65ee4 Privileges: SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 13824 | 2025-11-29 04:09:53 | | Microsoft-Windows-Security-Auditing | 4798: A user's local group membership was enumerated. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 User: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1000 Account Name: defaultuser0 Account Domain: DESKTOP-0JV7HJV Process Information: Process ID: 0x50c Process Name: C:\Windows\System32\lsass.exe
|
| | Security | Audit Success | 13826 | 2025-11-29 04:09:53 | | Microsoft-Windows-Security-Auditing | 4799: A security-enabled local group membership was enumerated. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Group: Security ID: S-1-5-32-544 Group Name: Administrators Group Domain: Builtin Process Information: Process ID: 0x750 Process Name: C:\Windows\System32\svchost.exe
|
| | Security | Audit Failure | 12290 | 2025-11-29 04:09:54 | | Microsoft-Windows-Security-Auditing | 5061: Cryptographic operation. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1000 Account Name: defaultuser0 Account Domain: DESKTOP-0JV7HJV Logon ID: 0x65f81 Cryptographic Parameters: Provider Name: Microsoft Software Key Storage Provider Algorithm Name: UNKNOWN Key Name: Microsoft Connected Devices Platform device certificate Key Type: %%2500 Cryptographic Operation: Operation: %%2480 Return Code: 0x80090016
|
| | Security | Audit Failure | 12290 | 2025-11-29 04:09:54 | | Microsoft-Windows-Security-Auditing | 5061: Cryptographic operation. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1000 Account Name: defaultuser0 Account Domain: DESKTOP-0JV7HJV Logon ID: 0x65f81 Cryptographic Parameters: Provider Name: Microsoft Software Key Storage Provider Algorithm Name: UNKNOWN Key Name: Microsoft Connected Devices Platform device certificate Key Type: %%2500 Cryptographic Operation: Operation: %%2480 Return Code: 0x80090016
|
| | Security | Audit Failure | 12290 | 2025-11-29 04:09:54 | | Microsoft-Windows-Security-Auditing | 5061: Cryptographic operation. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1000 Account Name: defaultuser0 Account Domain: DESKTOP-0JV7HJV Logon ID: 0x65f81 Cryptographic Parameters: Provider Name: Microsoft Software Key Storage Provider Algorithm Name: UNKNOWN Key Name: Microsoft Connected Devices Platform device certificate Key Type: %%2500 Cryptographic Operation: Operation: %%2480 Return Code: 0x80090016
|
| | Security | Audit Success | 12290 | 2025-11-29 04:09:54 | | Microsoft-Windows-Security-Auditing | 5061: Cryptographic operation. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Cryptographic Parameters: Provider Name: Microsoft Software Key Storage Provider Algorithm Name: RSA Key Name: f8df15d9-56fa-0cb3-682b-838ed74af121 Key Type: %%2500 Cryptographic Operation: Operation: %%2480 Return Code: 0x0
|
| | Security | Audit Success | 12290 | 2025-11-29 04:09:54 | | Microsoft-Windows-Security-Auditing | 5061: Cryptographic operation. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Cryptographic Parameters: Provider Name: Microsoft Software Key Storage Provider Algorithm Name: RSA Key Name: f8df15d9-56fa-0cb3-682b-838ed74af121 Key Type: %%2500 Cryptographic Operation: Operation: %%2480 Return Code: 0x0
|
| | Security | Audit Success | 12290 | 2025-11-29 04:09:54 | | Microsoft-Windows-Security-Auditing | 5061: Cryptographic operation. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1000 Account Name: defaultuser0 Account Domain: DESKTOP-0JV7HJV Logon ID: 0x65f81 Cryptographic Parameters: Provider Name: Microsoft Software Key Storage Provider Algorithm Name: ECDSA_P256 Key Name: Microsoft Connected Devices Platform device certificate Key Type: %%2500 Cryptographic Operation: Operation: %%2481 Return Code: 0x0
|
| | Security | Audit Success | 12290 | 2025-11-29 04:09:54 | | Microsoft-Windows-Security-Auditing | 5061: Cryptographic operation. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1000 Account Name: defaultuser0 Account Domain: DESKTOP-0JV7HJV Logon ID: 0x65f81 Cryptographic Parameters: Provider Name: Microsoft Software Key Storage Provider Algorithm Name: ECDSA_P256 Key Name: Microsoft Connected Devices Platform device certificate Key Type: %%2500 Cryptographic Operation: Operation: %%2480 Return Code: 0x0
|
| | Security | Audit Success | 12290 | 2025-11-29 04:09:54 | | Microsoft-Windows-Security-Auditing | 5061: Cryptographic operation. Subject: Security ID: S-1-5-19 Account Name: LOCAL SERVICE Account Domain: NT AUTHORITY Logon ID: 0x3e5 Cryptographic Parameters: Provider Name: Microsoft Software Key Storage Provider Algorithm Name: ECDSA_P256 Key Name: Microsoft Connected Devices Platform device certificate Key Type: %%2500 Cryptographic Operation: Operation: %%2480 Return Code: 0x0
|
| | Security | Audit Success | 12292 | 2025-11-29 04:09:54 | | Microsoft-Windows-Security-Auditing | 5058: Key file operation. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Process Information: Process ID: 2332 Process Creation Time: 2025-11-29T12:09:37.8811167Z Cryptographic Parameters: Provider Name: Microsoft Software Key Storage Provider Algorithm Name: UNKNOWN Key Name: f8df15d9-56fa-0cb3-682b-838ed74af121 Key Type: %%2500 Key File Operation Information: File Path: C:\ProgramData\Microsoft\Crypto\SystemKeys\8bb43a3e92c2eb4c420c9abd6e278936_9ee7012e-fa60-42be-b8b4-8dc8b4e1280d Operation: %%2458 Return Code: 0x0
|
| | Security | Audit Success | 12292 | 2025-11-29 04:09:54 | | Microsoft-Windows-Security-Auditing | 5058: Key file operation. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Process Information: Process ID: 2332 Process Creation Time: 2025-11-29T12:09:37.8811167Z Cryptographic Parameters: Provider Name: Microsoft Software Key Storage Provider Algorithm Name: UNKNOWN Key Name: f8df15d9-56fa-0cb3-682b-838ed74af121 Key Type: %%2500 Key File Operation Information: File Path: C:\ProgramData\Microsoft\Crypto\SystemKeys\8bb43a3e92c2eb4c420c9abd6e278936_9ee7012e-fa60-42be-b8b4-8dc8b4e1280d Operation: %%2458 Return Code: 0x0
|
| | Security | Audit Success | 12292 | 2025-11-29 04:09:54 | | Microsoft-Windows-Security-Auditing | 5059: Key migration operation. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Process Information: Process ID: 2332 Process Creation Time: 2025-11-29T12:09:37.8811167Z Cryptographic Parameters: Provider Name: Microsoft Software Key Storage Provider Algorithm Name: RSA Key Name: f8df15d9-56fa-0cb3-682b-838ed74af121 Key Type: %%2500 Additional Information: Operation: %%2464 Return Code: 0x0
|
| | Security | Audit Success | 12292 | 2025-11-29 04:09:54 | | Microsoft-Windows-Security-Auditing | 5058: Key file operation. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1000 Account Name: defaultuser0 Account Domain: DESKTOP-0JV7HJV Logon ID: 0x65f81 Process Information: Process ID: 1548 Process Creation Time: 2025-11-29T12:09:54.1828602Z Cryptographic Parameters: Provider Name: Microsoft Software Key Storage Provider Algorithm Name: ECDSA_P256 Key Name: Microsoft Connected Devices Platform device certificate Key Type: %%2500 Key File Operation Information: File Path: C:\Users\defaultuser0\AppData\Roaming\Microsoft\Crypto\Keys\de7cf8a7901d2ad13e5c67c29e5d1662_9ee7012e-fa60-42be-b8b4-8dc8b4e1280d Operation: %%2459 Return Code: 0x0
|
| | Security | Audit Success | 12292 | 2025-11-29 04:09:54 | | Microsoft-Windows-Security-Auditing | 5058: Key file operation. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1000 Account Name: defaultuser0 Account Domain: DESKTOP-0JV7HJV Logon ID: 0x65f81 Process Information: Process ID: 1548 Process Creation Time: 2025-11-29T12:09:54.1828602Z Cryptographic Parameters: Provider Name: Microsoft Software Key Storage Provider Algorithm Name: UNKNOWN Key Name: Microsoft Connected Devices Platform device certificate Key Type: %%2500 Key File Operation Information: File Path: C:\Users\defaultuser0\AppData\Roaming\Microsoft\Crypto\Keys\de7cf8a7901d2ad13e5c67c29e5d1662_9ee7012e-fa60-42be-b8b4-8dc8b4e1280d Operation: %%2458 Return Code: 0x0
|
| | Security | Audit Success | 12292 | 2025-11-29 04:09:54 | | Microsoft-Windows-Security-Auditing | 5059: Key migration operation. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1000 Account Name: defaultuser0 Account Domain: DESKTOP-0JV7HJV Logon ID: 0x65f81 Process Information: Process ID: 1548 Process Creation Time: 2025-11-29T12:09:54.1828602Z Cryptographic Parameters: Provider Name: Microsoft Software Key Storage Provider Algorithm Name: ECDSA_P256 Key Name: Microsoft Connected Devices Platform device certificate Key Type: %%2500 Additional Information: Operation: %%2464 Return Code: 0x0
|
| | Security | Audit Success | 12292 | 2025-11-29 04:09:54 | | Microsoft-Windows-Security-Auditing | 5059: Key migration operation. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1000 Account Name: defaultuser0 Account Domain: DESKTOP-0JV7HJV Logon ID: 0x65f81 Process Information: Process ID: 1548 Process Creation Time: 2025-11-29T12:09:54.1828602Z Cryptographic Parameters: Provider Name: Microsoft Software Key Storage Provider Algorithm Name: ECDSA_P256 Key Name: Microsoft Connected Devices Platform device certificate Key Type: %%2500 Additional Information: Operation: %%2464 Return Code: 0x0
|
| | Security | Audit Success | 12292 | 2025-11-29 04:09:54 | | Microsoft-Windows-Security-Auditing | 5059: Key migration operation. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1000 Account Name: defaultuser0 Account Domain: DESKTOP-0JV7HJV Logon ID: 0x65f81 Process Information: Process ID: 1548 Process Creation Time: 2025-11-29T12:09:54.1828602Z Cryptographic Parameters: Provider Name: Microsoft Software Key Storage Provider Algorithm Name: ECDSA_P256 Key Name: Microsoft Connected Devices Platform device certificate Key Type: %%2500 Additional Information: Operation: %%2464 Return Code: 0x0
|
| | Security | Audit Success | 12292 | 2025-11-29 04:09:54 | | Microsoft-Windows-Security-Auditing | 5058: Key file operation. Subject: Security ID: S-1-5-19 Account Name: LOCAL SERVICE Account Domain: NT AUTHORITY Logon ID: 0x3e5 Process Information: Process ID: 6400 Process Creation Time: 2025-11-29T12:09:54.4092670Z Cryptographic Parameters: Provider Name: Microsoft Software Key Storage Provider Algorithm Name: UNKNOWN Key Name: Microsoft Connected Devices Platform device certificate Key Type: %%2500 Key File Operation Information: File Path: C:\WINDOWS\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Crypto\Keys\de7cf8a7901d2ad13e5c67c29e5d1662_9ee7012e-fa60-42be-b8b4-8dc8b4e1280d Operation: %%2458 Return Code: 0x0
|
| | Security | Audit Success | 12292 | 2025-11-29 04:09:54 | | Microsoft-Windows-Security-Auditing | 5059: Key migration operation. Subject: Security ID: S-1-5-19 Account Name: LOCAL SERVICE Account Domain: NT AUTHORITY Logon ID: 0x3e5 Process Information: Process ID: 6400 Process Creation Time: 2025-11-29T12:09:54.4092670Z Cryptographic Parameters: Provider Name: Microsoft Software Key Storage Provider Algorithm Name: ECDSA_P256 Key Name: Microsoft Connected Devices Platform device certificate Key Type: %%2500 Additional Information: Operation: %%2464 Return Code: 0x0
|
| | Security | Audit Success | 12544 | 2025-11-29 04:09:54 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4f8 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-29 04:09:54 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4f8 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-29 04:09:54 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4f8 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12548 | 2025-11-29 04:09:54 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-29 04:09:54 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-29 04:09:54 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 13824 | 2025-11-29 04:09:54 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1000 Account Name: defaultuser0 Account Domain: DESKTOP-0JV7HJV Logon ID: 0x65f81 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:09:54 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1000 Account Name: defaultuser0 Account Domain: DESKTOP-0JV7HJV Logon ID: 0x65f81 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:09:54 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:09:54 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:09:54 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:09:54 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:09:54 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1000 Account Name: defaultuser0 Account Domain: DESKTOP-0JV7HJV Logon ID: 0x65f81 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:09:54 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1000 Account Name: defaultuser0 Account Domain: DESKTOP-0JV7HJV Logon ID: 0x65f81 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:09:54 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1000 Account Name: defaultuser0 Account Domain: DESKTOP-0JV7HJV Logon ID: 0x65f81 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:09:54 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1000 Account Name: defaultuser0 Account Domain: DESKTOP-0JV7HJV Logon ID: 0x65f81 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:09:54 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1000 Account Name: defaultuser0 Account Domain: DESKTOP-0JV7HJV Logon ID: 0x65f81 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:09:54 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1000 Account Name: defaultuser0 Account Domain: DESKTOP-0JV7HJV Logon ID: 0x65f81 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:09:54 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1000 Account Name: defaultuser0 Account Domain: DESKTOP-0JV7HJV Logon ID: 0x65f81 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:09:54 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1000 Account Name: defaultuser0 Account Domain: DESKTOP-0JV7HJV Logon ID: 0x65f81 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 12290 | 2025-11-29 04:09:56 | | Microsoft-Windows-Security-Auditing | 5061: Cryptographic operation. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Cryptographic Parameters: Provider Name: Microsoft Software Key Storage Provider Algorithm Name: RSA Key Name: f8df15d9-56fa-0cb3-682b-838ed74af121 Key Type: %%2500 Cryptographic Operation: Operation: %%2480 Return Code: 0x0
|
| | Security | Audit Success | 12290 | 2025-11-29 04:09:56 | | Microsoft-Windows-Security-Auditing | 5061: Cryptographic operation. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Cryptographic Parameters: Provider Name: Microsoft Software Key Storage Provider Algorithm Name: RSA Key Name: f8df15d9-56fa-0cb3-682b-838ed74af121 Key Type: %%2500 Cryptographic Operation: Operation: %%2480 Return Code: 0x0
|
| | Security | Audit Success | 12290 | 2025-11-29 04:09:56 | | Microsoft-Windows-Security-Auditing | 5061: Cryptographic operation. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Cryptographic Parameters: Provider Name: Microsoft Software Key Storage Provider Algorithm Name: RSA Key Name: f8df15d9-56fa-0cb3-682b-838ed74af121 Key Type: %%2500 Cryptographic Operation: Operation: %%2480 Return Code: 0x0
|
| | Security | Audit Success | 12290 | 2025-11-29 04:09:56 | | Microsoft-Windows-Security-Auditing | 5061: Cryptographic operation. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Cryptographic Parameters: Provider Name: Microsoft Software Key Storage Provider Algorithm Name: RSA Key Name: f8df15d9-56fa-0cb3-682b-838ed74af121 Key Type: %%2500 Cryptographic Operation: Operation: %%2480 Return Code: 0x0
|
| | Security | Audit Success | 12292 | 2025-11-29 04:09:56 | | Microsoft-Windows-Security-Auditing | 5058: Key file operation. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Process Information: Process ID: 2332 Process Creation Time: 2025-11-29T12:09:37.8811167Z Cryptographic Parameters: Provider Name: Microsoft Software Key Storage Provider Algorithm Name: UNKNOWN Key Name: f8df15d9-56fa-0cb3-682b-838ed74af121 Key Type: %%2500 Key File Operation Information: File Path: C:\ProgramData\Microsoft\Crypto\SystemKeys\8bb43a3e92c2eb4c420c9abd6e278936_9ee7012e-fa60-42be-b8b4-8dc8b4e1280d Operation: %%2458 Return Code: 0x0
|
| | Security | Audit Success | 12292 | 2025-11-29 04:09:56 | | Microsoft-Windows-Security-Auditing | 5058: Key file operation. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Process Information: Process ID: 2332 Process Creation Time: 2025-11-29T12:09:37.8811167Z Cryptographic Parameters: Provider Name: Microsoft Software Key Storage Provider Algorithm Name: UNKNOWN Key Name: f8df15d9-56fa-0cb3-682b-838ed74af121 Key Type: %%2500 Key File Operation Information: File Path: C:\ProgramData\Microsoft\Crypto\SystemKeys\8bb43a3e92c2eb4c420c9abd6e278936_9ee7012e-fa60-42be-b8b4-8dc8b4e1280d Operation: %%2458 Return Code: 0x0
|
| | Security | Audit Success | 12292 | 2025-11-29 04:09:56 | | Microsoft-Windows-Security-Auditing | 5059: Key migration operation. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Process Information: Process ID: 2332 Process Creation Time: 2025-11-29T12:09:37.8811167Z Cryptographic Parameters: Provider Name: Microsoft Software Key Storage Provider Algorithm Name: RSA Key Name: f8df15d9-56fa-0cb3-682b-838ed74af121 Key Type: %%2500 Additional Information: Operation: %%2464 Return Code: 0x0
|
| | Security | Audit Success | 12292 | 2025-11-29 04:09:56 | | Microsoft-Windows-Security-Auditing | 5058: Key file operation. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Process Information: Process ID: 2332 Process Creation Time: 2025-11-29T12:09:37.8811167Z Cryptographic Parameters: Provider Name: Microsoft Software Key Storage Provider Algorithm Name: UNKNOWN Key Name: f8df15d9-56fa-0cb3-682b-838ed74af121 Key Type: %%2500 Key File Operation Information: File Path: C:\ProgramData\Microsoft\Crypto\SystemKeys\8bb43a3e92c2eb4c420c9abd6e278936_9ee7012e-fa60-42be-b8b4-8dc8b4e1280d Operation: %%2458 Return Code: 0x0
|
| | Security | Audit Success | 12292 | 2025-11-29 04:09:56 | | Microsoft-Windows-Security-Auditing | 5058: Key file operation. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Process Information: Process ID: 2332 Process Creation Time: 2025-11-29T12:09:37.8811167Z Cryptographic Parameters: Provider Name: Microsoft Software Key Storage Provider Algorithm Name: UNKNOWN Key Name: f8df15d9-56fa-0cb3-682b-838ed74af121 Key Type: %%2500 Key File Operation Information: File Path: C:\ProgramData\Microsoft\Crypto\SystemKeys\8bb43a3e92c2eb4c420c9abd6e278936_9ee7012e-fa60-42be-b8b4-8dc8b4e1280d Operation: %%2458 Return Code: 0x0
|
| | Security | Audit Success | 12292 | 2025-11-29 04:09:56 | | Microsoft-Windows-Security-Auditing | 5059: Key migration operation. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Process Information: Process ID: 2332 Process Creation Time: 2025-11-29T12:09:37.8811167Z Cryptographic Parameters: Provider Name: Microsoft Software Key Storage Provider Algorithm Name: RSA Key Name: f8df15d9-56fa-0cb3-682b-838ed74af121 Key Type: %%2500 Additional Information: Operation: %%2464 Return Code: 0x0
|
| | Security | Audit Success | 13824 | 2025-11-29 04:09:56 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:09:56 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:09:56 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:09:56 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:09:56 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:09:56 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:09:56 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:09:56 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 12544 | 2025-11-29 04:09:57 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4f8 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12548 | 2025-11-29 04:09:57 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12544 | 2025-11-29 04:09:59 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4f8 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12548 | 2025-11-29 04:09:59 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12544 | 2025-11-29 04:10:00 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4f8 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-29 04:10:00 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4f8 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12548 | 2025-11-29 04:10:00 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-29 04:10:00 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12544 | 2025-11-29 04:10:03 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4f8 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12548 | 2025-11-29 04:10:03 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12290 | 2025-11-29 04:10:04 | | Microsoft-Windows-Security-Auditing | 5061: Cryptographic operation. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Cryptographic Parameters: Provider Name: Microsoft Software Key Storage Provider Algorithm Name: RSA Key Name: f8df15d9-56fa-0cb3-682b-838ed74af121 Key Type: %%2500 Cryptographic Operation: Operation: %%2480 Return Code: 0x0
|
| | Security | Audit Success | 12290 | 2025-11-29 04:10:04 | | Microsoft-Windows-Security-Auditing | 5061: Cryptographic operation. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Cryptographic Parameters: Provider Name: Microsoft Software Key Storage Provider Algorithm Name: RSA Key Name: f8df15d9-56fa-0cb3-682b-838ed74af121 Key Type: %%2500 Cryptographic Operation: Operation: %%2480 Return Code: 0x0
|
| | Security | Audit Success | 12290 | 2025-11-29 04:10:04 | | Microsoft-Windows-Security-Auditing | 5061: Cryptographic operation. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Cryptographic Parameters: Provider Name: Microsoft Software Key Storage Provider Algorithm Name: RSA Key Name: f8df15d9-56fa-0cb3-682b-838ed74af121 Key Type: %%2500 Cryptographic Operation: Operation: %%2480 Return Code: 0x0
|
| | Security | Audit Success | 12290 | 2025-11-29 04:10:04 | | Microsoft-Windows-Security-Auditing | 5061: Cryptographic operation. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Cryptographic Parameters: Provider Name: Microsoft Software Key Storage Provider Algorithm Name: RSA Key Name: f8df15d9-56fa-0cb3-682b-838ed74af121 Key Type: %%2500 Cryptographic Operation: Operation: %%2480 Return Code: 0x0
|
| | Security | Audit Success | 12290 | 2025-11-29 04:10:04 | | Microsoft-Windows-Security-Auditing | 5061: Cryptographic operation. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Cryptographic Parameters: Provider Name: Microsoft Software Key Storage Provider Algorithm Name: RSA Key Name: f8df15d9-56fa-0cb3-682b-838ed74af121 Key Type: %%2500 Cryptographic Operation: Operation: %%2480 Return Code: 0x0
|
| | Security | Audit Success | 12290 | 2025-11-29 04:10:04 | | Microsoft-Windows-Security-Auditing | 5061: Cryptographic operation. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Cryptographic Parameters: Provider Name: Microsoft Software Key Storage Provider Algorithm Name: RSA Key Name: f8df15d9-56fa-0cb3-682b-838ed74af121 Key Type: %%2500 Cryptographic Operation: Operation: %%2480 Return Code: 0x0
|
| | Security | Audit Success | 12290 | 2025-11-29 04:10:04 | | Microsoft-Windows-Security-Auditing | 5061: Cryptographic operation. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Cryptographic Parameters: Provider Name: Microsoft Software Key Storage Provider Algorithm Name: RSA Key Name: f8df15d9-56fa-0cb3-682b-838ed74af121 Key Type: %%2500 Cryptographic Operation: Operation: %%2480 Return Code: 0x0
|
| | Security | Audit Success | 12290 | 2025-11-29 04:10:04 | | Microsoft-Windows-Security-Auditing | 5061: Cryptographic operation. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Cryptographic Parameters: Provider Name: Microsoft Software Key Storage Provider Algorithm Name: RSA Key Name: f8df15d9-56fa-0cb3-682b-838ed74af121 Key Type: %%2500 Cryptographic Operation: Operation: %%2480 Return Code: 0x0
|
| | Security | Audit Success | 12290 | 2025-11-29 04:10:04 | | Microsoft-Windows-Security-Auditing | 5061: Cryptographic operation. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Cryptographic Parameters: Provider Name: Microsoft Software Key Storage Provider Algorithm Name: RSA Key Name: f8df15d9-56fa-0cb3-682b-838ed74af121 Key Type: %%2500 Cryptographic Operation: Operation: %%2480 Return Code: 0x0
|
| | Security | Audit Success | 12290 | 2025-11-29 04:10:04 | | Microsoft-Windows-Security-Auditing | 5061: Cryptographic operation. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Cryptographic Parameters: Provider Name: Microsoft Software Key Storage Provider Algorithm Name: RSA Key Name: f8df15d9-56fa-0cb3-682b-838ed74af121 Key Type: %%2500 Cryptographic Operation: Operation: %%2480 Return Code: 0x0
|
| | Security | Audit Success | 12292 | 2025-11-29 04:10:04 | | Microsoft-Windows-Security-Auditing | 5058: Key file operation. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Process Information: Process ID: 2332 Process Creation Time: 2025-11-29T12:09:37.8811167Z Cryptographic Parameters: Provider Name: Microsoft Software Key Storage Provider Algorithm Name: UNKNOWN Key Name: f8df15d9-56fa-0cb3-682b-838ed74af121 Key Type: %%2500 Key File Operation Information: File Path: C:\ProgramData\Microsoft\Crypto\SystemKeys\8bb43a3e92c2eb4c420c9abd6e278936_9ee7012e-fa60-42be-b8b4-8dc8b4e1280d Operation: %%2458 Return Code: 0x0
|
| | Security | Audit Success | 12292 | 2025-11-29 04:10:04 | | Microsoft-Windows-Security-Auditing | 5058: Key file operation. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Process Information: Process ID: 2332 Process Creation Time: 2025-11-29T12:09:37.8811167Z Cryptographic Parameters: Provider Name: Microsoft Software Key Storage Provider Algorithm Name: UNKNOWN Key Name: f8df15d9-56fa-0cb3-682b-838ed74af121 Key Type: %%2500 Key File Operation Information: File Path: C:\ProgramData\Microsoft\Crypto\SystemKeys\8bb43a3e92c2eb4c420c9abd6e278936_9ee7012e-fa60-42be-b8b4-8dc8b4e1280d Operation: %%2458 Return Code: 0x0
|
| | Security | Audit Success | 12292 | 2025-11-29 04:10:04 | | Microsoft-Windows-Security-Auditing | 5059: Key migration operation. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Process Information: Process ID: 2332 Process Creation Time: 2025-11-29T12:09:37.8811167Z Cryptographic Parameters: Provider Name: Microsoft Software Key Storage Provider Algorithm Name: RSA Key Name: f8df15d9-56fa-0cb3-682b-838ed74af121 Key Type: %%2500 Additional Information: Operation: %%2464 Return Code: 0x0
|
| | Security | Audit Success | 12292 | 2025-11-29 04:10:04 | | Microsoft-Windows-Security-Auditing | 5058: Key file operation. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Process Information: Process ID: 2332 Process Creation Time: 2025-11-29T12:09:37.8811167Z Cryptographic Parameters: Provider Name: Microsoft Software Key Storage Provider Algorithm Name: UNKNOWN Key Name: f8df15d9-56fa-0cb3-682b-838ed74af121 Key Type: %%2500 Key File Operation Information: File Path: C:\ProgramData\Microsoft\Crypto\SystemKeys\8bb43a3e92c2eb4c420c9abd6e278936_9ee7012e-fa60-42be-b8b4-8dc8b4e1280d Operation: %%2458 Return Code: 0x0
|
| | Security | Audit Success | 12292 | 2025-11-29 04:10:04 | | Microsoft-Windows-Security-Auditing | 5058: Key file operation. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Process Information: Process ID: 2332 Process Creation Time: 2025-11-29T12:09:37.8811167Z Cryptographic Parameters: Provider Name: Microsoft Software Key Storage Provider Algorithm Name: UNKNOWN Key Name: f8df15d9-56fa-0cb3-682b-838ed74af121 Key Type: %%2500 Key File Operation Information: File Path: C:\ProgramData\Microsoft\Crypto\SystemKeys\8bb43a3e92c2eb4c420c9abd6e278936_9ee7012e-fa60-42be-b8b4-8dc8b4e1280d Operation: %%2458 Return Code: 0x0
|
| | Security | Audit Success | 12292 | 2025-11-29 04:10:04 | | Microsoft-Windows-Security-Auditing | 5059: Key migration operation. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Process Information: Process ID: 2332 Process Creation Time: 2025-11-29T12:09:37.8811167Z Cryptographic Parameters: Provider Name: Microsoft Software Key Storage Provider Algorithm Name: RSA Key Name: f8df15d9-56fa-0cb3-682b-838ed74af121 Key Type: %%2500 Additional Information: Operation: %%2464 Return Code: 0x0
|
| | Security | Audit Success | 12292 | 2025-11-29 04:10:04 | | Microsoft-Windows-Security-Auditing | 5058: Key file operation. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Process Information: Process ID: 2332 Process Creation Time: 2025-11-29T12:09:37.8811167Z Cryptographic Parameters: Provider Name: Microsoft Software Key Storage Provider Algorithm Name: UNKNOWN Key Name: f8df15d9-56fa-0cb3-682b-838ed74af121 Key Type: %%2500 Key File Operation Information: File Path: C:\ProgramData\Microsoft\Crypto\SystemKeys\8bb43a3e92c2eb4c420c9abd6e278936_9ee7012e-fa60-42be-b8b4-8dc8b4e1280d Operation: %%2458 Return Code: 0x0
|
| | Security | Audit Success | 12292 | 2025-11-29 04:10:04 | | Microsoft-Windows-Security-Auditing | 5058: Key file operation. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Process Information: Process ID: 2332 Process Creation Time: 2025-11-29T12:09:37.8811167Z Cryptographic Parameters: Provider Name: Microsoft Software Key Storage Provider Algorithm Name: UNKNOWN Key Name: f8df15d9-56fa-0cb3-682b-838ed74af121 Key Type: %%2500 Key File Operation Information: File Path: C:\ProgramData\Microsoft\Crypto\SystemKeys\8bb43a3e92c2eb4c420c9abd6e278936_9ee7012e-fa60-42be-b8b4-8dc8b4e1280d Operation: %%2458 Return Code: 0x0
|
| | Security | Audit Success | 12292 | 2025-11-29 04:10:04 | | Microsoft-Windows-Security-Auditing | 5059: Key migration operation. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Process Information: Process ID: 2332 Process Creation Time: 2025-11-29T12:09:37.8811167Z Cryptographic Parameters: Provider Name: Microsoft Software Key Storage Provider Algorithm Name: RSA Key Name: f8df15d9-56fa-0cb3-682b-838ed74af121 Key Type: %%2500 Additional Information: Operation: %%2464 Return Code: 0x0
|
| | Security | Audit Success | 12292 | 2025-11-29 04:10:04 | | Microsoft-Windows-Security-Auditing | 5058: Key file operation. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Process Information: Process ID: 2332 Process Creation Time: 2025-11-29T12:09:37.8811167Z Cryptographic Parameters: Provider Name: Microsoft Software Key Storage Provider Algorithm Name: UNKNOWN Key Name: f8df15d9-56fa-0cb3-682b-838ed74af121 Key Type: %%2500 Key File Operation Information: File Path: C:\ProgramData\Microsoft\Crypto\SystemKeys\8bb43a3e92c2eb4c420c9abd6e278936_9ee7012e-fa60-42be-b8b4-8dc8b4e1280d Operation: %%2458 Return Code: 0x0
|
| | Security | Audit Success | 12292 | 2025-11-29 04:10:04 | | Microsoft-Windows-Security-Auditing | 5058: Key file operation. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Process Information: Process ID: 2332 Process Creation Time: 2025-11-29T12:09:37.8811167Z Cryptographic Parameters: Provider Name: Microsoft Software Key Storage Provider Algorithm Name: UNKNOWN Key Name: f8df15d9-56fa-0cb3-682b-838ed74af121 Key Type: %%2500 Key File Operation Information: File Path: C:\ProgramData\Microsoft\Crypto\SystemKeys\8bb43a3e92c2eb4c420c9abd6e278936_9ee7012e-fa60-42be-b8b4-8dc8b4e1280d Operation: %%2458 Return Code: 0x0
|
| | Security | Audit Success | 12292 | 2025-11-29 04:10:04 | | Microsoft-Windows-Security-Auditing | 5059: Key migration operation. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Process Information: Process ID: 2332 Process Creation Time: 2025-11-29T12:09:37.8811167Z Cryptographic Parameters: Provider Name: Microsoft Software Key Storage Provider Algorithm Name: RSA Key Name: f8df15d9-56fa-0cb3-682b-838ed74af121 Key Type: %%2500 Additional Information: Operation: %%2464 Return Code: 0x0
|
| | Security | Audit Success | 12292 | 2025-11-29 04:10:04 | | Microsoft-Windows-Security-Auditing | 5058: Key file operation. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Process Information: Process ID: 2332 Process Creation Time: 2025-11-29T12:09:37.8811167Z Cryptographic Parameters: Provider Name: Microsoft Software Key Storage Provider Algorithm Name: UNKNOWN Key Name: f8df15d9-56fa-0cb3-682b-838ed74af121 Key Type: %%2500 Key File Operation Information: File Path: C:\ProgramData\Microsoft\Crypto\SystemKeys\8bb43a3e92c2eb4c420c9abd6e278936_9ee7012e-fa60-42be-b8b4-8dc8b4e1280d Operation: %%2458 Return Code: 0x0
|
| | Security | Audit Success | 12292 | 2025-11-29 04:10:04 | | Microsoft-Windows-Security-Auditing | 5058: Key file operation. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Process Information: Process ID: 2332 Process Creation Time: 2025-11-29T12:09:37.8811167Z Cryptographic Parameters: Provider Name: Microsoft Software Key Storage Provider Algorithm Name: UNKNOWN Key Name: f8df15d9-56fa-0cb3-682b-838ed74af121 Key Type: %%2500 Key File Operation Information: File Path: C:\ProgramData\Microsoft\Crypto\SystemKeys\8bb43a3e92c2eb4c420c9abd6e278936_9ee7012e-fa60-42be-b8b4-8dc8b4e1280d Operation: %%2458 Return Code: 0x0
|
| | Security | Audit Success | 12292 | 2025-11-29 04:10:04 | | Microsoft-Windows-Security-Auditing | 5059: Key migration operation. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Process Information: Process ID: 2332 Process Creation Time: 2025-11-29T12:09:37.8811167Z Cryptographic Parameters: Provider Name: Microsoft Software Key Storage Provider Algorithm Name: RSA Key Name: f8df15d9-56fa-0cb3-682b-838ed74af121 Key Type: %%2500 Additional Information: Operation: %%2464 Return Code: 0x0
|
| | Security | Audit Success | 13824 | 2025-11-29 04:10:04 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:10:04 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:10:04 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:10:04 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:10:04 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:10:04 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:10:04 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:10:04 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:10:04 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:10:04 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:10:04 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:10:04 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:10:04 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:10:04 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:10:04 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:10:04 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:10:04 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:10:04 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:10:04 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:10:04 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 12290 | 2025-11-29 04:10:05 | | Microsoft-Windows-Security-Auditing | 5061: Cryptographic operation. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Cryptographic Parameters: Provider Name: Microsoft Software Key Storage Provider Algorithm Name: RSA Key Name: f8df15d9-56fa-0cb3-682b-838ed74af121 Key Type: %%2500 Cryptographic Operation: Operation: %%2480 Return Code: 0x0
|
| | Security | Audit Success | 12290 | 2025-11-29 04:10:05 | | Microsoft-Windows-Security-Auditing | 5061: Cryptographic operation. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Cryptographic Parameters: Provider Name: Microsoft Software Key Storage Provider Algorithm Name: RSA Key Name: f8df15d9-56fa-0cb3-682b-838ed74af121 Key Type: %%2500 Cryptographic Operation: Operation: %%2480 Return Code: 0x0
|
| | Security | Audit Success | 12290 | 2025-11-29 04:10:05 | | Microsoft-Windows-Security-Auditing | 5061: Cryptographic operation. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Cryptographic Parameters: Provider Name: Microsoft Software Key Storage Provider Algorithm Name: RSA Key Name: f8df15d9-56fa-0cb3-682b-838ed74af121 Key Type: %%2500 Cryptographic Operation: Operation: %%2480 Return Code: 0x0
|
| | Security | Audit Success | 12290 | 2025-11-29 04:10:05 | | Microsoft-Windows-Security-Auditing | 5061: Cryptographic operation. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Cryptographic Parameters: Provider Name: Microsoft Software Key Storage Provider Algorithm Name: RSA Key Name: f8df15d9-56fa-0cb3-682b-838ed74af121 Key Type: %%2500 Cryptographic Operation: Operation: %%2480 Return Code: 0x0
|
| | Security | Audit Success | 12290 | 2025-11-29 04:10:05 | | Microsoft-Windows-Security-Auditing | 5061: Cryptographic operation. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Cryptographic Parameters: Provider Name: Microsoft Software Key Storage Provider Algorithm Name: RSA Key Name: f8df15d9-56fa-0cb3-682b-838ed74af121 Key Type: %%2500 Cryptographic Operation: Operation: %%2480 Return Code: 0x0
|
| | Security | Audit Success | 12290 | 2025-11-29 04:10:05 | | Microsoft-Windows-Security-Auditing | 5061: Cryptographic operation. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Cryptographic Parameters: Provider Name: Microsoft Software Key Storage Provider Algorithm Name: RSA Key Name: f8df15d9-56fa-0cb3-682b-838ed74af121 Key Type: %%2500 Cryptographic Operation: Operation: %%2480 Return Code: 0x0
|
| | Security | Audit Success | 12290 | 2025-11-29 04:10:05 | | Microsoft-Windows-Security-Auditing | 5061: Cryptographic operation. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Cryptographic Parameters: Provider Name: Microsoft Software Key Storage Provider Algorithm Name: RSA Key Name: f8df15d9-56fa-0cb3-682b-838ed74af121 Key Type: %%2500 Cryptographic Operation: Operation: %%2480 Return Code: 0x0
|
| | Security | Audit Success | 12290 | 2025-11-29 04:10:05 | | Microsoft-Windows-Security-Auditing | 5061: Cryptographic operation. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Cryptographic Parameters: Provider Name: Microsoft Software Key Storage Provider Algorithm Name: RSA Key Name: f8df15d9-56fa-0cb3-682b-838ed74af121 Key Type: %%2500 Cryptographic Operation: Operation: %%2480 Return Code: 0x0
|
| | Security | Audit Success | 12292 | 2025-11-29 04:10:05 | | Microsoft-Windows-Security-Auditing | 5058: Key file operation. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Process Information: Process ID: 2332 Process Creation Time: 2025-11-29T12:09:37.8811167Z Cryptographic Parameters: Provider Name: Microsoft Software Key Storage Provider Algorithm Name: UNKNOWN Key Name: f8df15d9-56fa-0cb3-682b-838ed74af121 Key Type: %%2500 Key File Operation Information: File Path: C:\ProgramData\Microsoft\Crypto\SystemKeys\8bb43a3e92c2eb4c420c9abd6e278936_9ee7012e-fa60-42be-b8b4-8dc8b4e1280d Operation: %%2458 Return Code: 0x0
|
| | Security | Audit Success | 12292 | 2025-11-29 04:10:05 | | Microsoft-Windows-Security-Auditing | 5058: Key file operation. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Process Information: Process ID: 2332 Process Creation Time: 2025-11-29T12:09:37.8811167Z Cryptographic Parameters: Provider Name: Microsoft Software Key Storage Provider Algorithm Name: UNKNOWN Key Name: f8df15d9-56fa-0cb3-682b-838ed74af121 Key Type: %%2500 Key File Operation Information: File Path: C:\ProgramData\Microsoft\Crypto\SystemKeys\8bb43a3e92c2eb4c420c9abd6e278936_9ee7012e-fa60-42be-b8b4-8dc8b4e1280d Operation: %%2458 Return Code: 0x0
|
| | Security | Audit Success | 12292 | 2025-11-29 04:10:05 | | Microsoft-Windows-Security-Auditing | 5059: Key migration operation. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Process Information: Process ID: 2332 Process Creation Time: 2025-11-29T12:09:37.8811167Z Cryptographic Parameters: Provider Name: Microsoft Software Key Storage Provider Algorithm Name: RSA Key Name: f8df15d9-56fa-0cb3-682b-838ed74af121 Key Type: %%2500 Additional Information: Operation: %%2464 Return Code: 0x0
|
| | Security | Audit Success | 12292 | 2025-11-29 04:10:05 | | Microsoft-Windows-Security-Auditing | 5058: Key file operation. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Process Information: Process ID: 2332 Process Creation Time: 2025-11-29T12:09:37.8811167Z Cryptographic Parameters: Provider Name: Microsoft Software Key Storage Provider Algorithm Name: UNKNOWN Key Name: f8df15d9-56fa-0cb3-682b-838ed74af121 Key Type: %%2500 Key File Operation Information: File Path: C:\ProgramData\Microsoft\Crypto\SystemKeys\8bb43a3e92c2eb4c420c9abd6e278936_9ee7012e-fa60-42be-b8b4-8dc8b4e1280d Operation: %%2458 Return Code: 0x0
|
| | Security | Audit Success | 12292 | 2025-11-29 04:10:05 | | Microsoft-Windows-Security-Auditing | 5058: Key file operation. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Process Information: Process ID: 2332 Process Creation Time: 2025-11-29T12:09:37.8811167Z Cryptographic Parameters: Provider Name: Microsoft Software Key Storage Provider Algorithm Name: UNKNOWN Key Name: f8df15d9-56fa-0cb3-682b-838ed74af121 Key Type: %%2500 Key File Operation Information: File Path: C:\ProgramData\Microsoft\Crypto\SystemKeys\8bb43a3e92c2eb4c420c9abd6e278936_9ee7012e-fa60-42be-b8b4-8dc8b4e1280d Operation: %%2458 Return Code: 0x0
|
| | Security | Audit Success | 12292 | 2025-11-29 04:10:05 | | Microsoft-Windows-Security-Auditing | 5059: Key migration operation. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Process Information: Process ID: 2332 Process Creation Time: 2025-11-29T12:09:37.8811167Z Cryptographic Parameters: Provider Name: Microsoft Software Key Storage Provider Algorithm Name: RSA Key Name: f8df15d9-56fa-0cb3-682b-838ed74af121 Key Type: %%2500 Additional Information: Operation: %%2464 Return Code: 0x0
|
| | Security | Audit Success | 12292 | 2025-11-29 04:10:05 | | Microsoft-Windows-Security-Auditing | 5058: Key file operation. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Process Information: Process ID: 2332 Process Creation Time: 2025-11-29T12:09:37.8811167Z Cryptographic Parameters: Provider Name: Microsoft Software Key Storage Provider Algorithm Name: UNKNOWN Key Name: f8df15d9-56fa-0cb3-682b-838ed74af121 Key Type: %%2500 Key File Operation Information: File Path: C:\ProgramData\Microsoft\Crypto\SystemKeys\8bb43a3e92c2eb4c420c9abd6e278936_9ee7012e-fa60-42be-b8b4-8dc8b4e1280d Operation: %%2458 Return Code: 0x0
|
| | Security | Audit Success | 12292 | 2025-11-29 04:10:05 | | Microsoft-Windows-Security-Auditing | 5058: Key file operation. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Process Information: Process ID: 2332 Process Creation Time: 2025-11-29T12:09:37.8811167Z Cryptographic Parameters: Provider Name: Microsoft Software Key Storage Provider Algorithm Name: UNKNOWN Key Name: f8df15d9-56fa-0cb3-682b-838ed74af121 Key Type: %%2500 Key File Operation Information: File Path: C:\ProgramData\Microsoft\Crypto\SystemKeys\8bb43a3e92c2eb4c420c9abd6e278936_9ee7012e-fa60-42be-b8b4-8dc8b4e1280d Operation: %%2458 Return Code: 0x0
|
| | Security | Audit Success | 12292 | 2025-11-29 04:10:05 | | Microsoft-Windows-Security-Auditing | 5059: Key migration operation. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Process Information: Process ID: 2332 Process Creation Time: 2025-11-29T12:09:37.8811167Z Cryptographic Parameters: Provider Name: Microsoft Software Key Storage Provider Algorithm Name: RSA Key Name: f8df15d9-56fa-0cb3-682b-838ed74af121 Key Type: %%2500 Additional Information: Operation: %%2464 Return Code: 0x0
|
| | Security | Audit Success | 12292 | 2025-11-29 04:10:05 | | Microsoft-Windows-Security-Auditing | 5058: Key file operation. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Process Information: Process ID: 2332 Process Creation Time: 2025-11-29T12:09:37.8811167Z Cryptographic Parameters: Provider Name: Microsoft Software Key Storage Provider Algorithm Name: UNKNOWN Key Name: f8df15d9-56fa-0cb3-682b-838ed74af121 Key Type: %%2500 Key File Operation Information: File Path: C:\ProgramData\Microsoft\Crypto\SystemKeys\8bb43a3e92c2eb4c420c9abd6e278936_9ee7012e-fa60-42be-b8b4-8dc8b4e1280d Operation: %%2458 Return Code: 0x0
|
| | Security | Audit Success | 12292 | 2025-11-29 04:10:05 | | Microsoft-Windows-Security-Auditing | 5058: Key file operation. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Process Information: Process ID: 2332 Process Creation Time: 2025-11-29T12:09:37.8811167Z Cryptographic Parameters: Provider Name: Microsoft Software Key Storage Provider Algorithm Name: UNKNOWN Key Name: f8df15d9-56fa-0cb3-682b-838ed74af121 Key Type: %%2500 Key File Operation Information: File Path: C:\ProgramData\Microsoft\Crypto\SystemKeys\8bb43a3e92c2eb4c420c9abd6e278936_9ee7012e-fa60-42be-b8b4-8dc8b4e1280d Operation: %%2458 Return Code: 0x0
|
| | Security | Audit Success | 12292 | 2025-11-29 04:10:05 | | Microsoft-Windows-Security-Auditing | 5059: Key migration operation. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Process Information: Process ID: 2332 Process Creation Time: 2025-11-29T12:09:37.8811167Z Cryptographic Parameters: Provider Name: Microsoft Software Key Storage Provider Algorithm Name: RSA Key Name: f8df15d9-56fa-0cb3-682b-838ed74af121 Key Type: %%2500 Additional Information: Operation: %%2464 Return Code: 0x0
|
| | Security | Audit Success | 13824 | 2025-11-29 04:10:05 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:10:05 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:10:05 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:10:05 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:10:05 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:10:05 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:10:05 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:10:05 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:10:05 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:10:05 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:10:05 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:10:05 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:10:05 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:10:05 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:10:05 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:10:05 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 12544 | 2025-11-29 04:11:16 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4f8 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12548 | 2025-11-29 04:11:16 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 13826 | 2025-11-29 04:11:20 | | Microsoft-Windows-Security-Auditing | 4799: A security-enabled local group membership was enumerated. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Group: Security ID: S-1-5-32-544 Group Name: Administrators Group Domain: Builtin Process Information: Process ID: 0x1ed8 Process Name: C:\Windows\System32\svchost.exe
|
| | Security | Audit Success | 13826 | 2025-11-29 04:11:20 | | Microsoft-Windows-Security-Auditing | 4799: A security-enabled local group membership was enumerated. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Group: Security ID: S-1-5-32-551 Group Name: Backup Operators Group Domain: Builtin Process Information: Process ID: 0x1ed8 Process Name: C:\Windows\System32\svchost.exe
|
| | Security | Audit Success | 13824 | 2025-11-29 04:11:30 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-19 Account Name: LOCAL SERVICE Account Domain: NT AUTHORITY Logon ID: 0x3e5 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:11:30 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-19 Account Name: LOCAL SERVICE Account Domain: NT AUTHORITY Logon ID: 0x3e5 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:11:30 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-19 Account Name: LOCAL SERVICE Account Domain: NT AUTHORITY Logon ID: 0x3e5 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:11:30 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-19 Account Name: LOCAL SERVICE Account Domain: NT AUTHORITY Logon ID: 0x3e5 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:11:30 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-20 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e4 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:11:30 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-20 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e4 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:11:30 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-20 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e4 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:11:30 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-20 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e4 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:11:31 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-19 Account Name: LOCAL SERVICE Account Domain: NT AUTHORITY Logon ID: 0x3e5 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:11:31 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-19 Account Name: LOCAL SERVICE Account Domain: NT AUTHORITY Logon ID: 0x3e5 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:11:31 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-19 Account Name: LOCAL SERVICE Account Domain: NT AUTHORITY Logon ID: 0x3e5 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:11:31 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-19 Account Name: LOCAL SERVICE Account Domain: NT AUTHORITY Logon ID: 0x3e5 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:11:31 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1000 Account Name: defaultuser0 Account Domain: DESKTOP-0JV7HJV Logon ID: 0x65f81 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:11:31 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1000 Account Name: defaultuser0 Account Domain: DESKTOP-0JV7HJV Logon ID: 0x65f81 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:11:31 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1000 Account Name: defaultuser0 Account Domain: DESKTOP-0JV7HJV Logon ID: 0x65f81 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:11:31 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1000 Account Name: defaultuser0 Account Domain: DESKTOP-0JV7HJV Logon ID: 0x65f81 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 12544 | 2025-11-29 04:11:39 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4f8 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-29 04:11:39 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4f8 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-29 04:11:39 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4f8 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-29 04:11:39 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4f8 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12548 | 2025-11-29 04:11:39 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-29 04:11:39 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-29 04:11:39 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-29 04:11:39 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12290 | 2025-11-29 04:14:38 | | Microsoft-Windows-Security-Auditing | 5061: Cryptographic operation. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Cryptographic Parameters: Provider Name: Microsoft Software Key Storage Provider Algorithm Name: RSA Key Name: f8df15d9-56fa-0cb3-682b-838ed74af121 Key Type: %%2500 Cryptographic Operation: Operation: %%2480 Return Code: 0x0
|
| | Security | Audit Success | 12290 | 2025-11-29 04:14:38 | | Microsoft-Windows-Security-Auditing | 5061: Cryptographic operation. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Cryptographic Parameters: Provider Name: Microsoft Software Key Storage Provider Algorithm Name: RSA Key Name: f8df15d9-56fa-0cb3-682b-838ed74af121 Key Type: %%2500 Cryptographic Operation: Operation: %%2480 Return Code: 0x0
|
| | Security | Audit Success | 12292 | 2025-11-29 04:14:38 | | Microsoft-Windows-Security-Auditing | 5058: Key file operation. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Process Information: Process ID: 2332 Process Creation Time: 2025-11-29T12:09:37.8811167Z Cryptographic Parameters: Provider Name: Microsoft Software Key Storage Provider Algorithm Name: UNKNOWN Key Name: f8df15d9-56fa-0cb3-682b-838ed74af121 Key Type: %%2500 Key File Operation Information: File Path: C:\ProgramData\Microsoft\Crypto\SystemKeys\8bb43a3e92c2eb4c420c9abd6e278936_9ee7012e-fa60-42be-b8b4-8dc8b4e1280d Operation: %%2458 Return Code: 0x0
|
| | Security | Audit Success | 12292 | 2025-11-29 04:14:38 | | Microsoft-Windows-Security-Auditing | 5058: Key file operation. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Process Information: Process ID: 2332 Process Creation Time: 2025-11-29T12:09:37.8811167Z Cryptographic Parameters: Provider Name: Microsoft Software Key Storage Provider Algorithm Name: UNKNOWN Key Name: f8df15d9-56fa-0cb3-682b-838ed74af121 Key Type: %%2500 Key File Operation Information: File Path: C:\ProgramData\Microsoft\Crypto\SystemKeys\8bb43a3e92c2eb4c420c9abd6e278936_9ee7012e-fa60-42be-b8b4-8dc8b4e1280d Operation: %%2458 Return Code: 0x0
|
| | Security | Audit Success | 12292 | 2025-11-29 04:14:38 | | Microsoft-Windows-Security-Auditing | 5059: Key migration operation. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Process Information: Process ID: 2332 Process Creation Time: 2025-11-29T12:09:37.8811167Z Cryptographic Parameters: Provider Name: Microsoft Software Key Storage Provider Algorithm Name: RSA Key Name: f8df15d9-56fa-0cb3-682b-838ed74af121 Key Type: %%2500 Additional Information: Operation: %%2464 Return Code: 0x0
|
| | Security | Audit Success | 13824 | 2025-11-29 04:14:38 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:14:38 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:14:38 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:14:38 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 12290 | 2025-11-29 04:14:42 | | Microsoft-Windows-Security-Auditing | 5061: Cryptographic operation. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Cryptographic Parameters: Provider Name: Microsoft Software Key Storage Provider Algorithm Name: RSA Key Name: f8df15d9-56fa-0cb3-682b-838ed74af121 Key Type: %%2500 Cryptographic Operation: Operation: %%2480 Return Code: 0x0
|
| | Security | Audit Success | 12290 | 2025-11-29 04:14:42 | | Microsoft-Windows-Security-Auditing | 5061: Cryptographic operation. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Cryptographic Parameters: Provider Name: Microsoft Software Key Storage Provider Algorithm Name: RSA Key Name: f8df15d9-56fa-0cb3-682b-838ed74af121 Key Type: %%2500 Cryptographic Operation: Operation: %%2480 Return Code: 0x0
|
| | Security | Audit Success | 12292 | 2025-11-29 04:14:42 | | Microsoft-Windows-Security-Auditing | 5058: Key file operation. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Process Information: Process ID: 2332 Process Creation Time: 2025-11-29T12:09:37.8811167Z Cryptographic Parameters: Provider Name: Microsoft Software Key Storage Provider Algorithm Name: UNKNOWN Key Name: f8df15d9-56fa-0cb3-682b-838ed74af121 Key Type: %%2500 Key File Operation Information: File Path: C:\ProgramData\Microsoft\Crypto\SystemKeys\8bb43a3e92c2eb4c420c9abd6e278936_9ee7012e-fa60-42be-b8b4-8dc8b4e1280d Operation: %%2458 Return Code: 0x0
|
| | Security | Audit Success | 12292 | 2025-11-29 04:14:42 | | Microsoft-Windows-Security-Auditing | 5058: Key file operation. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Process Information: Process ID: 2332 Process Creation Time: 2025-11-29T12:09:37.8811167Z Cryptographic Parameters: Provider Name: Microsoft Software Key Storage Provider Algorithm Name: UNKNOWN Key Name: f8df15d9-56fa-0cb3-682b-838ed74af121 Key Type: %%2500 Key File Operation Information: File Path: C:\ProgramData\Microsoft\Crypto\SystemKeys\8bb43a3e92c2eb4c420c9abd6e278936_9ee7012e-fa60-42be-b8b4-8dc8b4e1280d Operation: %%2458 Return Code: 0x0
|
| | Security | Audit Success | 12292 | 2025-11-29 04:14:42 | | Microsoft-Windows-Security-Auditing | 5059: Key migration operation. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Process Information: Process ID: 2332 Process Creation Time: 2025-11-29T12:09:37.8811167Z Cryptographic Parameters: Provider Name: Microsoft Software Key Storage Provider Algorithm Name: RSA Key Name: f8df15d9-56fa-0cb3-682b-838ed74af121 Key Type: %%2500 Additional Information: Operation: %%2464 Return Code: 0x0
|
| | Security | Audit Success | 13824 | 2025-11-29 04:14:42 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:14:42 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:14:42 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:14:42 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:18:24 | | Microsoft-Windows-Security-Auditing | 4798: A user's local group membership was enumerated. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 User: Security ID: S-1-5-21-2954332259-1466799094-2054226798-500 Account Name: Administrator Account Domain: DESKTOP-0JV7HJV Process Information: Process ID: 0x208c Process Name: C:\Windows\System32\CompatTelRunner.exe
|
| | Security | Audit Success | 13824 | 2025-11-29 04:18:24 | | Microsoft-Windows-Security-Auditing | 4798: A user's local group membership was enumerated. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 User: Security ID: S-1-5-21-2954332259-1466799094-2054226798-503 Account Name: DefaultAccount Account Domain: DESKTOP-0JV7HJV Process Information: Process ID: 0x208c Process Name: C:\Windows\System32\CompatTelRunner.exe
|
| | Security | Audit Success | 13824 | 2025-11-29 04:18:24 | | Microsoft-Windows-Security-Auditing | 4798: A user's local group membership was enumerated. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 User: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1000 Account Name: defaultuser0 Account Domain: DESKTOP-0JV7HJV Process Information: Process ID: 0x208c Process Name: C:\Windows\System32\CompatTelRunner.exe
|
| | Security | Audit Success | 13824 | 2025-11-29 04:18:24 | | Microsoft-Windows-Security-Auditing | 4798: A user's local group membership was enumerated. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 User: Security ID: S-1-5-21-2954332259-1466799094-2054226798-501 Account Name: Guest Account Domain: DESKTOP-0JV7HJV Process Information: Process ID: 0x208c Process Name: C:\Windows\System32\CompatTelRunner.exe
|
| | Security | Audit Success | 13824 | 2025-11-29 04:18:24 | | Microsoft-Windows-Security-Auditing | 4798: A user's local group membership was enumerated. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 User: Security ID: S-1-5-21-2954332259-1466799094-2054226798-504 Account Name: WDAGUtilityAccount Account Domain: DESKTOP-0JV7HJV Process Information: Process ID: 0x208c Process Name: C:\Windows\System32\CompatTelRunner.exe
|
| | Security | Audit Success | 13826 | 2025-11-29 04:18:24 | | Microsoft-Windows-Security-Auditing | 4799: A security-enabled local group membership was enumerated. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Group: Security ID: S-1-5-32-544 Group Name: Administrators Group Domain: Builtin Process Information: Process ID: 0x208c Process Name: C:\Windows\System32\CompatTelRunner.exe
|
| | Security | Audit Success | 13826 | 2025-11-29 04:18:24 | | Microsoft-Windows-Security-Auditing | 4799: A security-enabled local group membership was enumerated. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Group: Security ID: S-1-5-32-545 Group Name: Users Group Domain: Builtin Process Information: Process ID: 0x208c Process Name: C:\Windows\System32\CompatTelRunner.exe
|
| | Security | Audit Success | 13826 | 2025-11-29 04:18:24 | | Microsoft-Windows-Security-Auditing | 4799: A security-enabled local group membership was enumerated. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Group: Security ID: S-1-5-32-546 Group Name: Guests Group Domain: Builtin Process Information: Process ID: 0x208c Process Name: C:\Windows\System32\CompatTelRunner.exe
|
| | Security | Audit Success | 12544 | 2025-11-29 04:18:48 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4f8 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12548 | 2025-11-29 04:18:48 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12544 | 2025-11-29 04:20:03 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4f8 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-29 04:20:03 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4f8 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12548 | 2025-11-29 04:20:03 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-29 04:20:03 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 13824 | 2025-11-29 04:20:03 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:20:03 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:20:03 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 12290 | 2025-11-29 04:20:04 | | Microsoft-Windows-Security-Auditing | 5061: Cryptographic operation. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Cryptographic Parameters: Provider Name: Microsoft Software Key Storage Provider Algorithm Name: RSA Key Name: f8df15d9-56fa-0cb3-682b-838ed74af121 Key Type: %%2500 Cryptographic Operation: Operation: %%2480 Return Code: 0x0
|
| | Security | Audit Success | 12290 | 2025-11-29 04:20:04 | | Microsoft-Windows-Security-Auditing | 5061: Cryptographic operation. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Cryptographic Parameters: Provider Name: Microsoft Software Key Storage Provider Algorithm Name: RSA Key Name: f8df15d9-56fa-0cb3-682b-838ed74af121 Key Type: %%2500 Cryptographic Operation: Operation: %%2480 Return Code: 0x0
|
| | Security | Audit Success | 12290 | 2025-11-29 04:20:04 | | Microsoft-Windows-Security-Auditing | 5061: Cryptographic operation. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Cryptographic Parameters: Provider Name: Microsoft Software Key Storage Provider Algorithm Name: RSA Key Name: f8df15d9-56fa-0cb3-682b-838ed74af121 Key Type: %%2500 Cryptographic Operation: Operation: %%2480 Return Code: 0x0
|
| | Security | Audit Success | 12290 | 2025-11-29 04:20:04 | | Microsoft-Windows-Security-Auditing | 5061: Cryptographic operation. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Cryptographic Parameters: Provider Name: Microsoft Software Key Storage Provider Algorithm Name: RSA Key Name: f8df15d9-56fa-0cb3-682b-838ed74af121 Key Type: %%2500 Cryptographic Operation: Operation: %%2480 Return Code: 0x0
|
| | Security | Audit Success | 12290 | 2025-11-29 04:20:04 | | Microsoft-Windows-Security-Auditing | 5061: Cryptographic operation. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Cryptographic Parameters: Provider Name: Microsoft Software Key Storage Provider Algorithm Name: RSA Key Name: f8df15d9-56fa-0cb3-682b-838ed74af121 Key Type: %%2500 Cryptographic Operation: Operation: %%2480 Return Code: 0x0
|
| | Security | Audit Success | 12290 | 2025-11-29 04:20:04 | | Microsoft-Windows-Security-Auditing | 5061: Cryptographic operation. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Cryptographic Parameters: Provider Name: Microsoft Software Key Storage Provider Algorithm Name: RSA Key Name: f8df15d9-56fa-0cb3-682b-838ed74af121 Key Type: %%2500 Cryptographic Operation: Operation: %%2480 Return Code: 0x0
|
| | Security | Audit Success | 12290 | 2025-11-29 04:20:04 | | Microsoft-Windows-Security-Auditing | 5061: Cryptographic operation. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Cryptographic Parameters: Provider Name: Microsoft Software Key Storage Provider Algorithm Name: RSA Key Name: f8df15d9-56fa-0cb3-682b-838ed74af121 Key Type: %%2500 Cryptographic Operation: Operation: %%2480 Return Code: 0x0
|
| | Security | Audit Success | 12290 | 2025-11-29 04:20:04 | | Microsoft-Windows-Security-Auditing | 5061: Cryptographic operation. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Cryptographic Parameters: Provider Name: Microsoft Software Key Storage Provider Algorithm Name: RSA Key Name: f8df15d9-56fa-0cb3-682b-838ed74af121 Key Type: %%2500 Cryptographic Operation: Operation: %%2480 Return Code: 0x0
|
| | Security | Audit Success | 12290 | 2025-11-29 04:20:04 | | Microsoft-Windows-Security-Auditing | 5061: Cryptographic operation. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Cryptographic Parameters: Provider Name: Microsoft Software Key Storage Provider Algorithm Name: RSA Key Name: f8df15d9-56fa-0cb3-682b-838ed74af121 Key Type: %%2500 Cryptographic Operation: Operation: %%2480 Return Code: 0x0
|
| | Security | Audit Success | 12290 | 2025-11-29 04:20:04 | | Microsoft-Windows-Security-Auditing | 5061: Cryptographic operation. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Cryptographic Parameters: Provider Name: Microsoft Software Key Storage Provider Algorithm Name: RSA Key Name: f8df15d9-56fa-0cb3-682b-838ed74af121 Key Type: %%2500 Cryptographic Operation: Operation: %%2480 Return Code: 0x0
|
| | Security | Audit Success | 12290 | 2025-11-29 04:20:04 | | Microsoft-Windows-Security-Auditing | 5061: Cryptographic operation. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Cryptographic Parameters: Provider Name: Microsoft Software Key Storage Provider Algorithm Name: RSA Key Name: f8df15d9-56fa-0cb3-682b-838ed74af121 Key Type: %%2500 Cryptographic Operation: Operation: %%2480 Return Code: 0x0
|
| | Security | Audit Success | 12290 | 2025-11-29 04:20:04 | | Microsoft-Windows-Security-Auditing | 5061: Cryptographic operation. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Cryptographic Parameters: Provider Name: Microsoft Software Key Storage Provider Algorithm Name: RSA Key Name: f8df15d9-56fa-0cb3-682b-838ed74af121 Key Type: %%2500 Cryptographic Operation: Operation: %%2480 Return Code: 0x0
|
| | Security | Audit Success | 12290 | 2025-11-29 04:20:04 | | Microsoft-Windows-Security-Auditing | 5061: Cryptographic operation. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Cryptographic Parameters: Provider Name: Microsoft Software Key Storage Provider Algorithm Name: RSA Key Name: f8df15d9-56fa-0cb3-682b-838ed74af121 Key Type: %%2500 Cryptographic Operation: Operation: %%2480 Return Code: 0x0
|
| | Security | Audit Success | 12290 | 2025-11-29 04:20:04 | | Microsoft-Windows-Security-Auditing | 5061: Cryptographic operation. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Cryptographic Parameters: Provider Name: Microsoft Software Key Storage Provider Algorithm Name: RSA Key Name: f8df15d9-56fa-0cb3-682b-838ed74af121 Key Type: %%2500 Cryptographic Operation: Operation: %%2480 Return Code: 0x0
|
| | Security | Audit Success | 12290 | 2025-11-29 04:20:04 | | Microsoft-Windows-Security-Auditing | 5061: Cryptographic operation. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Cryptographic Parameters: Provider Name: Microsoft Software Key Storage Provider Algorithm Name: RSA Key Name: f8df15d9-56fa-0cb3-682b-838ed74af121 Key Type: %%2500 Cryptographic Operation: Operation: %%2480 Return Code: 0x0
|
| | Security | Audit Success | 12290 | 2025-11-29 04:20:04 | | Microsoft-Windows-Security-Auditing | 5061: Cryptographic operation. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Cryptographic Parameters: Provider Name: Microsoft Software Key Storage Provider Algorithm Name: RSA Key Name: f8df15d9-56fa-0cb3-682b-838ed74af121 Key Type: %%2500 Cryptographic Operation: Operation: %%2480 Return Code: 0x0
|
| | Security | Audit Success | 12290 | 2025-11-29 04:20:04 | | Microsoft-Windows-Security-Auditing | 5061: Cryptographic operation. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Cryptographic Parameters: Provider Name: Microsoft Software Key Storage Provider Algorithm Name: RSA Key Name: f8df15d9-56fa-0cb3-682b-838ed74af121 Key Type: %%2500 Cryptographic Operation: Operation: %%2480 Return Code: 0x0
|
| | Security | Audit Success | 12290 | 2025-11-29 04:20:04 | | Microsoft-Windows-Security-Auditing | 5061: Cryptographic operation. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Cryptographic Parameters: Provider Name: Microsoft Software Key Storage Provider Algorithm Name: RSA Key Name: f8df15d9-56fa-0cb3-682b-838ed74af121 Key Type: %%2500 Cryptographic Operation: Operation: %%2480 Return Code: 0x0
|
| | Security | Audit Success | 12290 | 2025-11-29 04:20:04 | | Microsoft-Windows-Security-Auditing | 5061: Cryptographic operation. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Cryptographic Parameters: Provider Name: Microsoft Software Key Storage Provider Algorithm Name: RSA Key Name: f8df15d9-56fa-0cb3-682b-838ed74af121 Key Type: %%2500 Cryptographic Operation: Operation: %%2480 Return Code: 0x0
|
| | Security | Audit Success | 12290 | 2025-11-29 04:20:04 | | Microsoft-Windows-Security-Auditing | 5061: Cryptographic operation. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Cryptographic Parameters: Provider Name: Microsoft Software Key Storage Provider Algorithm Name: RSA Key Name: f8df15d9-56fa-0cb3-682b-838ed74af121 Key Type: %%2500 Cryptographic Operation: Operation: %%2480 Return Code: 0x0
|
| | Security | Audit Success | 12290 | 2025-11-29 04:20:04 | | Microsoft-Windows-Security-Auditing | 5061: Cryptographic operation. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Cryptographic Parameters: Provider Name: Microsoft Software Key Storage Provider Algorithm Name: RSA Key Name: f8df15d9-56fa-0cb3-682b-838ed74af121 Key Type: %%2500 Cryptographic Operation: Operation: %%2480 Return Code: 0x0
|
| | Security | Audit Success | 12290 | 2025-11-29 04:20:04 | | Microsoft-Windows-Security-Auditing | 5061: Cryptographic operation. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Cryptographic Parameters: Provider Name: Microsoft Software Key Storage Provider Algorithm Name: RSA Key Name: f8df15d9-56fa-0cb3-682b-838ed74af121 Key Type: %%2500 Cryptographic Operation: Operation: %%2480 Return Code: 0x0
|
| | Security | Audit Success | 12292 | 2025-11-29 04:20:04 | | Microsoft-Windows-Security-Auditing | 5058: Key file operation. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Process Information: Process ID: 1360 Process Creation Time: 2025-11-29T12:20:03.7972954Z Cryptographic Parameters: Provider Name: Microsoft Software Key Storage Provider Algorithm Name: UNKNOWN Key Name: f8df15d9-56fa-0cb3-682b-838ed74af121 Key Type: %%2500 Key File Operation Information: File Path: C:\ProgramData\Microsoft\Crypto\SystemKeys\8bb43a3e92c2eb4c420c9abd6e278936_9ee7012e-fa60-42be-b8b4-8dc8b4e1280d Operation: %%2458 Return Code: 0x0
|
| | Security | Audit Success | 12292 | 2025-11-29 04:20:04 | | Microsoft-Windows-Security-Auditing | 5058: Key file operation. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Process Information: Process ID: 1360 Process Creation Time: 2025-11-29T12:20:03.7972954Z Cryptographic Parameters: Provider Name: Microsoft Software Key Storage Provider Algorithm Name: UNKNOWN Key Name: f8df15d9-56fa-0cb3-682b-838ed74af121 Key Type: %%2500 Key File Operation Information: File Path: C:\ProgramData\Microsoft\Crypto\SystemKeys\8bb43a3e92c2eb4c420c9abd6e278936_9ee7012e-fa60-42be-b8b4-8dc8b4e1280d Operation: %%2458 Return Code: 0x0
|
| | Security | Audit Success | 12292 | 2025-11-29 04:20:04 | | Microsoft-Windows-Security-Auditing | 5059: Key migration operation. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Process Information: Process ID: 1360 Process Creation Time: 2025-11-29T12:20:03.7972954Z Cryptographic Parameters: Provider Name: Microsoft Software Key Storage Provider Algorithm Name: RSA Key Name: f8df15d9-56fa-0cb3-682b-838ed74af121 Key Type: %%2500 Additional Information: Operation: %%2464 Return Code: 0x0
|
| | Security | Audit Success | 12292 | 2025-11-29 04:20:04 | | Microsoft-Windows-Security-Auditing | 5058: Key file operation. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Process Information: Process ID: 1360 Process Creation Time: 2025-11-29T12:20:03.7972954Z Cryptographic Parameters: Provider Name: Microsoft Software Key Storage Provider Algorithm Name: UNKNOWN Key Name: f8df15d9-56fa-0cb3-682b-838ed74af121 Key Type: %%2500 Key File Operation Information: File Path: C:\ProgramData\Microsoft\Crypto\SystemKeys\8bb43a3e92c2eb4c420c9abd6e278936_9ee7012e-fa60-42be-b8b4-8dc8b4e1280d Operation: %%2458 Return Code: 0x0
|
| | Security | Audit Success | 12292 | 2025-11-29 04:20:04 | | Microsoft-Windows-Security-Auditing | 5058: Key file operation. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Process Information: Process ID: 1360 Process Creation Time: 2025-11-29T12:20:03.7972954Z Cryptographic Parameters: Provider Name: Microsoft Software Key Storage Provider Algorithm Name: UNKNOWN Key Name: f8df15d9-56fa-0cb3-682b-838ed74af121 Key Type: %%2500 Key File Operation Information: File Path: C:\ProgramData\Microsoft\Crypto\SystemKeys\8bb43a3e92c2eb4c420c9abd6e278936_9ee7012e-fa60-42be-b8b4-8dc8b4e1280d Operation: %%2458 Return Code: 0x0
|
| | Security | Audit Success | 12292 | 2025-11-29 04:20:04 | | Microsoft-Windows-Security-Auditing | 5059: Key migration operation. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Process Information: Process ID: 1360 Process Creation Time: 2025-11-29T12:20:03.7972954Z Cryptographic Parameters: Provider Name: Microsoft Software Key Storage Provider Algorithm Name: RSA Key Name: f8df15d9-56fa-0cb3-682b-838ed74af121 Key Type: %%2500 Additional Information: Operation: %%2464 Return Code: 0x0
|
| | Security | Audit Success | 12292 | 2025-11-29 04:20:04 | | Microsoft-Windows-Security-Auditing | 5058: Key file operation. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Process Information: Process ID: 1360 Process Creation Time: 2025-11-29T12:20:03.7972954Z Cryptographic Parameters: Provider Name: Microsoft Software Key Storage Provider Algorithm Name: UNKNOWN Key Name: f8df15d9-56fa-0cb3-682b-838ed74af121 Key Type: %%2500 Key File Operation Information: File Path: C:\ProgramData\Microsoft\Crypto\SystemKeys\8bb43a3e92c2eb4c420c9abd6e278936_9ee7012e-fa60-42be-b8b4-8dc8b4e1280d Operation: %%2458 Return Code: 0x0
|
| | Security | Audit Success | 12292 | 2025-11-29 04:20:04 | | Microsoft-Windows-Security-Auditing | 5058: Key file operation. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Process Information: Process ID: 1360 Process Creation Time: 2025-11-29T12:20:03.7972954Z Cryptographic Parameters: Provider Name: Microsoft Software Key Storage Provider Algorithm Name: UNKNOWN Key Name: f8df15d9-56fa-0cb3-682b-838ed74af121 Key Type: %%2500 Key File Operation Information: File Path: C:\ProgramData\Microsoft\Crypto\SystemKeys\8bb43a3e92c2eb4c420c9abd6e278936_9ee7012e-fa60-42be-b8b4-8dc8b4e1280d Operation: %%2458 Return Code: 0x0
|
| | Security | Audit Success | 12292 | 2025-11-29 04:20:04 | | Microsoft-Windows-Security-Auditing | 5059: Key migration operation. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Process Information: Process ID: 1360 Process Creation Time: 2025-11-29T12:20:03.7972954Z Cryptographic Parameters: Provider Name: Microsoft Software Key Storage Provider Algorithm Name: RSA Key Name: f8df15d9-56fa-0cb3-682b-838ed74af121 Key Type: %%2500 Additional Information: Operation: %%2464 Return Code: 0x0
|
| | Security | Audit Success | 12292 | 2025-11-29 04:20:04 | | Microsoft-Windows-Security-Auditing | 5058: Key file operation. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Process Information: Process ID: 1360 Process Creation Time: 2025-11-29T12:20:03.7972954Z Cryptographic Parameters: Provider Name: Microsoft Software Key Storage Provider Algorithm Name: UNKNOWN Key Name: f8df15d9-56fa-0cb3-682b-838ed74af121 Key Type: %%2500 Key File Operation Information: File Path: C:\ProgramData\Microsoft\Crypto\SystemKeys\8bb43a3e92c2eb4c420c9abd6e278936_9ee7012e-fa60-42be-b8b4-8dc8b4e1280d Operation: %%2458 Return Code: 0x0
|
| | Security | Audit Success | 12292 | 2025-11-29 04:20:04 | | Microsoft-Windows-Security-Auditing | 5058: Key file operation. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Process Information: Process ID: 1360 Process Creation Time: 2025-11-29T12:20:03.7972954Z Cryptographic Parameters: Provider Name: Microsoft Software Key Storage Provider Algorithm Name: UNKNOWN Key Name: f8df15d9-56fa-0cb3-682b-838ed74af121 Key Type: %%2500 Key File Operation Information: File Path: C:\ProgramData\Microsoft\Crypto\SystemKeys\8bb43a3e92c2eb4c420c9abd6e278936_9ee7012e-fa60-42be-b8b4-8dc8b4e1280d Operation: %%2458 Return Code: 0x0
|
| | Security | Audit Success | 12292 | 2025-11-29 04:20:04 | | Microsoft-Windows-Security-Auditing | 5059: Key migration operation. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Process Information: Process ID: 1360 Process Creation Time: 2025-11-29T12:20:03.7972954Z Cryptographic Parameters: Provider Name: Microsoft Software Key Storage Provider Algorithm Name: RSA Key Name: f8df15d9-56fa-0cb3-682b-838ed74af121 Key Type: %%2500 Additional Information: Operation: %%2464 Return Code: 0x0
|
| | Security | Audit Success | 12292 | 2025-11-29 04:20:04 | | Microsoft-Windows-Security-Auditing | 5058: Key file operation. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Process Information: Process ID: 1360 Process Creation Time: 2025-11-29T12:20:03.7972954Z Cryptographic Parameters: Provider Name: Microsoft Software Key Storage Provider Algorithm Name: UNKNOWN Key Name: f8df15d9-56fa-0cb3-682b-838ed74af121 Key Type: %%2500 Key File Operation Information: File Path: C:\ProgramData\Microsoft\Crypto\SystemKeys\8bb43a3e92c2eb4c420c9abd6e278936_9ee7012e-fa60-42be-b8b4-8dc8b4e1280d Operation: %%2458 Return Code: 0x0
|
| | Security | Audit Success | 12292 | 2025-11-29 04:20:04 | | Microsoft-Windows-Security-Auditing | 5058: Key file operation. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Process Information: Process ID: 1360 Process Creation Time: 2025-11-29T12:20:03.7972954Z Cryptographic Parameters: Provider Name: Microsoft Software Key Storage Provider Algorithm Name: UNKNOWN Key Name: f8df15d9-56fa-0cb3-682b-838ed74af121 Key Type: %%2500 Key File Operation Information: File Path: C:\ProgramData\Microsoft\Crypto\SystemKeys\8bb43a3e92c2eb4c420c9abd6e278936_9ee7012e-fa60-42be-b8b4-8dc8b4e1280d Operation: %%2458 Return Code: 0x0
|
| | Security | Audit Success | 12292 | 2025-11-29 04:20:04 | | Microsoft-Windows-Security-Auditing | 5059: Key migration operation. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Process Information: Process ID: 1360 Process Creation Time: 2025-11-29T12:20:03.7972954Z Cryptographic Parameters: Provider Name: Microsoft Software Key Storage Provider Algorithm Name: RSA Key Name: f8df15d9-56fa-0cb3-682b-838ed74af121 Key Type: %%2500 Additional Information: Operation: %%2464 Return Code: 0x0
|
| | Security | Audit Success | 12292 | 2025-11-29 04:20:04 | | Microsoft-Windows-Security-Auditing | 5058: Key file operation. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Process Information: Process ID: 1360 Process Creation Time: 2025-11-29T12:20:03.7972954Z Cryptographic Parameters: Provider Name: Microsoft Software Key Storage Provider Algorithm Name: UNKNOWN Key Name: f8df15d9-56fa-0cb3-682b-838ed74af121 Key Type: %%2500 Key File Operation Information: File Path: C:\ProgramData\Microsoft\Crypto\SystemKeys\8bb43a3e92c2eb4c420c9abd6e278936_9ee7012e-fa60-42be-b8b4-8dc8b4e1280d Operation: %%2458 Return Code: 0x0
|
| | Security | Audit Success | 12292 | 2025-11-29 04:20:04 | | Microsoft-Windows-Security-Auditing | 5058: Key file operation. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Process Information: Process ID: 1360 Process Creation Time: 2025-11-29T12:20:03.7972954Z Cryptographic Parameters: Provider Name: Microsoft Software Key Storage Provider Algorithm Name: UNKNOWN Key Name: f8df15d9-56fa-0cb3-682b-838ed74af121 Key Type: %%2500 Key File Operation Information: File Path: C:\ProgramData\Microsoft\Crypto\SystemKeys\8bb43a3e92c2eb4c420c9abd6e278936_9ee7012e-fa60-42be-b8b4-8dc8b4e1280d Operation: %%2458 Return Code: 0x0
|
| | Security | Audit Success | 12292 | 2025-11-29 04:20:04 | | Microsoft-Windows-Security-Auditing | 5059: Key migration operation. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Process Information: Process ID: 1360 Process Creation Time: 2025-11-29T12:20:03.7972954Z Cryptographic Parameters: Provider Name: Microsoft Software Key Storage Provider Algorithm Name: RSA Key Name: f8df15d9-56fa-0cb3-682b-838ed74af121 Key Type: %%2500 Additional Information: Operation: %%2464 Return Code: 0x0
|
| | Security | Audit Success | 12292 | 2025-11-29 04:20:04 | | Microsoft-Windows-Security-Auditing | 5058: Key file operation. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Process Information: Process ID: 1360 Process Creation Time: 2025-11-29T12:20:03.7972954Z Cryptographic Parameters: Provider Name: Microsoft Software Key Storage Provider Algorithm Name: UNKNOWN Key Name: f8df15d9-56fa-0cb3-682b-838ed74af121 Key Type: %%2500 Key File Operation Information: File Path: C:\ProgramData\Microsoft\Crypto\SystemKeys\8bb43a3e92c2eb4c420c9abd6e278936_9ee7012e-fa60-42be-b8b4-8dc8b4e1280d Operation: %%2458 Return Code: 0x0
|
| | Security | Audit Success | 12292 | 2025-11-29 04:20:04 | | Microsoft-Windows-Security-Auditing | 5058: Key file operation. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Process Information: Process ID: 1360 Process Creation Time: 2025-11-29T12:20:03.7972954Z Cryptographic Parameters: Provider Name: Microsoft Software Key Storage Provider Algorithm Name: UNKNOWN Key Name: f8df15d9-56fa-0cb3-682b-838ed74af121 Key Type: %%2500 Key File Operation Information: File Path: C:\ProgramData\Microsoft\Crypto\SystemKeys\8bb43a3e92c2eb4c420c9abd6e278936_9ee7012e-fa60-42be-b8b4-8dc8b4e1280d Operation: %%2458 Return Code: 0x0
|
| | Security | Audit Success | 12292 | 2025-11-29 04:20:04 | | Microsoft-Windows-Security-Auditing | 5059: Key migration operation. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Process Information: Process ID: 1360 Process Creation Time: 2025-11-29T12:20:03.7972954Z Cryptographic Parameters: Provider Name: Microsoft Software Key Storage Provider Algorithm Name: RSA Key Name: f8df15d9-56fa-0cb3-682b-838ed74af121 Key Type: %%2500 Additional Information: Operation: %%2464 Return Code: 0x0
|
| | Security | Audit Success | 12292 | 2025-11-29 04:20:04 | | Microsoft-Windows-Security-Auditing | 5058: Key file operation. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Process Information: Process ID: 1360 Process Creation Time: 2025-11-29T12:20:03.7972954Z Cryptographic Parameters: Provider Name: Microsoft Software Key Storage Provider Algorithm Name: UNKNOWN Key Name: f8df15d9-56fa-0cb3-682b-838ed74af121 Key Type: %%2500 Key File Operation Information: File Path: C:\ProgramData\Microsoft\Crypto\SystemKeys\8bb43a3e92c2eb4c420c9abd6e278936_9ee7012e-fa60-42be-b8b4-8dc8b4e1280d Operation: %%2458 Return Code: 0x0
|
| | Security | Audit Success | 12292 | 2025-11-29 04:20:04 | | Microsoft-Windows-Security-Auditing | 5058: Key file operation. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Process Information: Process ID: 1360 Process Creation Time: 2025-11-29T12:20:03.7972954Z Cryptographic Parameters: Provider Name: Microsoft Software Key Storage Provider Algorithm Name: UNKNOWN Key Name: f8df15d9-56fa-0cb3-682b-838ed74af121 Key Type: %%2500 Key File Operation Information: File Path: C:\ProgramData\Microsoft\Crypto\SystemKeys\8bb43a3e92c2eb4c420c9abd6e278936_9ee7012e-fa60-42be-b8b4-8dc8b4e1280d Operation: %%2458 Return Code: 0x0
|
| | Security | Audit Success | 12292 | 2025-11-29 04:20:04 | | Microsoft-Windows-Security-Auditing | 5059: Key migration operation. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Process Information: Process ID: 1360 Process Creation Time: 2025-11-29T12:20:03.7972954Z Cryptographic Parameters: Provider Name: Microsoft Software Key Storage Provider Algorithm Name: RSA Key Name: f8df15d9-56fa-0cb3-682b-838ed74af121 Key Type: %%2500 Additional Information: Operation: %%2464 Return Code: 0x0
|
| | Security | Audit Success | 12292 | 2025-11-29 04:20:04 | | Microsoft-Windows-Security-Auditing | 5058: Key file operation. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Process Information: Process ID: 1360 Process Creation Time: 2025-11-29T12:20:03.7972954Z Cryptographic Parameters: Provider Name: Microsoft Software Key Storage Provider Algorithm Name: UNKNOWN Key Name: f8df15d9-56fa-0cb3-682b-838ed74af121 Key Type: %%2500 Key File Operation Information: File Path: C:\ProgramData\Microsoft\Crypto\SystemKeys\8bb43a3e92c2eb4c420c9abd6e278936_9ee7012e-fa60-42be-b8b4-8dc8b4e1280d Operation: %%2458 Return Code: 0x0
|
| | Security | Audit Success | 12292 | 2025-11-29 04:20:04 | | Microsoft-Windows-Security-Auditing | 5058: Key file operation. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Process Information: Process ID: 1360 Process Creation Time: 2025-11-29T12:20:03.7972954Z Cryptographic Parameters: Provider Name: Microsoft Software Key Storage Provider Algorithm Name: UNKNOWN Key Name: f8df15d9-56fa-0cb3-682b-838ed74af121 Key Type: %%2500 Key File Operation Information: File Path: C:\ProgramData\Microsoft\Crypto\SystemKeys\8bb43a3e92c2eb4c420c9abd6e278936_9ee7012e-fa60-42be-b8b4-8dc8b4e1280d Operation: %%2458 Return Code: 0x0
|
| | Security | Audit Success | 12292 | 2025-11-29 04:20:04 | | Microsoft-Windows-Security-Auditing | 5059: Key migration operation. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Process Information: Process ID: 1360 Process Creation Time: 2025-11-29T12:20:03.7972954Z Cryptographic Parameters: Provider Name: Microsoft Software Key Storage Provider Algorithm Name: RSA Key Name: f8df15d9-56fa-0cb3-682b-838ed74af121 Key Type: %%2500 Additional Information: Operation: %%2464 Return Code: 0x0
|
| | Security | Audit Success | 12292 | 2025-11-29 04:20:04 | | Microsoft-Windows-Security-Auditing | 5058: Key file operation. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Process Information: Process ID: 1360 Process Creation Time: 2025-11-29T12:20:03.7972954Z Cryptographic Parameters: Provider Name: Microsoft Software Key Storage Provider Algorithm Name: UNKNOWN Key Name: f8df15d9-56fa-0cb3-682b-838ed74af121 Key Type: %%2500 Key File Operation Information: File Path: C:\ProgramData\Microsoft\Crypto\SystemKeys\8bb43a3e92c2eb4c420c9abd6e278936_9ee7012e-fa60-42be-b8b4-8dc8b4e1280d Operation: %%2458 Return Code: 0x0
|
| | Security | Audit Success | 12292 | 2025-11-29 04:20:04 | | Microsoft-Windows-Security-Auditing | 5058: Key file operation. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Process Information: Process ID: 1360 Process Creation Time: 2025-11-29T12:20:03.7972954Z Cryptographic Parameters: Provider Name: Microsoft Software Key Storage Provider Algorithm Name: UNKNOWN Key Name: f8df15d9-56fa-0cb3-682b-838ed74af121 Key Type: %%2500 Key File Operation Information: File Path: C:\ProgramData\Microsoft\Crypto\SystemKeys\8bb43a3e92c2eb4c420c9abd6e278936_9ee7012e-fa60-42be-b8b4-8dc8b4e1280d Operation: %%2458 Return Code: 0x0
|
| | Security | Audit Success | 12292 | 2025-11-29 04:20:04 | | Microsoft-Windows-Security-Auditing | 5059: Key migration operation. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Process Information: Process ID: 1360 Process Creation Time: 2025-11-29T12:20:03.7972954Z Cryptographic Parameters: Provider Name: Microsoft Software Key Storage Provider Algorithm Name: RSA Key Name: f8df15d9-56fa-0cb3-682b-838ed74af121 Key Type: %%2500 Additional Information: Operation: %%2464 Return Code: 0x0
|
| | Security | Audit Success | 12292 | 2025-11-29 04:20:04 | | Microsoft-Windows-Security-Auditing | 5058: Key file operation. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Process Information: Process ID: 1360 Process Creation Time: 2025-11-29T12:20:03.7972954Z Cryptographic Parameters: Provider Name: Microsoft Software Key Storage Provider Algorithm Name: UNKNOWN Key Name: f8df15d9-56fa-0cb3-682b-838ed74af121 Key Type: %%2500 Key File Operation Information: File Path: C:\ProgramData\Microsoft\Crypto\SystemKeys\8bb43a3e92c2eb4c420c9abd6e278936_9ee7012e-fa60-42be-b8b4-8dc8b4e1280d Operation: %%2458 Return Code: 0x0
|
| | Security | Audit Success | 12292 | 2025-11-29 04:20:04 | | Microsoft-Windows-Security-Auditing | 5058: Key file operation. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Process Information: Process ID: 1360 Process Creation Time: 2025-11-29T12:20:03.7972954Z Cryptographic Parameters: Provider Name: Microsoft Software Key Storage Provider Algorithm Name: UNKNOWN Key Name: f8df15d9-56fa-0cb3-682b-838ed74af121 Key Type: %%2500 Key File Operation Information: File Path: C:\ProgramData\Microsoft\Crypto\SystemKeys\8bb43a3e92c2eb4c420c9abd6e278936_9ee7012e-fa60-42be-b8b4-8dc8b4e1280d Operation: %%2458 Return Code: 0x0
|
| | Security | Audit Success | 12292 | 2025-11-29 04:20:04 | | Microsoft-Windows-Security-Auditing | 5059: Key migration operation. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Process Information: Process ID: 1360 Process Creation Time: 2025-11-29T12:20:03.7972954Z Cryptographic Parameters: Provider Name: Microsoft Software Key Storage Provider Algorithm Name: RSA Key Name: f8df15d9-56fa-0cb3-682b-838ed74af121 Key Type: %%2500 Additional Information: Operation: %%2464 Return Code: 0x0
|
| | Security | Audit Success | 12544 | 2025-11-29 04:20:04 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4f8 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12548 | 2025-11-29 04:20:04 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 13824 | 2025-11-29 04:20:04 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:20:04 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:20:04 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:20:04 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:20:04 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:20:04 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:20:04 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:20:04 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:20:04 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:20:04 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:20:04 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:20:04 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:20:04 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:20:04 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1000 Account Name: defaultuser0 Account Domain: DESKTOP-0JV7HJV Logon ID: 0x65f81 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:20:04 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1000 Account Name: defaultuser0 Account Domain: DESKTOP-0JV7HJV Logon ID: 0x65f81 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:20:04 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1000 Account Name: defaultuser0 Account Domain: DESKTOP-0JV7HJV Logon ID: 0x65f81 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:20:04 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1000 Account Name: defaultuser0 Account Domain: DESKTOP-0JV7HJV Logon ID: 0x65f81 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:20:04 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1000 Account Name: defaultuser0 Account Domain: DESKTOP-0JV7HJV Logon ID: 0x65f81 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:20:04 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1000 Account Name: defaultuser0 Account Domain: DESKTOP-0JV7HJV Logon ID: 0x65f81 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:20:04 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1000 Account Name: defaultuser0 Account Domain: DESKTOP-0JV7HJV Logon ID: 0x65f81 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:20:04 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1000 Account Name: defaultuser0 Account Domain: DESKTOP-0JV7HJV Logon ID: 0x65f81 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:20:04 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:20:04 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:20:04 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:20:04 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:20:04 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:20:04 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:20:04 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:20:04 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:20:04 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:20:04 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:20:04 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:20:04 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:20:04 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:20:04 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:20:04 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:20:04 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:20:04 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:20:04 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:20:04 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:20:04 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:20:04 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:20:04 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:20:04 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:20:04 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:20:04 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:20:04 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:20:04 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:20:04 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 12544 | 2025-11-29 04:28:12 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4f8 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12548 | 2025-11-29 04:28:12 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12544 | 2025-11-29 04:28:13 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4f8 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12548 | 2025-11-29 04:28:13 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12544 | 2025-11-29 04:28:14 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4f8 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12548 | 2025-11-29 04:28:14 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 13824 | 2025-11-29 04:28:50 | | Microsoft-Windows-Security-Auditing | 4720: A user account was created. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 New Account: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Attributes: SAM Account Name: CogiArt Display Name: %%1793 User Principal Name: - Home Directory: %%1793 Home Drive: %%1793 Script Path: %%1793 Profile Path: %%1793 User Workstations: %%1793 Password Last Set: %%1794 Account Expires: %%1794 Primary Group ID: 513 Allowed To Delegate To: - Old UAC Value: 0x0 New UAC Value: 0x15 User Account Control: %%2080 %%2082 %%2084 User Parameters: %%1793 SID History: - Logon Hours: %%1797 Additional Information: Privileges -
|
| | Security | Audit Success | 13824 | 2025-11-29 04:28:50 | | Microsoft-Windows-Security-Auditing | 4722: A user account was enabled. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Target Account: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV
|
| | Security | Audit Success | 13824 | 2025-11-29 04:28:50 | | Microsoft-Windows-Security-Auditing | 4738: A user account was changed. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Target Account: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Changed Attributes: SAM Account Name: CogiArt Display Name: %%1793 User Principal Name: - Home Directory: %%1793 Home Drive: %%1793 Script Path: %%1793 Profile Path: %%1793 User Workstations: %%1793 Password Last Set: %%1794 Account Expires: %%1794 Primary Group ID: 513 AllowedToDelegateTo: - Old UAC Value: 0x15 New UAC Value: 0x14 User Account Control: %%2048 User Parameters: %%1793 SID History: - Logon Hours: %%1797 Additional Information: Privileges: -
|
| | Security | Audit Success | 13826 | 2025-11-29 04:28:50 | | Microsoft-Windows-Security-Auditing | 4728: A member was added to a security-enabled global group. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Member: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: - Group: Security ID: S-1-5-21-2954332259-1466799094-2054226798-513 Group Name: None Group Domain: DESKTOP-0JV7HJV Additional Information: Privileges: - Expiration time: (null)
|
| | Security | Audit Success | 13826 | 2025-11-29 04:28:50 | | Microsoft-Windows-Security-Auditing | 4732: A member was added to a security-enabled local group. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Member: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: - Group: Security ID: S-1-5-32-545 Group Name: Users Group Domain: Builtin Additional Information: Privileges: - Expiration time: (null)
|
| | Security | Audit Success | 12544 | 2025-11-29 04:28:51 | | Microsoft-Windows-Security-Auditing | 4648: A logon was attempted using explicit credentials. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1000 Account Name: defaultuser0 Account Domain: DESKTOP-0JV7HJV Logon ID: 0x65f81 Logon GUID: {00000000-0000-0000-0000-000000000000} Account Whose Credentials Were Used: Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon GUID: {00000000-0000-0000-0000-000000000000} Target Server: Target Server Name: localhost Additional Information: localhost Process Information: Process ID: 0x1b5c Process Name: C:\Windows\System32\CloudExperienceHostBroker.exe Network Information: Network Address: - Port: - This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
|
| | Security | Audit Success | 12544 | 2025-11-29 04:28:51 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1000 Account Name: defaultuser0 Account Domain: DESKTOP-0JV7HJV Logon ID: 0x65f81 Logon Information: Logon Type: 2 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x1723f6 Linked Logon ID: 0x172439 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x1b5c Process Name: C:\Windows\System32\CloudExperienceHostBroker.exe Network Information: Workstation Name: WIN-GH7MCVI2372 Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: OOBE Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-29 04:28:51 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1000 Account Name: defaultuser0 Account Domain: DESKTOP-0JV7HJV Logon ID: 0x65f81 Logon Information: Logon Type: 2 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1843 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x172439 Linked Logon ID: 0x1723f6 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x1b5c Process Name: C:\Windows\System32\CloudExperienceHostBroker.exe Network Information: Workstation Name: WIN-GH7MCVI2372 Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: OOBE Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12548 | 2025-11-29 04:28:51 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x1723f6 Privileges: SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 13824 | 2025-11-29 04:28:51 | | Microsoft-Windows-Security-Auditing | 4738: A user account was changed. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Target Account: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Changed Attributes: SAM Account Name: CogiArt Display Name: %%1793 User Principal Name: - Home Directory: %%1793 Home Drive: %%1793 Script Path: %%1793 Profile Path: %%1793 User Workstations: %%1793 Password Last Set: 11/29/2025 4:28:51 AM Account Expires: %%1794 Primary Group ID: 513 AllowedToDelegateTo: - Old UAC Value: 0x14 New UAC Value: 0x14 User Account Control: - User Parameters: - SID History: - Logon Hours: %%1797 Additional Information: Privileges: -
|
| | Security | Audit Success | 13824 | 2025-11-29 04:28:51 | | Microsoft-Windows-Security-Auditing | 4724: An attempt was made to reset an account's password. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Target Account: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV
|
| | Security | Audit Success | 13824 | 2025-11-29 04:28:51 | | Microsoft-Windows-Security-Auditing | 4738: A user account was changed. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Target Account: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Changed Attributes: SAM Account Name: CogiArt Display Name: %%1793 User Principal Name: - Home Directory: %%1793 Home Drive: %%1793 Script Path: %%1793 Profile Path: %%1793 User Workstations: %%1793 Password Last Set: 11/29/2025 4:28:51 AM Account Expires: %%1794 Primary Group ID: 513 AllowedToDelegateTo: - Old UAC Value: 0x14 New UAC Value: 0x214 User Account Control: %%2089 User Parameters: - SID History: - Logon Hours: %%1797 Additional Information: Privileges: -
|
| | Security | Audit Success | 13824 | 2025-11-29 04:28:51 | | Microsoft-Windows-Security-Auditing | 4724: An attempt was made to reset an account's password. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Target Account: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV
|
| | Security | Audit Success | 13824 | 2025-11-29 04:28:51 | | Microsoft-Windows-Security-Auditing | 4738: A user account was changed. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Target Account: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Changed Attributes: SAM Account Name: - Display Name: - User Principal Name: - Home Directory: - Home Drive: - Script Path: - Profile Path: - User Workstations: - Password Last Set: - Account Expires: - Primary Group ID: - AllowedToDelegateTo: - Old UAC Value: - New UAC Value: - User Account Control: - User Parameters: - SID History: - Logon Hours: - Additional Information: Privileges: -
|
| | Security | Audit Success | 13824 | 2025-11-29 04:28:51 | | Microsoft-Windows-Security-Auditing | 4798: A user's local group membership was enumerated. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 User: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Process Information: Process ID: 0x50c Process Name: C:\Windows\System32\lsass.exe
|
| | Security | Audit Success | 13826 | 2025-11-29 04:28:51 | | Microsoft-Windows-Security-Auditing | 4799: A security-enabled local group membership was enumerated. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Group: Security ID: S-1-5-32-544 Group Name: Administrators Group Domain: Builtin Process Information: Process ID: 0x1b5c Process Name: C:\Windows\System32\CloudExperienceHostBroker.exe
|
| | Security | Audit Success | 13826 | 2025-11-29 04:28:51 | | Microsoft-Windows-Security-Auditing | 4799: A security-enabled local group membership was enumerated. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Group: Security ID: S-1-5-32-544 Group Name: Administrators Group Domain: Builtin Process Information: Process ID: 0x1b5c Process Name: C:\Windows\System32\CloudExperienceHostBroker.exe
|
| | Security | Audit Success | 13826 | 2025-11-29 04:28:51 | | Microsoft-Windows-Security-Auditing | 4732: A member was added to a security-enabled local group. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Member: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: - Group: Security ID: S-1-5-32-544 Group Name: Administrators Group Domain: Builtin Additional Information: Privileges: - Expiration time: (null)
|
| | Security | Audit Success | 13826 | 2025-11-29 04:28:51 | | Microsoft-Windows-Security-Auditing | 4799: A security-enabled local group membership was enumerated. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Group: Security ID: S-1-5-32-544 Group Name: Administrators Group Domain: Builtin Process Information: Process ID: 0x1b5c Process Name: C:\Windows\System32\CloudExperienceHostBroker.exe
|
| | Security | Audit Success | 13826 | 2025-11-29 04:28:51 | | Microsoft-Windows-Security-Auditing | 4799: A security-enabled local group membership was enumerated. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Group: Security ID: S-1-5-32-544 Group Name: Administrators Group Domain: Builtin Process Information: Process ID: 0x1b5c Process Name: C:\Windows\System32\CloudExperienceHostBroker.exe
|
| | Security | Audit Success | 13826 | 2025-11-29 04:28:51 | | Microsoft-Windows-Security-Auditing | 4799: A security-enabled local group membership was enumerated. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Group: Security ID: S-1-5-32-545 Group Name: Users Group Domain: Builtin Process Information: Process ID: 0x1b5c Process Name: C:\Windows\System32\CloudExperienceHostBroker.exe
|
| | Security | Audit Success | 13826 | 2025-11-29 04:28:51 | | Microsoft-Windows-Security-Auditing | 4799: A security-enabled local group membership was enumerated. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Group: Security ID: S-1-5-32-545 Group Name: Users Group Domain: Builtin Process Information: Process ID: 0x1b5c Process Name: C:\Windows\System32\CloudExperienceHostBroker.exe
|
| | Security | Audit Success | 13826 | 2025-11-29 04:28:51 | | Microsoft-Windows-Security-Auditing | 4799: A security-enabled local group membership was enumerated. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Group: Security ID: S-1-5-32-545 Group Name: Users Group Domain: Builtin Process Information: Process ID: 0x1b5c Process Name: C:\Windows\System32\CloudExperienceHostBroker.exe
|
| | Security | Audit Success | 13826 | 2025-11-29 04:28:51 | | Microsoft-Windows-Security-Auditing | 4733: A member was removed from a security-enabled local group. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Member: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: - Group: Security ID: S-1-5-32-545 Group Name: Users Group Domain: Builtin Additional Information: Privileges: -
|
| | Security | Audit Success | 13826 | 2025-11-29 04:28:51 | | Microsoft-Windows-Security-Auditing | 4799: A security-enabled local group membership was enumerated. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Group: Security ID: S-1-5-32-545 Group Name: Users Group Domain: Builtin Process Information: Process ID: 0x1b5c Process Name: C:\Windows\System32\CloudExperienceHostBroker.exe
|
| | Security | Audit Success | 13826 | 2025-11-29 04:28:51 | | Microsoft-Windows-Security-Auditing | 4799: A security-enabled local group membership was enumerated. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Group: Security ID: S-1-5-32-545 Group Name: Users Group Domain: Builtin Process Information: Process ID: 0x1b5c Process Name: C:\Windows\System32\CloudExperienceHostBroker.exe
|
| | Security | Audit Success | 12290 | 2025-11-29 04:28:52 | | Microsoft-Windows-Security-Auditing | 5061: Cryptographic operation. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Cryptographic Parameters: Provider Name: Microsoft Software Key Storage Provider Algorithm Name: RSA Key Name: f8df15d9-56fa-0cb3-682b-838ed74af121 Key Type: %%2500 Cryptographic Operation: Operation: %%2480 Return Code: 0x0
|
| | Security | Audit Success | 12290 | 2025-11-29 04:28:52 | | Microsoft-Windows-Security-Auditing | 5061: Cryptographic operation. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Cryptographic Parameters: Provider Name: Microsoft Software Key Storage Provider Algorithm Name: RSA Key Name: f8df15d9-56fa-0cb3-682b-838ed74af121 Key Type: %%2500 Cryptographic Operation: Operation: %%2480 Return Code: 0x0
|
| | Security | Audit Success | 12292 | 2025-11-29 04:28:52 | | Microsoft-Windows-Security-Auditing | 5058: Key file operation. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Process Information: Process ID: 9044 Process Creation Time: 2025-11-29T12:28:52.7888123Z Cryptographic Parameters: Provider Name: Microsoft Software Key Storage Provider Algorithm Name: UNKNOWN Key Name: f8df15d9-56fa-0cb3-682b-838ed74af121 Key Type: %%2500 Key File Operation Information: File Path: C:\ProgramData\Microsoft\Crypto\SystemKeys\8bb43a3e92c2eb4c420c9abd6e278936_9ee7012e-fa60-42be-b8b4-8dc8b4e1280d Operation: %%2458 Return Code: 0x0
|
| | Security | Audit Success | 12292 | 2025-11-29 04:28:52 | | Microsoft-Windows-Security-Auditing | 5058: Key file operation. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Process Information: Process ID: 9044 Process Creation Time: 2025-11-29T12:28:52.7888123Z Cryptographic Parameters: Provider Name: Microsoft Software Key Storage Provider Algorithm Name: UNKNOWN Key Name: f8df15d9-56fa-0cb3-682b-838ed74af121 Key Type: %%2500 Key File Operation Information: File Path: C:\ProgramData\Microsoft\Crypto\SystemKeys\8bb43a3e92c2eb4c420c9abd6e278936_9ee7012e-fa60-42be-b8b4-8dc8b4e1280d Operation: %%2458 Return Code: 0x0
|
| | Security | Audit Success | 12292 | 2025-11-29 04:28:52 | | Microsoft-Windows-Security-Auditing | 5059: Key migration operation. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Process Information: Process ID: 9044 Process Creation Time: 2025-11-29T12:28:52.7888123Z Cryptographic Parameters: Provider Name: Microsoft Software Key Storage Provider Algorithm Name: RSA Key Name: f8df15d9-56fa-0cb3-682b-838ed74af121 Key Type: %%2500 Additional Information: Operation: %%2464 Return Code: 0x0
|
| | Security | Audit Success | 12544 | 2025-11-29 04:28:52 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4f8 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-29 04:28:52 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4f8 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-29 04:28:52 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4f8 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-29 04:28:52 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4f8 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12548 | 2025-11-29 04:28:52 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-29 04:28:52 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-29 04:28:52 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-29 04:28:52 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 13824 | 2025-11-29 04:28:52 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:28:52 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:28:52 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:28:52 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:28:52 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:28:52 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:28:52 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13826 | 2025-11-29 04:28:52 | | Microsoft-Windows-Security-Auditing | 4799: A security-enabled local group membership was enumerated. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Group: Security ID: S-1-5-32-544 Group Name: Administrators Group Domain: Builtin Process Information: Process ID: 0x750 Process Name: C:\Windows\System32\svchost.exe
|
| | Security | Audit Success | 12290 | 2025-11-29 04:28:53 | | Microsoft-Windows-Security-Auditing | 5061: Cryptographic operation. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Cryptographic Parameters: Provider Name: Microsoft Software Key Storage Provider Algorithm Name: RSA Key Name: f8df15d9-56fa-0cb3-682b-838ed74af121 Key Type: %%2500 Cryptographic Operation: Operation: %%2480 Return Code: 0x0
|
| | Security | Audit Success | 12290 | 2025-11-29 04:28:53 | | Microsoft-Windows-Security-Auditing | 5061: Cryptographic operation. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Cryptographic Parameters: Provider Name: Microsoft Software Key Storage Provider Algorithm Name: RSA Key Name: f8df15d9-56fa-0cb3-682b-838ed74af121 Key Type: %%2500 Cryptographic Operation: Operation: %%2480 Return Code: 0x0
|
| | Security | Audit Success | 12292 | 2025-11-29 04:28:53 | | Microsoft-Windows-Security-Auditing | 5058: Key file operation. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Process Information: Process ID: 9044 Process Creation Time: 2025-11-29T12:28:52.7888123Z Cryptographic Parameters: Provider Name: Microsoft Software Key Storage Provider Algorithm Name: UNKNOWN Key Name: f8df15d9-56fa-0cb3-682b-838ed74af121 Key Type: %%2500 Key File Operation Information: File Path: C:\ProgramData\Microsoft\Crypto\SystemKeys\8bb43a3e92c2eb4c420c9abd6e278936_9ee7012e-fa60-42be-b8b4-8dc8b4e1280d Operation: %%2458 Return Code: 0x0
|
| | Security | Audit Success | 12292 | 2025-11-29 04:28:53 | | Microsoft-Windows-Security-Auditing | 5058: Key file operation. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Process Information: Process ID: 9044 Process Creation Time: 2025-11-29T12:28:52.7888123Z Cryptographic Parameters: Provider Name: Microsoft Software Key Storage Provider Algorithm Name: UNKNOWN Key Name: f8df15d9-56fa-0cb3-682b-838ed74af121 Key Type: %%2500 Key File Operation Information: File Path: C:\ProgramData\Microsoft\Crypto\SystemKeys\8bb43a3e92c2eb4c420c9abd6e278936_9ee7012e-fa60-42be-b8b4-8dc8b4e1280d Operation: %%2458 Return Code: 0x0
|
| | Security | Audit Success | 12292 | 2025-11-29 04:28:53 | | Microsoft-Windows-Security-Auditing | 5059: Key migration operation. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Process Information: Process ID: 9044 Process Creation Time: 2025-11-29T12:28:52.7888123Z Cryptographic Parameters: Provider Name: Microsoft Software Key Storage Provider Algorithm Name: RSA Key Name: f8df15d9-56fa-0cb3-682b-838ed74af121 Key Type: %%2500 Additional Information: Operation: %%2464 Return Code: 0x0
|
| | Security | Audit Success | 13824 | 2025-11-29 04:28:53 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:28:53 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1000 Account Name: defaultuser0 Account Domain: DESKTOP-0JV7HJV Logon ID: 0x65f81 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:28:53 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1000 Account Name: defaultuser0 Account Domain: DESKTOP-0JV7HJV Logon ID: 0x65f81 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:28:53 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1000 Account Name: defaultuser0 Account Domain: DESKTOP-0JV7HJV Logon ID: 0x65f81 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:28:53 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1000 Account Name: defaultuser0 Account Domain: DESKTOP-0JV7HJV Logon ID: 0x65f81 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:28:53 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1000 Account Name: defaultuser0 Account Domain: DESKTOP-0JV7HJV Logon ID: 0x65f81 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:28:53 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1000 Account Name: defaultuser0 Account Domain: DESKTOP-0JV7HJV Logon ID: 0x65f81 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:28:53 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1000 Account Name: defaultuser0 Account Domain: DESKTOP-0JV7HJV Logon ID: 0x65f81 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:28:53 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1000 Account Name: defaultuser0 Account Domain: DESKTOP-0JV7HJV Logon ID: 0x65f81 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 12544 | 2025-11-29 04:28:55 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4f8 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12545 | 2025-11-29 04:28:55 | | Microsoft-Windows-Security-Auditing | 4634: An account was logged off. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x172439 Logon Type: 2 This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
|
| | Security | Audit Success | 12545 | 2025-11-29 04:28:55 | | Microsoft-Windows-Security-Auditing | 4634: An account was logged off. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x1723f6 Logon Type: 2 This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
|
| | Security | Audit Success | 12545 | 2025-11-29 04:28:55 | | Microsoft-Windows-Security-Auditing | 4647: User initiated logoff: Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1000 Account Name: defaultuser0 Account Domain: DESKTOP-0JV7HJV Logon ID: 0x65f81 This event is generated when a logoff is initiated. No further user-initiated activity can occur. This event can be interpreted as a logoff event.
|
| | Security | Audit Success | 12548 | 2025-11-29 04:28:55 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 13824 | 2025-11-29 04:28:55 | | Microsoft-Windows-Security-Auditing | 4725: A user account was disabled. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Target Account: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1000 Account Name: defaultuser0 Account Domain: DESKTOP-0JV7HJV
|
| | Security | Audit Success | 13824 | 2025-11-29 04:28:55 | | Microsoft-Windows-Security-Auditing | 4738: A user account was changed. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Target Account: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1000 Account Name: defaultuser0 Account Domain: DESKTOP-0JV7HJV Changed Attributes: SAM Account Name: defaultuser0 Display Name: %%1793 User Principal Name: - Home Directory: %%1793 Home Drive: %%1793 Script Path: %%1793 Profile Path: %%1793 User Workstations: %%1793 Password Last Set: 11/29/2025 4:09:38 AM Account Expires: %%1794 Primary Group ID: 513 AllowedToDelegateTo: - Old UAC Value: 0x214 New UAC Value: 0x211 User Account Control: %%2080 %%2050 User Parameters: %%1793 SID History: - Logon Hours: %%1797 Additional Information: Privileges: -
|
| | Security | Audit Success | 13826 | 2025-11-29 04:28:55 | | Microsoft-Windows-Security-Auditing | 4733: A member was removed from a security-enabled local group. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Member: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1000 Account Name: - Group: Security ID: S-1-5-32-544 Group Name: Administrators Group Domain: Builtin Additional Information: Privileges: -
|
| | Security | Audit Success | 12544 | 2025-11-29 04:28:57 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4f8 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-29 04:28:57 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4f8 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-29 04:28:57 | | Microsoft-Windows-Security-Auditing | 4648: A logon was attempted using explicit credentials. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon GUID: {00000000-0000-0000-0000-000000000000} Account Whose Credentials Were Used: Account Name: UMFD-2 Account Domain: Font Driver Host Logon GUID: {00000000-0000-0000-0000-000000000000} Target Server: Target Server Name: localhost Additional Information: localhost Process Information: Process ID: 0xe7c Process Name: C:\Windows\System32\winlogon.exe Network Information: Network Address: - Port: - This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
|
| | Security | Audit Success | 12544 | 2025-11-29 04:28:57 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 2 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1842 Elevated Token: %%1843 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-96-0-2 Account Name: UMFD-2 Account Domain: Font Driver Host Logon ID: 0x17d389 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0xe7c Process Name: C:\Windows\System32\winlogon.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-29 04:28:57 | | Microsoft-Windows-Security-Auditing | 4648: A logon was attempted using explicit credentials. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon GUID: {00000000-0000-0000-0000-000000000000} Account Whose Credentials Were Used: Account Name: DWM-2 Account Domain: Window Manager Logon GUID: {00000000-0000-0000-0000-000000000000} Target Server: Target Server Name: localhost Additional Information: localhost Process Information: Process ID: 0xe7c Process Name: C:\Windows\System32\winlogon.exe Network Information: Network Address: - Port: - This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
|
| | Security | Audit Success | 12544 | 2025-11-29 04:28:57 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 2 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1842 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-90-0-2 Account Name: DWM-2 Account Domain: Window Manager Logon ID: 0x17d8c1 Linked Logon ID: 0x17d8fc Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0xe7c Process Name: C:\Windows\System32\winlogon.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-29 04:28:57 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 2 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1842 Elevated Token: %%1843 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-90-0-2 Account Name: DWM-2 Account Domain: Window Manager Logon ID: 0x17d8fc Linked Logon ID: 0x17d8c1 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0xe7c Process Name: C:\Windows\System32\winlogon.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12545 | 2025-11-29 04:28:57 | | Microsoft-Windows-Security-Auditing | 4634: An account was logged off. Subject: Security ID: S-1-5-96-0-1 Account Name: UMFD-1 Account Domain: Font Driver Host Logon ID: 0xd1bc Logon Type: 2 This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
|
| | Security | Audit Success | 12548 | 2025-11-29 04:28:57 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-29 04:28:57 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-29 04:28:57 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-90-0-2 Account Name: DWM-2 Account Domain: Window Manager Logon ID: 0x17d8c1 Privileges: SeAssignPrimaryTokenPrivilege SeAuditPrivilege SeImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-29 04:28:57 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-90-0-2 Account Name: DWM-2 Account Domain: Window Manager Logon ID: 0x17d8fc Privileges: SeAssignPrimaryTokenPrivilege SeAuditPrivilege
|
| | Security | Audit Success | 12544 | 2025-11-29 04:28:58 | | Microsoft-Windows-Security-Auditing | 4648: A logon was attempted using explicit credentials. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon GUID: {00000000-0000-0000-0000-000000000000} Account Whose Credentials Were Used: Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon GUID: {00000000-0000-0000-0000-000000000000} Target Server: Target Server Name: localhost Additional Information: localhost Process Information: Process ID: 0x7a8 Process Name: C:\Windows\System32\svchost.exe Network Information: Network Address: 127.0.0.1 Port: 0 This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
|
| | Security | Audit Success | 12544 | 2025-11-29 04:28:58 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 2 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x1800b5 Linked Logon ID: 0x1801ae Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x7a8 Process Name: C:\Windows\System32\svchost.exe Network Information: Workstation Name: WIN-GH7MCVI2372 Source Network Address: 127.0.0.1 Source Port: 0 Detailed Authentication Information: Logon Process: User32 Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-29 04:28:58 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 2 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1843 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x1801ae Linked Logon ID: 0x1800b5 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x7a8 Process Name: C:\Windows\System32\svchost.exe Network Information: Workstation Name: WIN-GH7MCVI2372 Source Network Address: 127.0.0.1 Source Port: 0 Detailed Authentication Information: Logon Process: User32 Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12548 | 2025-11-29 04:28:58 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x1800b5 Privileges: SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 13824 | 2025-11-29 04:28:58 | | Microsoft-Windows-Security-Auditing | 4798: A user's local group membership was enumerated. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 User: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Process Information: Process ID: 0x50c Process Name: C:\Windows\System32\lsass.exe
|
| | Security | Audit Success | 13826 | 2025-11-29 04:28:58 | | Microsoft-Windows-Security-Auditing | 4799: A security-enabled local group membership was enumerated. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Group: Security ID: S-1-5-32-544 Group Name: Administrators Group Domain: Builtin Process Information: Process ID: 0x750 Process Name: C:\Windows\System32\svchost.exe
|
| | Security | Audit Failure | 12290 | 2025-11-29 04:28:59 | | Microsoft-Windows-Security-Auditing | 5061: Cryptographic operation. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x1801ae Cryptographic Parameters: Provider Name: Microsoft Software Key Storage Provider Algorithm Name: UNKNOWN Key Name: Microsoft Connected Devices Platform device certificate Key Type: %%2500 Cryptographic Operation: Operation: %%2480 Return Code: 0x80090016
|
| | Security | Audit Failure | 12290 | 2025-11-29 04:28:59 | | Microsoft-Windows-Security-Auditing | 5061: Cryptographic operation. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x1801ae Cryptographic Parameters: Provider Name: Microsoft Software Key Storage Provider Algorithm Name: UNKNOWN Key Name: Microsoft Connected Devices Platform device certificate Key Type: %%2500 Cryptographic Operation: Operation: %%2480 Return Code: 0x80090016
|
| | Security | Audit Failure | 12290 | 2025-11-29 04:28:59 | | Microsoft-Windows-Security-Auditing | 5061: Cryptographic operation. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x1801ae Cryptographic Parameters: Provider Name: Microsoft Software Key Storage Provider Algorithm Name: UNKNOWN Key Name: Microsoft Connected Devices Platform device certificate Key Type: %%2500 Cryptographic Operation: Operation: %%2480 Return Code: 0x80090016
|
| | Security | Audit Success | 12290 | 2025-11-29 04:28:59 | | Microsoft-Windows-Security-Auditing | 5061: Cryptographic operation. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Cryptographic Parameters: Provider Name: Microsoft Software Key Storage Provider Algorithm Name: RSA Key Name: f8df15d9-56fa-0cb3-682b-838ed74af121 Key Type: %%2500 Cryptographic Operation: Operation: %%2480 Return Code: 0x0
|
| | Security | Audit Success | 12290 | 2025-11-29 04:28:59 | | Microsoft-Windows-Security-Auditing | 5061: Cryptographic operation. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Cryptographic Parameters: Provider Name: Microsoft Software Key Storage Provider Algorithm Name: RSA Key Name: f8df15d9-56fa-0cb3-682b-838ed74af121 Key Type: %%2500 Cryptographic Operation: Operation: %%2480 Return Code: 0x0
|
| | Security | Audit Success | 12290 | 2025-11-29 04:28:59 | | Microsoft-Windows-Security-Auditing | 5061: Cryptographic operation. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x1801ae Cryptographic Parameters: Provider Name: Microsoft Software Key Storage Provider Algorithm Name: ECDSA_P256 Key Name: Microsoft Connected Devices Platform device certificate Key Type: %%2500 Cryptographic Operation: Operation: %%2481 Return Code: 0x0
|
| | Security | Audit Success | 12290 | 2025-11-29 04:28:59 | | Microsoft-Windows-Security-Auditing | 5061: Cryptographic operation. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x1801ae Cryptographic Parameters: Provider Name: Microsoft Software Key Storage Provider Algorithm Name: ECDSA_P256 Key Name: Microsoft Connected Devices Platform device certificate Key Type: %%2500 Cryptographic Operation: Operation: %%2480 Return Code: 0x0
|
| | Security | Audit Success | 12292 | 2025-11-29 04:28:59 | | Microsoft-Windows-Security-Auditing | 5058: Key file operation. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Process Information: Process ID: 9044 Process Creation Time: 2025-11-29T12:28:52.7888123Z Cryptographic Parameters: Provider Name: Microsoft Software Key Storage Provider Algorithm Name: UNKNOWN Key Name: f8df15d9-56fa-0cb3-682b-838ed74af121 Key Type: %%2500 Key File Operation Information: File Path: C:\ProgramData\Microsoft\Crypto\SystemKeys\8bb43a3e92c2eb4c420c9abd6e278936_9ee7012e-fa60-42be-b8b4-8dc8b4e1280d Operation: %%2458 Return Code: 0x0
|
| | Security | Audit Success | 12292 | 2025-11-29 04:28:59 | | Microsoft-Windows-Security-Auditing | 5058: Key file operation. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Process Information: Process ID: 9044 Process Creation Time: 2025-11-29T12:28:52.7888123Z Cryptographic Parameters: Provider Name: Microsoft Software Key Storage Provider Algorithm Name: UNKNOWN Key Name: f8df15d9-56fa-0cb3-682b-838ed74af121 Key Type: %%2500 Key File Operation Information: File Path: C:\ProgramData\Microsoft\Crypto\SystemKeys\8bb43a3e92c2eb4c420c9abd6e278936_9ee7012e-fa60-42be-b8b4-8dc8b4e1280d Operation: %%2458 Return Code: 0x0
|
| | Security | Audit Success | 12292 | 2025-11-29 04:28:59 | | Microsoft-Windows-Security-Auditing | 5059: Key migration operation. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Process Information: Process ID: 9044 Process Creation Time: 2025-11-29T12:28:52.7888123Z Cryptographic Parameters: Provider Name: Microsoft Software Key Storage Provider Algorithm Name: RSA Key Name: f8df15d9-56fa-0cb3-682b-838ed74af121 Key Type: %%2500 Additional Information: Operation: %%2464 Return Code: 0x0
|
| | Security | Audit Success | 12292 | 2025-11-29 04:28:59 | | Microsoft-Windows-Security-Auditing | 5058: Key file operation. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x1801ae Process Information: Process ID: 1632 Process Creation Time: 2025-11-29T12:28:59.1390090Z Cryptographic Parameters: Provider Name: Microsoft Software Key Storage Provider Algorithm Name: ECDSA_P256 Key Name: Microsoft Connected Devices Platform device certificate Key Type: %%2500 Key File Operation Information: File Path: C:\Users\CogiArt\AppData\Roaming\Microsoft\Crypto\Keys\de7cf8a7901d2ad13e5c67c29e5d1662_9ee7012e-fa60-42be-b8b4-8dc8b4e1280d Operation: %%2459 Return Code: 0x0
|
| | Security | Audit Success | 12292 | 2025-11-29 04:28:59 | | Microsoft-Windows-Security-Auditing | 5058: Key file operation. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x1801ae Process Information: Process ID: 1632 Process Creation Time: 2025-11-29T12:28:59.1390090Z Cryptographic Parameters: Provider Name: Microsoft Software Key Storage Provider Algorithm Name: UNKNOWN Key Name: Microsoft Connected Devices Platform device certificate Key Type: %%2500 Key File Operation Information: File Path: C:\Users\CogiArt\AppData\Roaming\Microsoft\Crypto\Keys\de7cf8a7901d2ad13e5c67c29e5d1662_9ee7012e-fa60-42be-b8b4-8dc8b4e1280d Operation: %%2458 Return Code: 0x0
|
| | Security | Audit Success | 12292 | 2025-11-29 04:28:59 | | Microsoft-Windows-Security-Auditing | 5059: Key migration operation. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x1801ae Process Information: Process ID: 1632 Process Creation Time: 2025-11-29T12:28:59.1390090Z Cryptographic Parameters: Provider Name: Microsoft Software Key Storage Provider Algorithm Name: ECDSA_P256 Key Name: Microsoft Connected Devices Platform device certificate Key Type: %%2500 Additional Information: Operation: %%2464 Return Code: 0x0
|
| | Security | Audit Success | 12292 | 2025-11-29 04:28:59 | | Microsoft-Windows-Security-Auditing | 5059: Key migration operation. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x1801ae Process Information: Process ID: 1632 Process Creation Time: 2025-11-29T12:28:59.1390090Z Cryptographic Parameters: Provider Name: Microsoft Software Key Storage Provider Algorithm Name: ECDSA_P256 Key Name: Microsoft Connected Devices Platform device certificate Key Type: %%2500 Additional Information: Operation: %%2464 Return Code: 0x0
|
| | Security | Audit Success | 12292 | 2025-11-29 04:28:59 | | Microsoft-Windows-Security-Auditing | 5059: Key migration operation. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x1801ae Process Information: Process ID: 1632 Process Creation Time: 2025-11-29T12:28:59.1390090Z Cryptographic Parameters: Provider Name: Microsoft Software Key Storage Provider Algorithm Name: ECDSA_P256 Key Name: Microsoft Connected Devices Platform device certificate Key Type: %%2500 Additional Information: Operation: %%2464 Return Code: 0x0
|
| | Security | Audit Success | 12544 | 2025-11-29 04:28:59 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4f8 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-29 04:28:59 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4f8 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-29 04:28:59 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4f8 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12545 | 2025-11-29 04:28:59 | | Microsoft-Windows-Security-Auditing | 4634: An account was logged off. Subject: Security ID: S-1-5-90-0-1 Account Name: DWM-1 Account Domain: Window Manager Logon ID: 0x12dfc Logon Type: 2 This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
|
| | Security | Audit Success | 12545 | 2025-11-29 04:28:59 | | Microsoft-Windows-Security-Auditing | 4634: An account was logged off. Subject: Security ID: S-1-5-90-0-1 Account Name: DWM-1 Account Domain: Window Manager Logon ID: 0x12ddf Logon Type: 2 This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
|
| | Security | Audit Success | 12548 | 2025-11-29 04:28:59 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-29 04:28:59 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-29 04:28:59 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 13824 | 2025-11-29 04:28:59 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x1801ae Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:28:59 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x1801ae Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:28:59 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:28:59 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:28:59 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:28:59 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:28:59 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x1801ae Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:28:59 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x1801ae Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:28:59 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x1801ae Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:28:59 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x1801ae Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:28:59 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x1801ae Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:28:59 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x1801ae Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:28:59 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x1801ae Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:28:59 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x1801ae Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 12290 | 2025-11-29 04:29:02 | | Microsoft-Windows-Security-Auditing | 5061: Cryptographic operation. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Cryptographic Parameters: Provider Name: Microsoft Software Key Storage Provider Algorithm Name: RSA Key Name: f8df15d9-56fa-0cb3-682b-838ed74af121 Key Type: %%2500 Cryptographic Operation: Operation: %%2480 Return Code: 0x0
|
| | Security | Audit Success | 12290 | 2025-11-29 04:29:02 | | Microsoft-Windows-Security-Auditing | 5061: Cryptographic operation. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Cryptographic Parameters: Provider Name: Microsoft Software Key Storage Provider Algorithm Name: RSA Key Name: f8df15d9-56fa-0cb3-682b-838ed74af121 Key Type: %%2500 Cryptographic Operation: Operation: %%2480 Return Code: 0x0
|
| | Security | Audit Success | 12292 | 2025-11-29 04:29:02 | | Microsoft-Windows-Security-Auditing | 5058: Key file operation. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Process Information: Process ID: 9044 Process Creation Time: 2025-11-29T12:28:52.7888123Z Cryptographic Parameters: Provider Name: Microsoft Software Key Storage Provider Algorithm Name: UNKNOWN Key Name: f8df15d9-56fa-0cb3-682b-838ed74af121 Key Type: %%2500 Key File Operation Information: File Path: C:\ProgramData\Microsoft\Crypto\SystemKeys\8bb43a3e92c2eb4c420c9abd6e278936_9ee7012e-fa60-42be-b8b4-8dc8b4e1280d Operation: %%2458 Return Code: 0x0
|
| | Security | Audit Success | 12292 | 2025-11-29 04:29:02 | | Microsoft-Windows-Security-Auditing | 5058: Key file operation. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Process Information: Process ID: 9044 Process Creation Time: 2025-11-29T12:28:52.7888123Z Cryptographic Parameters: Provider Name: Microsoft Software Key Storage Provider Algorithm Name: UNKNOWN Key Name: f8df15d9-56fa-0cb3-682b-838ed74af121 Key Type: %%2500 Key File Operation Information: File Path: C:\ProgramData\Microsoft\Crypto\SystemKeys\8bb43a3e92c2eb4c420c9abd6e278936_9ee7012e-fa60-42be-b8b4-8dc8b4e1280d Operation: %%2458 Return Code: 0x0
|
| | Security | Audit Success | 12292 | 2025-11-29 04:29:02 | | Microsoft-Windows-Security-Auditing | 5059: Key migration operation. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Process Information: Process ID: 9044 Process Creation Time: 2025-11-29T12:28:52.7888123Z Cryptographic Parameters: Provider Name: Microsoft Software Key Storage Provider Algorithm Name: RSA Key Name: f8df15d9-56fa-0cb3-682b-838ed74af121 Key Type: %%2500 Additional Information: Operation: %%2464 Return Code: 0x0
|
| | Security | Audit Success | 13824 | 2025-11-29 04:29:02 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:29:02 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:29:02 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:29:02 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:29:02 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x1800b5 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:29:02 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x1800b5 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:29:02 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x1800b5 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:29:02 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x1800b5 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:29:02 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x1800b5 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:29:02 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x1800b5 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:29:02 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x1800b5 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:29:02 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x1800b5 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 12290 | 2025-11-29 04:29:03 | | Microsoft-Windows-Security-Auditing | 5061: Cryptographic operation. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Cryptographic Parameters: Provider Name: Microsoft Software Key Storage Provider Algorithm Name: RSA Key Name: f8df15d9-56fa-0cb3-682b-838ed74af121 Key Type: %%2500 Cryptographic Operation: Operation: %%2480 Return Code: 0x0
|
| | Security | Audit Success | 12290 | 2025-11-29 04:29:03 | | Microsoft-Windows-Security-Auditing | 5061: Cryptographic operation. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Cryptographic Parameters: Provider Name: Microsoft Software Key Storage Provider Algorithm Name: RSA Key Name: f8df15d9-56fa-0cb3-682b-838ed74af121 Key Type: %%2500 Cryptographic Operation: Operation: %%2480 Return Code: 0x0
|
| | Security | Audit Success | 12292 | 2025-11-29 04:29:03 | | Microsoft-Windows-Security-Auditing | 5058: Key file operation. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Process Information: Process ID: 9044 Process Creation Time: 2025-11-29T12:28:52.7888123Z Cryptographic Parameters: Provider Name: Microsoft Software Key Storage Provider Algorithm Name: UNKNOWN Key Name: f8df15d9-56fa-0cb3-682b-838ed74af121 Key Type: %%2500 Key File Operation Information: File Path: C:\ProgramData\Microsoft\Crypto\SystemKeys\8bb43a3e92c2eb4c420c9abd6e278936_9ee7012e-fa60-42be-b8b4-8dc8b4e1280d Operation: %%2458 Return Code: 0x0
|
| | Security | Audit Success | 12292 | 2025-11-29 04:29:03 | | Microsoft-Windows-Security-Auditing | 5058: Key file operation. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Process Information: Process ID: 9044 Process Creation Time: 2025-11-29T12:28:52.7888123Z Cryptographic Parameters: Provider Name: Microsoft Software Key Storage Provider Algorithm Name: UNKNOWN Key Name: f8df15d9-56fa-0cb3-682b-838ed74af121 Key Type: %%2500 Key File Operation Information: File Path: C:\ProgramData\Microsoft\Crypto\SystemKeys\8bb43a3e92c2eb4c420c9abd6e278936_9ee7012e-fa60-42be-b8b4-8dc8b4e1280d Operation: %%2458 Return Code: 0x0
|
| | Security | Audit Success | 12292 | 2025-11-29 04:29:03 | | Microsoft-Windows-Security-Auditing | 5059: Key migration operation. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Process Information: Process ID: 9044 Process Creation Time: 2025-11-29T12:28:52.7888123Z Cryptographic Parameters: Provider Name: Microsoft Software Key Storage Provider Algorithm Name: RSA Key Name: f8df15d9-56fa-0cb3-682b-838ed74af121 Key Type: %%2500 Additional Information: Operation: %%2464 Return Code: 0x0
|
| | Security | Audit Success | 12544 | 2025-11-29 04:29:03 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4f8 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12548 | 2025-11-29 04:29:03 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 13824 | 2025-11-29 04:29:03 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x1801ae Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:29:03 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x1801ae Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:29:03 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x1801ae Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:29:03 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x1801ae Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:29:03 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:29:03 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:29:03 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:29:03 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:29:03 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x1801ae Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:29:03 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x1801ae Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:29:03 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x1801ae Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:29:03 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x1801ae Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:29:03 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x1801ae Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:29:03 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x1801ae Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:29:03 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x1801ae Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:29:03 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x1801ae Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 12290 | 2025-11-29 04:29:05 | | Microsoft-Windows-Security-Auditing | 5061: Cryptographic operation. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Cryptographic Parameters: Provider Name: Microsoft Software Key Storage Provider Algorithm Name: RSA Key Name: f8df15d9-56fa-0cb3-682b-838ed74af121 Key Type: %%2500 Cryptographic Operation: Operation: %%2480 Return Code: 0x0
|
| | Security | Audit Success | 12290 | 2025-11-29 04:29:05 | | Microsoft-Windows-Security-Auditing | 5061: Cryptographic operation. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Cryptographic Parameters: Provider Name: Microsoft Software Key Storage Provider Algorithm Name: RSA Key Name: f8df15d9-56fa-0cb3-682b-838ed74af121 Key Type: %%2500 Cryptographic Operation: Operation: %%2480 Return Code: 0x0
|
| | Security | Audit Success | 12292 | 2025-11-29 04:29:05 | | Microsoft-Windows-Security-Auditing | 5058: Key file operation. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Process Information: Process ID: 9044 Process Creation Time: 2025-11-29T12:28:52.7888123Z Cryptographic Parameters: Provider Name: Microsoft Software Key Storage Provider Algorithm Name: UNKNOWN Key Name: f8df15d9-56fa-0cb3-682b-838ed74af121 Key Type: %%2500 Key File Operation Information: File Path: C:\ProgramData\Microsoft\Crypto\SystemKeys\8bb43a3e92c2eb4c420c9abd6e278936_9ee7012e-fa60-42be-b8b4-8dc8b4e1280d Operation: %%2458 Return Code: 0x0
|
| | Security | Audit Success | 12292 | 2025-11-29 04:29:05 | | Microsoft-Windows-Security-Auditing | 5058: Key file operation. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Process Information: Process ID: 9044 Process Creation Time: 2025-11-29T12:28:52.7888123Z Cryptographic Parameters: Provider Name: Microsoft Software Key Storage Provider Algorithm Name: UNKNOWN Key Name: f8df15d9-56fa-0cb3-682b-838ed74af121 Key Type: %%2500 Key File Operation Information: File Path: C:\ProgramData\Microsoft\Crypto\SystemKeys\8bb43a3e92c2eb4c420c9abd6e278936_9ee7012e-fa60-42be-b8b4-8dc8b4e1280d Operation: %%2458 Return Code: 0x0
|
| | Security | Audit Success | 12292 | 2025-11-29 04:29:05 | | Microsoft-Windows-Security-Auditing | 5059: Key migration operation. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Process Information: Process ID: 9044 Process Creation Time: 2025-11-29T12:28:52.7888123Z Cryptographic Parameters: Provider Name: Microsoft Software Key Storage Provider Algorithm Name: RSA Key Name: f8df15d9-56fa-0cb3-682b-838ed74af121 Key Type: %%2500 Additional Information: Operation: %%2464 Return Code: 0x0
|
| | Security | Audit Success | 13824 | 2025-11-29 04:29:05 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x1801ae Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:29:05 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x1801ae Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:29:05 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x1801ae Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:29:05 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x1801ae Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:29:05 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:29:05 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:29:05 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:29:05 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13826 | 2025-11-29 04:29:05 | | Microsoft-Windows-Security-Auditing | 4799: A security-enabled local group membership was enumerated. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x1801ae Group: Security ID: S-1-5-32-544 Group Name: Administrators Group Domain: Builtin Process Information: Process ID: 0x71c Process Name: C:\Windows\System32\RuntimeBroker.exe
|
| | Security | Audit Success | 13826 | 2025-11-29 04:29:05 | | Microsoft-Windows-Security-Auditing | 4799: A security-enabled local group membership was enumerated. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x1801ae Group: Security ID: S-1-5-32-544 Group Name: Administrators Group Domain: Builtin Process Information: Process ID: 0x71c Process Name: C:\Windows\System32\RuntimeBroker.exe
|
| | Security | Audit Success | 13824 | 2025-11-29 04:29:17 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x1801ae Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:29:17 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x1801ae Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:29:17 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x1801ae Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:29:17 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x1801ae Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:29:17 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x1801ae Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:29:17 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x1801ae Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:29:17 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x1801ae Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:29:17 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x1801ae Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:29:20 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x1801ae Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:29:20 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x1801ae Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:29:20 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x1801ae Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:29:20 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x1801ae Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:29:20 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x1801ae Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:29:20 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x1801ae Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:29:20 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x1801ae Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:29:20 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x1801ae Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 12290 | 2025-11-29 04:30:06 | | Microsoft-Windows-Security-Auditing | 5061: Cryptographic operation. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Cryptographic Parameters: Provider Name: Microsoft Software Key Storage Provider Algorithm Name: RSA Key Name: f8df15d9-56fa-0cb3-682b-838ed74af121 Key Type: %%2500 Cryptographic Operation: Operation: %%2480 Return Code: 0x0
|
| | Security | Audit Success | 12290 | 2025-11-29 04:30:06 | | Microsoft-Windows-Security-Auditing | 5061: Cryptographic operation. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Cryptographic Parameters: Provider Name: Microsoft Software Key Storage Provider Algorithm Name: RSA Key Name: f8df15d9-56fa-0cb3-682b-838ed74af121 Key Type: %%2500 Cryptographic Operation: Operation: %%2480 Return Code: 0x0
|
| | Security | Audit Success | 12290 | 2025-11-29 04:30:06 | | Microsoft-Windows-Security-Auditing | 5061: Cryptographic operation. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Cryptographic Parameters: Provider Name: Microsoft Software Key Storage Provider Algorithm Name: RSA Key Name: f8df15d9-56fa-0cb3-682b-838ed74af121 Key Type: %%2500 Cryptographic Operation: Operation: %%2480 Return Code: 0x0
|
| | Security | Audit Success | 12290 | 2025-11-29 04:30:06 | | Microsoft-Windows-Security-Auditing | 5061: Cryptographic operation. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Cryptographic Parameters: Provider Name: Microsoft Software Key Storage Provider Algorithm Name: RSA Key Name: f8df15d9-56fa-0cb3-682b-838ed74af121 Key Type: %%2500 Cryptographic Operation: Operation: %%2480 Return Code: 0x0
|
| | Security | Audit Success | 12292 | 2025-11-29 04:30:06 | | Microsoft-Windows-Security-Auditing | 5058: Key file operation. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Process Information: Process ID: 9044 Process Creation Time: 2025-11-29T12:28:52.7888123Z Cryptographic Parameters: Provider Name: Microsoft Software Key Storage Provider Algorithm Name: UNKNOWN Key Name: f8df15d9-56fa-0cb3-682b-838ed74af121 Key Type: %%2500 Key File Operation Information: File Path: C:\ProgramData\Microsoft\Crypto\SystemKeys\8bb43a3e92c2eb4c420c9abd6e278936_9ee7012e-fa60-42be-b8b4-8dc8b4e1280d Operation: %%2458 Return Code: 0x0
|
| | Security | Audit Success | 12292 | 2025-11-29 04:30:06 | | Microsoft-Windows-Security-Auditing | 5058: Key file operation. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Process Information: Process ID: 9044 Process Creation Time: 2025-11-29T12:28:52.7888123Z Cryptographic Parameters: Provider Name: Microsoft Software Key Storage Provider Algorithm Name: UNKNOWN Key Name: f8df15d9-56fa-0cb3-682b-838ed74af121 Key Type: %%2500 Key File Operation Information: File Path: C:\ProgramData\Microsoft\Crypto\SystemKeys\8bb43a3e92c2eb4c420c9abd6e278936_9ee7012e-fa60-42be-b8b4-8dc8b4e1280d Operation: %%2458 Return Code: 0x0
|
| | Security | Audit Success | 12292 | 2025-11-29 04:30:06 | | Microsoft-Windows-Security-Auditing | 5059: Key migration operation. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Process Information: Process ID: 9044 Process Creation Time: 2025-11-29T12:28:52.7888123Z Cryptographic Parameters: Provider Name: Microsoft Software Key Storage Provider Algorithm Name: RSA Key Name: f8df15d9-56fa-0cb3-682b-838ed74af121 Key Type: %%2500 Additional Information: Operation: %%2464 Return Code: 0x0
|
| | Security | Audit Success | 12292 | 2025-11-29 04:30:06 | | Microsoft-Windows-Security-Auditing | 5058: Key file operation. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Process Information: Process ID: 9044 Process Creation Time: 2025-11-29T12:28:52.7888123Z Cryptographic Parameters: Provider Name: Microsoft Software Key Storage Provider Algorithm Name: UNKNOWN Key Name: f8df15d9-56fa-0cb3-682b-838ed74af121 Key Type: %%2500 Key File Operation Information: File Path: C:\ProgramData\Microsoft\Crypto\SystemKeys\8bb43a3e92c2eb4c420c9abd6e278936_9ee7012e-fa60-42be-b8b4-8dc8b4e1280d Operation: %%2458 Return Code: 0x0
|
| | Security | Audit Success | 12292 | 2025-11-29 04:30:06 | | Microsoft-Windows-Security-Auditing | 5058: Key file operation. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Process Information: Process ID: 9044 Process Creation Time: 2025-11-29T12:28:52.7888123Z Cryptographic Parameters: Provider Name: Microsoft Software Key Storage Provider Algorithm Name: UNKNOWN Key Name: f8df15d9-56fa-0cb3-682b-838ed74af121 Key Type: %%2500 Key File Operation Information: File Path: C:\ProgramData\Microsoft\Crypto\SystemKeys\8bb43a3e92c2eb4c420c9abd6e278936_9ee7012e-fa60-42be-b8b4-8dc8b4e1280d Operation: %%2458 Return Code: 0x0
|
| | Security | Audit Success | 12292 | 2025-11-29 04:30:06 | | Microsoft-Windows-Security-Auditing | 5059: Key migration operation. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Process Information: Process ID: 9044 Process Creation Time: 2025-11-29T12:28:52.7888123Z Cryptographic Parameters: Provider Name: Microsoft Software Key Storage Provider Algorithm Name: RSA Key Name: f8df15d9-56fa-0cb3-682b-838ed74af121 Key Type: %%2500 Additional Information: Operation: %%2464 Return Code: 0x0
|
| | Security | Audit Success | 12544 | 2025-11-29 04:30:06 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4f8 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-29 04:30:06 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4f8 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12548 | 2025-11-29 04:30:06 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-29 04:30:06 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 13824 | 2025-11-29 04:30:06 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:30:06 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x1801ae Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:30:06 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x1801ae Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:30:06 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x1801ae Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:30:06 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x1801ae Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:30:06 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:30:06 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:30:06 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:30:06 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:30:06 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x1801ae Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:30:06 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x1801ae Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:30:06 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x1801ae Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:30:06 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x1801ae Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:30:06 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x1801ae Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:30:06 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x1801ae Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:30:06 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x1801ae Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:30:06 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x1801ae Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:30:06 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:30:06 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:30:06 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13826 | 2025-11-29 04:30:06 | | Microsoft-Windows-Security-Auditing | 4799: A security-enabled local group membership was enumerated. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x1801ae Group: Security ID: S-1-5-32-544 Group Name: Administrators Group Domain: Builtin Process Information: Process ID: 0x234c Process Name: C:\Windows\System32\RuntimeBroker.exe
|
| | Security | Audit Success | 13826 | 2025-11-29 04:30:06 | | Microsoft-Windows-Security-Auditing | 4799: A security-enabled local group membership was enumerated. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x1801ae Group: Security ID: S-1-5-32-544 Group Name: Administrators Group Domain: Builtin Process Information: Process ID: 0x234c Process Name: C:\Windows\System32\RuntimeBroker.exe
|
| | Security | Audit Success | 13826 | 2025-11-29 04:30:06 | | Microsoft-Windows-Security-Auditing | 4799: A security-enabled local group membership was enumerated. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x1801ae Group: Security ID: S-1-5-32-544 Group Name: Administrators Group Domain: Builtin Process Information: Process ID: 0x734 Process Name: C:\Windows\System32\svchost.exe
|
| | Security | Audit Success | 13826 | 2025-11-29 04:30:06 | | Microsoft-Windows-Security-Auditing | 4799: A security-enabled local group membership was enumerated. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x1801ae Group: Security ID: S-1-5-32-544 Group Name: Administrators Group Domain: Builtin Process Information: Process ID: 0x234c Process Name: C:\Windows\System32\RuntimeBroker.exe
|
| | Security | Audit Success | 13826 | 2025-11-29 04:30:06 | | Microsoft-Windows-Security-Auditing | 4799: A security-enabled local group membership was enumerated. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x1801ae Group: Security ID: S-1-5-32-544 Group Name: Administrators Group Domain: Builtin Process Information: Process ID: 0x234c Process Name: C:\Windows\System32\RuntimeBroker.exe
|
| | Security | Audit Success | 12544 | 2025-11-29 04:30:07 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4f8 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12548 | 2025-11-29 04:30:07 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 13824 | 2025-11-29 04:30:07 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x1801ae Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:30:07 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x1801ae Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:30:07 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x1801ae Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:30:07 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x1801ae Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:30:07 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x1801ae Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:30:07 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x1801ae Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:30:07 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x1801ae Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:30:07 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x1801ae Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:30:07 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x1801ae Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:30:07 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x1801ae Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:30:07 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x1801ae Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:30:07 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x1801ae Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:30:08 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x1801ae Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:30:08 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x1801ae Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:30:08 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x1801ae Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:30:08 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x1801ae Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:30:08 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-19 Account Name: LOCAL SERVICE Account Domain: NT AUTHORITY Logon ID: 0x3e5 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:30:08 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-19 Account Name: LOCAL SERVICE Account Domain: NT AUTHORITY Logon ID: 0x3e5 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:30:08 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-19 Account Name: LOCAL SERVICE Account Domain: NT AUTHORITY Logon ID: 0x3e5 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:30:08 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-19 Account Name: LOCAL SERVICE Account Domain: NT AUTHORITY Logon ID: 0x3e5 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:30:08 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x1801ae Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:30:08 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x1801ae Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:30:08 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x1801ae Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:30:08 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x1801ae Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:30:12 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x1801ae Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:30:12 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x1801ae Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:30:12 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x1801ae Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:30:12 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x1801ae Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:30:12 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x1801ae Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:30:12 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x1801ae Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:30:12 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x1801ae Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:30:12 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x1801ae Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 12544 | 2025-11-29 04:30:25 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4f8 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12548 | 2025-11-29 04:30:25 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 13568 | 2025-11-29 04:30:30 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\_0000000000000000.cdf-ms Handle ID: 0xe70 Process Information: Process ID: 0x168c Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.5074_none_a5532eb7772ad4c4\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 04:30:30 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$.cdf-ms Handle ID: 0xe70 Process Information: Process ID: 0x168c Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.5074_none_a5532eb7772ad4c4\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 04:30:30 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_syswow64_21ffbdd2a2dd92e0.cdf-ms Handle ID: 0xe70 Process Information: Process ID: 0x168c Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.5074_none_a5532eb7772ad4c4\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 04:30:30 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_syswow64_wbem_1bf25d11bb30b33f.cdf-ms Handle ID: 0xe70 Process Information: Process ID: 0x168c Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.5074_none_a5532eb7772ad4c4\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 04:30:30 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_syswow64_wbem_en-us_04f9ae10d0d40b09.cdf-ms Handle ID: 0xe70 Process Information: Process ID: 0x168c Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.5074_none_a5532eb7772ad4c4\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 04:30:30 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_system32_21f9a9c4a2f8b514.cdf-ms Handle ID: 0x808 Process Information: Process ID: 0x168c Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.5074_none_a5532eb7772ad4c4\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 04:30:30 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_system32_wbem_06656d9fdf2f8577.cdf-ms Handle ID: 0xe68 Process Information: Process ID: 0x168c Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.5074_none_a5532eb7772ad4c4\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 04:30:30 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_system32_wbem_en-us_4555b1beb1c13883.cdf-ms Handle ID: 0xe68 Process Information: Process ID: 0x168c Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.5074_none_a5532eb7772ad4c4\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13824 | 2025-11-29 04:31:15 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x1801ae Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:31:15 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x1801ae Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:31:15 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x1801ae Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:31:15 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x1801ae Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:31:18 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x1801ae Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:31:19 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x1801ae Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:31:19 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x1801ae Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:31:19 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x1801ae Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:31:19 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x1801ae Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:31:19 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x1801ae Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:31:19 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x1801ae Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:31:19 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x1801ae Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:31:19 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x1801ae Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:31:19 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x1801ae Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:31:19 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x1801ae Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:31:19 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x1801ae Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:31:19 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x1801ae Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:31:28 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x1801ae Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:31:28 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x1801ae Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:31:28 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x1801ae Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:31:28 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x1801ae Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:31:28 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x1801ae Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:31:28 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x1801ae Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:31:28 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x1801ae Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:31:28 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x1801ae Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:31:28 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x1801ae Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:31:29 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x1801ae Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:31:29 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x1801ae Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:31:29 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x1801ae Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:31:29 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x1801ae Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 12545 | 2025-11-29 04:31:40 | | Microsoft-Windows-Security-Auditing | 4647: User initiated logoff: Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x1801ae This event is generated when a logoff is initiated. No further user-initiated activity can occur. This event can be interpreted as a logoff event.
|
| | Security | Audit Success | 12544 | 2025-11-29 04:31:41 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: WIN-GH7MCVI2372$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4f8 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12548 | 2025-11-29 04:31:41 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 103 | 2025-11-29 04:31:42 | | Microsoft-Windows-Eventlog | 1100: The event logging service has shut down.
|
| | Security | Audit Success | 13312 | 2025-11-29 04:31:47 | | Microsoft-Windows-Security-Auditing | 4688: A new process has been created. Creator Subject: Security ID: S-1-5-18 Account Name: - Account Domain: - Logon ID: 0x3e7 Target Subject: Security ID: S-1-0-0 Account Name: - Account Domain: - Logon ID: 0x0 Process Information: New Process ID: 0x170 New Process Name: R Token Elevation Type: %%1936 Mandatory Label: S-1-16-16384 Creator Process ID: 0x4 Creator Process Name: Process Command Line: Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
|
| | Security | Audit Success | 13312 | 2025-11-29 04:31:47 | | Microsoft-Windows-Security-Auditing | 4696: A primary token was assigned to process. Subject: Security ID: S-1-5-18 Account Name: - Account Domain: - Logon ID: 0x3e7 Process Information: Process ID: 0x4 Process Name: Target Process: Target Process ID: 0x170 Target Process Name: Registry New Token Information: Security ID: S-1-0-0 Account Name: - Account Domain: - Logon ID: 0x3e7
|
| | Security | Audit Success | 13312 | 2025-11-29 04:31:47 | | Microsoft-Windows-Security-Auditing | 4688: A new process has been created. Creator Subject: Security ID: S-1-5-18 Account Name: - Account Domain: - Logon ID: 0x3e7 Target Subject: Security ID: S-1-0-0 Account Name: - Account Domain: - Logon ID: 0x0 Process Information: New Process ID: 0x368 New Process Name: C Token Elevation Type: %%1936 Mandatory Label: S-1-16-16384 Creator Process ID: 0x4 Creator Process Name: Process Command Line: Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
|
| | Security | Audit Success | 13573 | 2025-11-29 04:31:47 | | Microsoft-Windows-Security-Auditing | 4826: Boot Configuration Data loaded. Subject: Security ID: S-1-5-18 Account Name: - Account Domain: - Logon ID: 0x3e7 General Settings: Load Options: - Advanced Options: %%1843 Configuration Access Policy: %%1846 System Event Logging: %%1843 Kernel Debugging: %%1843 VSM Launch Type: %%1848 Signature Settings: Test Signing: %%1843 Flight Signing: %%1843 Disable Integrity Checks: %%1843 HyperVisor Settings: HyperVisor Load Options: - HyperVisor Launch Type: %%1848 HyperVisor Debugging: %%1843
|
| | Security | Audit Success | 13312 | 2025-11-29 04:31:48 | | Microsoft-Windows-Security-Auditing | 4688: A new process has been created. Creator Subject: Security ID: S-1-5-18 Account Name: - Account Domain: - Logon ID: 0x3e7 Target Subject: Security ID: S-1-0-0 Account Name: - Account Domain: - Logon ID: 0x0 Process Information: New Process ID: 0x378 New Process Name: C Token Elevation Type: %%1936 Mandatory Label: S-1-16-16384 Creator Process ID: 0x368 Creator Process Name: C Process Command Line: Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
|
| | Security | Audit Success | 13312 | 2025-11-29 04:32:00 | | Microsoft-Windows-Security-Auditing | 4688: A new process has been created. Creator Subject: Security ID: S-1-5-18 Account Name: - Account Domain: - Logon ID: 0x3e7 Target Subject: Security ID: S-1-0-0 Account Name: - Account Domain: - Logon ID: 0x0 Process Information: New Process ID: 0x3e0 New Process Name: C Token Elevation Type: %%1936 Mandatory Label: S-1-16-16384 Creator Process ID: 0x368 Creator Process Name: C Process Command Line: Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
|
| | Security | Audit Success | 12288 | 2025-11-29 04:32:02 | | Microsoft-Windows-Security-Auditing | 4608: Windows is starting up. This event is logged when LSASS.EXE starts and the auditing subsystem is initialized.
|
| | Security | Audit Success | 12290 | 2025-11-29 04:32:02 | | Microsoft-Windows-Security-Auditing | 6417: The FIPS mode crypto selftests succeeded. Process ID: 0x4dc Process Name: C:\Windows\System32\lsass.exe
|
| | Security | Audit Success | 12544 | 2025-11-29 04:32:02 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-0-0 Account Name: - Account Domain: - Logon ID: 0x0 Logon Information: Logon Type: 0 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: - New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4 Process Name: Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: - Authentication Package: - Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-29 04:32:02 | | Microsoft-Windows-Security-Auditing | 4648: A logon was attempted using explicit credentials. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon GUID: {00000000-0000-0000-0000-000000000000} Account Whose Credentials Were Used: Account Name: UMFD-0 Account Domain: Font Driver Host Logon GUID: {00000000-0000-0000-0000-000000000000} Target Server: Target Server Name: localhost Additional Information: localhost Process Information: Process ID: 0x438 Process Name: C:\Windows\System32\wininit.exe Network Information: Network Address: - Port: - This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
|
| | Security | Audit Success | 12544 | 2025-11-29 04:32:02 | | Microsoft-Windows-Security-Auditing | 4648: A logon was attempted using explicit credentials. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon GUID: {00000000-0000-0000-0000-000000000000} Account Whose Credentials Were Used: Account Name: UMFD-1 Account Domain: Font Driver Host Logon GUID: {00000000-0000-0000-0000-000000000000} Target Server: Target Server Name: localhost Additional Information: localhost Process Information: Process ID: 0x480 Process Name: C:\Windows\System32\winlogon.exe Network Information: Network Address: - Port: - This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
|
| | Security | Audit Success | 12544 | 2025-11-29 04:32:02 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4c8 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-29 04:32:02 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 2 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1842 Elevated Token: %%1843 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-96-0-0 Account Name: UMFD-0 Account Domain: Font Driver Host Logon ID: 0xd010 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x438 Process Name: C:\Windows\System32\wininit.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-29 04:32:02 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 2 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1842 Elevated Token: %%1843 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-96-0-1 Account Name: UMFD-1 Account Domain: Font Driver Host Logon ID: 0xd011 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x480 Process Name: C:\Windows\System32\winlogon.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-29 04:32:02 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-20 Account Name: NETWORK SERVICE Account Domain: NT AUTHORITY Logon ID: 0x3e4 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4c8 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-29 04:32:02 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4c8 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12548 | 2025-11-29 04:32:02 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-29 04:32:02 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-20 Account Name: NETWORK SERVICE Account Domain: NT AUTHORITY Logon ID: 0x3e4 Privileges: SeAssignPrimaryTokenPrivilege SeAuditPrivilege SeImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-29 04:32:02 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 13312 | 2025-11-29 04:32:02 | | Microsoft-Windows-Security-Auditing | 4688: A new process has been created. Creator Subject: Security ID: S-1-5-18 Account Name: - Account Domain: - Logon ID: 0x3e7 Target Subject: Security ID: S-1-0-0 Account Name: - Account Domain: - Logon ID: 0x0 Process Information: New Process ID: 0x3b8 New Process Name: C Token Elevation Type: %%1936 Mandatory Label: S-1-16-16384 Creator Process ID: 0x3e0 Creator Process Name: C Process Command Line: Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
|
| | Security | Audit Success | 13312 | 2025-11-29 04:32:02 | | Microsoft-Windows-Security-Auditing | 4688: A new process has been created. Creator Subject: Security ID: S-1-5-18 Account Name: - Account Domain: - Logon ID: 0x3e7 Target Subject: Security ID: S-1-0-0 Account Name: - Account Domain: - Logon ID: 0x0 Process Information: New Process ID: 0x430 New Process Name: C Token Elevation Type: %%1936 Mandatory Label: S-1-16-16384 Creator Process ID: 0x368 Creator Process Name: C Process Command Line: Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
|
| | Security | Audit Success | 13312 | 2025-11-29 04:32:02 | | Microsoft-Windows-Security-Auditing | 4688: A new process has been created. Creator Subject: Security ID: S-1-5-18 Account Name: - Account Domain: - Logon ID: 0x3e7 Target Subject: Security ID: S-1-0-0 Account Name: - Account Domain: - Logon ID: 0x0 Process Information: New Process ID: 0x438 New Process Name: C Token Elevation Type: %%1936 Mandatory Label: S-1-16-16384 Creator Process ID: 0x3e0 Creator Process Name: C Process Command Line: Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
|
| | Security | Audit Success | 13312 | 2025-11-29 04:32:02 | | Microsoft-Windows-Security-Auditing | 4688: A new process has been created. Creator Subject: Security ID: S-1-5-18 Account Name: - Account Domain: - Logon ID: 0x3e7 Target Subject: Security ID: S-1-0-0 Account Name: - Account Domain: - Logon ID: 0x0 Process Information: New Process ID: 0x440 New Process Name: C Token Elevation Type: %%1936 Mandatory Label: S-1-16-16384 Creator Process ID: 0x430 Creator Process Name: C Process Command Line: Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
|
| | Security | Audit Success | 13312 | 2025-11-29 04:32:02 | | Microsoft-Windows-Security-Auditing | 4688: A new process has been created. Creator Subject: Security ID: S-1-5-18 Account Name: - Account Domain: - Logon ID: 0x3e7 Target Subject: Security ID: S-1-0-0 Account Name: - Account Domain: - Logon ID: 0x0 Process Information: New Process ID: 0x480 New Process Name: C Token Elevation Type: %%1936 Mandatory Label: S-1-16-16384 Creator Process ID: 0x430 Creator Process Name: C Process Command Line: Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
|
| | Security | Audit Success | 13312 | 2025-11-29 04:32:02 | | Microsoft-Windows-Security-Auditing | 4688: A new process has been created. Creator Subject: Security ID: S-1-5-18 Account Name: - Account Domain: - Logon ID: 0x3e7 Target Subject: Security ID: S-1-0-0 Account Name: - Account Domain: - Logon ID: 0x0 Process Information: New Process ID: 0x4c8 New Process Name: C Token Elevation Type: %%1936 Mandatory Label: S-1-16-16384 Creator Process ID: 0x438 Creator Process Name: C Process Command Line: Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
|
| | Security | Audit Success | 13312 | 2025-11-29 04:32:02 | | Microsoft-Windows-Security-Auditing | 4688: A new process has been created. Creator Subject: Security ID: S-1-5-18 Account Name: - Account Domain: - Logon ID: 0x3e7 Target Subject: Security ID: S-1-0-0 Account Name: - Account Domain: - Logon ID: 0x0 Process Information: New Process ID: 0x4dc New Process Name: C Token Elevation Type: %%1936 Mandatory Label: S-1-16-16384 Creator Process ID: 0x438 Creator Process Name: C Process Command Line: Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
|
| | Security | Audit Success | 13568 | 2025-11-29 04:32:02 | | Microsoft-Windows-Security-Auditing | 4902: The Per-user audit policy table was created. Number of Elements: 0 Policy ID: 0xcbe6
|
| | Security | Audit Success | 12290 | 2025-11-29 04:32:03 | | Microsoft-Windows-Security-Auditing | 5061: Cryptographic operation. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Cryptographic Parameters: Provider Name: Microsoft Software Key Storage Provider Algorithm Name: RSA Key Name: f8df15d9-56fa-0cb3-682b-838ed74af121 Key Type: %%2500 Cryptographic Operation: Operation: %%2480 Return Code: 0x0
|
| | Security | Audit Success | 12290 | 2025-11-29 04:32:03 | | Microsoft-Windows-Security-Auditing | 5061: Cryptographic operation. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Cryptographic Parameters: Provider Name: Microsoft Software Key Storage Provider Algorithm Name: RSA Key Name: f8df15d9-56fa-0cb3-682b-838ed74af121 Key Type: %%2500 Cryptographic Operation: Operation: %%2480 Return Code: 0x0
|
| | Security | Audit Success | 12292 | 2025-11-29 04:32:03 | | Microsoft-Windows-Security-Auditing | 5058: Key file operation. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Process Information: Process ID: 1740 Process Creation Time: 2025-11-29T12:32:03.1634457Z Cryptographic Parameters: Provider Name: Microsoft Software Key Storage Provider Algorithm Name: UNKNOWN Key Name: f8df15d9-56fa-0cb3-682b-838ed74af121 Key Type: %%2500 Key File Operation Information: File Path: C:\ProgramData\Microsoft\Crypto\SystemKeys\8bb43a3e92c2eb4c420c9abd6e278936_9ee7012e-fa60-42be-b8b4-8dc8b4e1280d Operation: %%2458 Return Code: 0x0
|
| | Security | Audit Success | 12292 | 2025-11-29 04:32:03 | | Microsoft-Windows-Security-Auditing | 5058: Key file operation. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Process Information: Process ID: 1740 Process Creation Time: 2025-11-29T12:32:03.1634457Z Cryptographic Parameters: Provider Name: Microsoft Software Key Storage Provider Algorithm Name: UNKNOWN Key Name: f8df15d9-56fa-0cb3-682b-838ed74af121 Key Type: %%2500 Key File Operation Information: File Path: C:\ProgramData\Microsoft\Crypto\SystemKeys\8bb43a3e92c2eb4c420c9abd6e278936_9ee7012e-fa60-42be-b8b4-8dc8b4e1280d Operation: %%2458 Return Code: 0x0
|
| | Security | Audit Success | 12292 | 2025-11-29 04:32:03 | | Microsoft-Windows-Security-Auditing | 5059: Key migration operation. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Process Information: Process ID: 1740 Process Creation Time: 2025-11-29T12:32:03.1634457Z Cryptographic Parameters: Provider Name: Microsoft Software Key Storage Provider Algorithm Name: RSA Key Name: f8df15d9-56fa-0cb3-682b-838ed74af121 Key Type: %%2500 Additional Information: Operation: %%2464 Return Code: 0x0
|
| | Security | Audit Success | 12292 | 2025-11-29 04:32:03 | | Microsoft-Windows-Security-Auditing | 5033: The Windows Firewall Driver started successfully.
|
| | Security | Audit Success | 12544 | 2025-11-29 04:32:03 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4c8 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-29 04:32:03 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4c8 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-29 04:32:03 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4c8 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-29 04:32:03 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4c8 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-29 04:32:03 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4c8 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-29 04:32:03 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4c8 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-29 04:32:03 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-19 Account Name: LOCAL SERVICE Account Domain: NT AUTHORITY Logon ID: 0x3e5 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4c8 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-29 04:32:03 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4c8 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-29 04:32:03 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4c8 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-29 04:32:03 | | Microsoft-Windows-Security-Auditing | 4648: A logon was attempted using explicit credentials. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon GUID: {00000000-0000-0000-0000-000000000000} Account Whose Credentials Were Used: Account Name: DWM-1 Account Domain: Window Manager Logon GUID: {00000000-0000-0000-0000-000000000000} Target Server: Target Server Name: localhost Additional Information: localhost Process Information: Process ID: 0x480 Process Name: C:\Windows\System32\winlogon.exe Network Information: Network Address: - Port: - This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
|
| | Security | Audit Success | 12544 | 2025-11-29 04:32:03 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 2 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1842 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-90-0-1 Account Name: DWM-1 Account Domain: Window Manager Logon ID: 0x16ee1 Linked Logon ID: 0x16f4a Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x480 Process Name: C:\Windows\System32\winlogon.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-29 04:32:03 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 2 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1842 Elevated Token: %%1843 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-90-0-1 Account Name: DWM-1 Account Domain: Window Manager Logon ID: 0x16f4a Linked Logon ID: 0x16ee1 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x480 Process Name: C:\Windows\System32\winlogon.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-29 04:32:03 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4c8 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-29 04:32:03 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4c8 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-29 04:32:03 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4c8 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-29 04:32:03 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4c8 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-29 04:32:03 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4c8 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-29 04:32:03 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4c8 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-29 04:32:03 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4c8 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-29 04:32:03 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4c8 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-29 04:32:03 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4c8 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-29 04:32:03 | | Microsoft-Windows-Security-Auditing | 4648: A logon was attempted using explicit credentials. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon GUID: {00000000-0000-0000-0000-000000000000} Account Whose Credentials Were Used: Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon GUID: {00000000-0000-0000-0000-000000000000} Target Server: Target Server Name: localhost Additional Information: localhost Process Information: Process ID: 0xa3c Process Name: C:\Windows\System32\svchost.exe Network Information: Network Address: 127.0.0.1 Port: 0 This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
|
| | Security | Audit Success | 12544 | 2025-11-29 04:32:03 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 2 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x1c99e Linked Logon ID: 0x1cbe5 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0xa3c Process Name: C:\Windows\System32\svchost.exe Network Information: Workstation Name: DESKTOP-0JV7HJV Source Network Address: 127.0.0.1 Source Port: 0 Detailed Authentication Information: Logon Process: User32 Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-29 04:32:03 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 2 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1843 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x1cbe5 Linked Logon ID: 0x1c99e Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0xa3c Process Name: C:\Windows\System32\svchost.exe Network Information: Workstation Name: DESKTOP-0JV7HJV Source Network Address: 127.0.0.1 Source Port: 0 Detailed Authentication Information: Logon Process: User32 Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-29 04:32:03 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4c8 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-29 04:32:03 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4c8 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-29 04:32:03 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4c8 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-29 04:32:03 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4c8 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-29 04:32:03 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4c8 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-29 04:32:03 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4c8 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-29 04:32:03 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4c8 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-29 04:32:03 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4c8 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-29 04:32:03 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4c8 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-29 04:32:03 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4c8 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12548 | 2025-11-29 04:32:03 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-29 04:32:03 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-29 04:32:03 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-29 04:32:03 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-29 04:32:03 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-29 04:32:03 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-29 04:32:03 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-19 Account Name: LOCAL SERVICE Account Domain: NT AUTHORITY Logon ID: 0x3e5 Privileges: SeAssignPrimaryTokenPrivilege SeAuditPrivilege SeImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-29 04:32:03 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-29 04:32:03 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-29 04:32:03 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-90-0-1 Account Name: DWM-1 Account Domain: Window Manager Logon ID: 0x16ee1 Privileges: SeAssignPrimaryTokenPrivilege SeAuditPrivilege SeImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-29 04:32:03 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-90-0-1 Account Name: DWM-1 Account Domain: Window Manager Logon ID: 0x16f4a Privileges: SeAssignPrimaryTokenPrivilege SeAuditPrivilege
|
| | Security | Audit Success | 12548 | 2025-11-29 04:32:03 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-29 04:32:03 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-29 04:32:03 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-29 04:32:03 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-29 04:32:03 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-29 04:32:03 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-29 04:32:03 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-29 04:32:03 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-29 04:32:03 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-29 04:32:03 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x1c99e Privileges: SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-29 04:32:03 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-29 04:32:03 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-29 04:32:03 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-29 04:32:03 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-29 04:32:03 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-29 04:32:03 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-29 04:32:03 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-29 04:32:03 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-29 04:32:03 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-29 04:32:03 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 13824 | 2025-11-29 04:32:03 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:32:03 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:32:03 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:32:03 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:32:03 | | Microsoft-Windows-Security-Auditing | 4798: A user's local group membership was enumerated. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 User: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Process Information: Process ID: 0x4dc Process Name: C:\Windows\System32\lsass.exe
|
| | Security | Audit Success | 13826 | 2025-11-29 04:32:03 | | Microsoft-Windows-Security-Auditing | 4799: A security-enabled local group membership was enumerated. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Group: Security ID: S-1-5-32-544 Group Name: Administrators Group Domain: Builtin Process Information: Process ID: 0xc88 Process Name: C:\Windows\System32\svchost.exe
|
| | Security | Audit Success | 13826 | 2025-11-29 04:32:03 | | Microsoft-Windows-Security-Auditing | 4799: A security-enabled local group membership was enumerated. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Group: Security ID: S-1-5-32-551 Group Name: Backup Operators Group Domain: Builtin Process Information: Process ID: 0xc88 Process Name: C:\Windows\System32\svchost.exe
|
| | Security | Audit Success | 13826 | 2025-11-29 04:32:03 | | Microsoft-Windows-Security-Auditing | 4799: A security-enabled local group membership was enumerated. Subject: Security ID: S-1-5-20 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e4 Group: Security ID: S-1-5-32-544 Group Name: Administrators Group Domain: Builtin Process Information: Process ID: 0x6c4 Process Name: C:\Windows\System32\svchost.exe
|
| | Security | Audit Success | 13826 | 2025-11-29 04:32:03 | | Microsoft-Windows-Security-Auditing | 4799: A security-enabled local group membership was enumerated. Subject: Security ID: S-1-5-20 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e4 Group: Security ID: S-1-5-32-551 Group Name: Backup Operators Group Domain: Builtin Process Information: Process ID: 0x6c4 Process Name: C:\Windows\System32\svchost.exe
|
| | Security | Audit Success | 12290 | 2025-11-29 04:32:04 | | Microsoft-Windows-Security-Auditing | 5061: Cryptographic operation. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Cryptographic Parameters: Provider Name: Microsoft Software Key Storage Provider Algorithm Name: RSA Key Name: f8df15d9-56fa-0cb3-682b-838ed74af121 Key Type: %%2500 Cryptographic Operation: Operation: %%2480 Return Code: 0x0
|
| | Security | Audit Success | 12290 | 2025-11-29 04:32:04 | | Microsoft-Windows-Security-Auditing | 5061: Cryptographic operation. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Cryptographic Parameters: Provider Name: Microsoft Software Key Storage Provider Algorithm Name: RSA Key Name: f8df15d9-56fa-0cb3-682b-838ed74af121 Key Type: %%2500 Cryptographic Operation: Operation: %%2480 Return Code: 0x0
|
| | Security | Audit Success | 12290 | 2025-11-29 04:32:04 | | Microsoft-Windows-Security-Auditing | 5061: Cryptographic operation. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x1cbe5 Cryptographic Parameters: Provider Name: Microsoft Software Key Storage Provider Algorithm Name: ECDSA_P256 Key Name: Microsoft Connected Devices Platform device certificate Key Type: %%2500 Cryptographic Operation: Operation: %%2480 Return Code: 0x0
|
| | Security | Audit Success | 12290 | 2025-11-29 04:32:04 | | Microsoft-Windows-Security-Auditing | 5061: Cryptographic operation. Subject: Security ID: S-1-5-19 Account Name: LOCAL SERVICE Account Domain: NT AUTHORITY Logon ID: 0x3e5 Cryptographic Parameters: Provider Name: Microsoft Software Key Storage Provider Algorithm Name: ECDSA_P256 Key Name: Microsoft Connected Devices Platform device certificate Key Type: %%2500 Cryptographic Operation: Operation: %%2480 Return Code: 0x0
|
| | Security | Audit Success | 12292 | 2025-11-29 04:32:04 | | Microsoft-Windows-Security-Auditing | 5058: Key file operation. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Process Information: Process ID: 1740 Process Creation Time: 2025-11-29T12:32:03.1634457Z Cryptographic Parameters: Provider Name: Microsoft Software Key Storage Provider Algorithm Name: UNKNOWN Key Name: f8df15d9-56fa-0cb3-682b-838ed74af121 Key Type: %%2500 Key File Operation Information: File Path: C:\ProgramData\Microsoft\Crypto\SystemKeys\8bb43a3e92c2eb4c420c9abd6e278936_9ee7012e-fa60-42be-b8b4-8dc8b4e1280d Operation: %%2458 Return Code: 0x0
|
| | Security | Audit Success | 12292 | 2025-11-29 04:32:04 | | Microsoft-Windows-Security-Auditing | 5058: Key file operation. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Process Information: Process ID: 1740 Process Creation Time: 2025-11-29T12:32:03.1634457Z Cryptographic Parameters: Provider Name: Microsoft Software Key Storage Provider Algorithm Name: UNKNOWN Key Name: f8df15d9-56fa-0cb3-682b-838ed74af121 Key Type: %%2500 Key File Operation Information: File Path: C:\ProgramData\Microsoft\Crypto\SystemKeys\8bb43a3e92c2eb4c420c9abd6e278936_9ee7012e-fa60-42be-b8b4-8dc8b4e1280d Operation: %%2458 Return Code: 0x0
|
| | Security | Audit Success | 12292 | 2025-11-29 04:32:04 | | Microsoft-Windows-Security-Auditing | 5059: Key migration operation. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Process Information: Process ID: 1740 Process Creation Time: 2025-11-29T12:32:03.1634457Z Cryptographic Parameters: Provider Name: Microsoft Software Key Storage Provider Algorithm Name: RSA Key Name: f8df15d9-56fa-0cb3-682b-838ed74af121 Key Type: %%2500 Additional Information: Operation: %%2464 Return Code: 0x0
|
| | Security | Audit Success | 12292 | 2025-11-29 04:32:04 | | Microsoft-Windows-Security-Auditing | 5058: Key file operation. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x1cbe5 Process Information: Process ID: 4824 Process Creation Time: 2025-11-29T12:32:04.4017100Z Cryptographic Parameters: Provider Name: Microsoft Software Key Storage Provider Algorithm Name: UNKNOWN Key Name: Microsoft Connected Devices Platform device certificate Key Type: %%2500 Key File Operation Information: File Path: C:\Users\CogiArt\AppData\Roaming\Microsoft\Crypto\Keys\de7cf8a7901d2ad13e5c67c29e5d1662_9ee7012e-fa60-42be-b8b4-8dc8b4e1280d Operation: %%2458 Return Code: 0x0
|
| | Security | Audit Success | 12292 | 2025-11-29 04:32:04 | | Microsoft-Windows-Security-Auditing | 5059: Key migration operation. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x1cbe5 Process Information: Process ID: 4824 Process Creation Time: 2025-11-29T12:32:04.4017100Z Cryptographic Parameters: Provider Name: Microsoft Software Key Storage Provider Algorithm Name: ECDSA_P256 Key Name: Microsoft Connected Devices Platform device certificate Key Type: %%2500 Additional Information: Operation: %%2464 Return Code: 0x0
|
| | Security | Audit Success | 12292 | 2025-11-29 04:32:04 | | Microsoft-Windows-Security-Auditing | 5058: Key file operation. Subject: Security ID: S-1-5-19 Account Name: LOCAL SERVICE Account Domain: NT AUTHORITY Logon ID: 0x3e5 Process Information: Process ID: 5164 Process Creation Time: 2025-11-29T12:32:04.6217785Z Cryptographic Parameters: Provider Name: Microsoft Software Key Storage Provider Algorithm Name: UNKNOWN Key Name: Microsoft Connected Devices Platform device certificate Key Type: %%2500 Key File Operation Information: File Path: C:\WINDOWS\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Crypto\Keys\de7cf8a7901d2ad13e5c67c29e5d1662_9ee7012e-fa60-42be-b8b4-8dc8b4e1280d Operation: %%2458 Return Code: 0x0
|
| | Security | Audit Success | 12292 | 2025-11-29 04:32:04 | | Microsoft-Windows-Security-Auditing | 5059: Key migration operation. Subject: Security ID: S-1-5-19 Account Name: LOCAL SERVICE Account Domain: NT AUTHORITY Logon ID: 0x3e5 Process Information: Process ID: 5164 Process Creation Time: 2025-11-29T12:32:04.6217785Z Cryptographic Parameters: Provider Name: Microsoft Software Key Storage Provider Algorithm Name: ECDSA_P256 Key Name: Microsoft Connected Devices Platform device certificate Key Type: %%2500 Additional Information: Operation: %%2464 Return Code: 0x0
|
| | Security | Audit Success | 12544 | 2025-11-29 04:32:04 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4c8 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12548 | 2025-11-29 04:32:04 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 13824 | 2025-11-29 04:32:04 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:32:04 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:32:04 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:32:04 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:32:04 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x1cbe5 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:32:04 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x1cbe5 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:32:04 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x1cbe5 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:32:04 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x1cbe5 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:32:04 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x1cbe5 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:32:04 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x1cbe5 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:32:04 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x1cbe5 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:32:04 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x1cbe5 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13826 | 2025-11-29 04:32:04 | | Microsoft-Windows-Security-Auditing | 4799: A security-enabled local group membership was enumerated. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Group: Security ID: S-1-5-32-544 Group Name: Administrators Group Domain: Builtin Process Information: Process ID: 0x938 Process Name: C:\Windows\System32\svchost.exe
|
| | Security | Audit Success | 12292 | 2025-11-29 04:32:05 | | Microsoft-Windows-Security-Auditing | 5024: The Windows Firewall service started successfully.
|
| | Security | Audit Success | 12544 | 2025-11-29 04:32:05 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4c8 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-29 04:32:05 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4c8 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12548 | 2025-11-29 04:32:05 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-29 04:32:05 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12544 | 2025-11-29 04:32:06 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4c8 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-29 04:32:06 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4c8 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12548 | 2025-11-29 04:32:06 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-29 04:32:06 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 13824 | 2025-11-29 04:32:06 | | Microsoft-Windows-Security-Auditing | 4798: A user's local group membership was enumerated. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 User: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Process Information: Process ID: 0x874 Process Name: C:\Windows\System32\LogonUI.exe
|
| | Security | Audit Success | 12290 | 2025-11-29 04:32:07 | | Microsoft-Windows-Security-Auditing | 5061: Cryptographic operation. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Cryptographic Parameters: Provider Name: Microsoft Software Key Storage Provider Algorithm Name: RSA Key Name: f8df15d9-56fa-0cb3-682b-838ed74af121 Key Type: %%2500 Cryptographic Operation: Operation: %%2480 Return Code: 0x0
|
| | Security | Audit Success | 12290 | 2025-11-29 04:32:07 | | Microsoft-Windows-Security-Auditing | 5061: Cryptographic operation. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Cryptographic Parameters: Provider Name: Microsoft Software Key Storage Provider Algorithm Name: RSA Key Name: f8df15d9-56fa-0cb3-682b-838ed74af121 Key Type: %%2500 Cryptographic Operation: Operation: %%2480 Return Code: 0x0
|
| | Security | Audit Success | 12292 | 2025-11-29 04:32:07 | | Microsoft-Windows-Security-Auditing | 5058: Key file operation. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Process Information: Process ID: 1740 Process Creation Time: 2025-11-29T12:32:03.1634457Z Cryptographic Parameters: Provider Name: Microsoft Software Key Storage Provider Algorithm Name: UNKNOWN Key Name: f8df15d9-56fa-0cb3-682b-838ed74af121 Key Type: %%2500 Key File Operation Information: File Path: C:\ProgramData\Microsoft\Crypto\SystemKeys\8bb43a3e92c2eb4c420c9abd6e278936_9ee7012e-fa60-42be-b8b4-8dc8b4e1280d Operation: %%2458 Return Code: 0x0
|
| | Security | Audit Success | 12292 | 2025-11-29 04:32:07 | | Microsoft-Windows-Security-Auditing | 5058: Key file operation. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Process Information: Process ID: 1740 Process Creation Time: 2025-11-29T12:32:03.1634457Z Cryptographic Parameters: Provider Name: Microsoft Software Key Storage Provider Algorithm Name: UNKNOWN Key Name: f8df15d9-56fa-0cb3-682b-838ed74af121 Key Type: %%2500 Key File Operation Information: File Path: C:\ProgramData\Microsoft\Crypto\SystemKeys\8bb43a3e92c2eb4c420c9abd6e278936_9ee7012e-fa60-42be-b8b4-8dc8b4e1280d Operation: %%2458 Return Code: 0x0
|
| | Security | Audit Success | 12292 | 2025-11-29 04:32:07 | | Microsoft-Windows-Security-Auditing | 5059: Key migration operation. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Process Information: Process ID: 1740 Process Creation Time: 2025-11-29T12:32:03.1634457Z Cryptographic Parameters: Provider Name: Microsoft Software Key Storage Provider Algorithm Name: RSA Key Name: f8df15d9-56fa-0cb3-682b-838ed74af121 Key Type: %%2500 Additional Information: Operation: %%2464 Return Code: 0x0
|
| | Security | Audit Success | 12544 | 2025-11-29 04:32:07 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4c8 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-29 04:32:07 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4c8 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-29 04:32:07 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4c8 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12548 | 2025-11-29 04:32:07 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-29 04:32:07 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-29 04:32:07 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 13824 | 2025-11-29 04:32:07 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:32:07 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:32:07 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:32:07 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:32:07 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-19 Account Name: LOCAL SERVICE Account Domain: NT AUTHORITY Logon ID: 0x3e5 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:32:07 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-19 Account Name: LOCAL SERVICE Account Domain: NT AUTHORITY Logon ID: 0x3e5 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:32:07 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-19 Account Name: LOCAL SERVICE Account Domain: NT AUTHORITY Logon ID: 0x3e5 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:32:07 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-19 Account Name: LOCAL SERVICE Account Domain: NT AUTHORITY Logon ID: 0x3e5 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:32:07 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x1cbe5 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:32:07 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x1cbe5 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:32:07 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x1cbe5 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:32:07 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x1cbe5 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:32:07 | | Microsoft-Windows-Security-Auditing | 5382: Vault credentials were read. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 This event occurs when a user reads a stored vault credential.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:32:08 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x1cbe5 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:32:08 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x1cbe5 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:32:08 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x1cbe5 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:32:08 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x1cbe5 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:32:08 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-19 Account Name: LOCAL SERVICE Account Domain: NT AUTHORITY Logon ID: 0x3e5 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:32:08 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-19 Account Name: LOCAL SERVICE Account Domain: NT AUTHORITY Logon ID: 0x3e5 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:32:08 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-19 Account Name: LOCAL SERVICE Account Domain: NT AUTHORITY Logon ID: 0x3e5 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:32:08 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-19 Account Name: LOCAL SERVICE Account Domain: NT AUTHORITY Logon ID: 0x3e5 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:32:08 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x1cbe5 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:32:08 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x1cbe5 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:32:08 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x1cbe5 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:32:08 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x1cbe5 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:32:08 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-19 Account Name: LOCAL SERVICE Account Domain: NT AUTHORITY Logon ID: 0x3e5 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:32:08 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-19 Account Name: LOCAL SERVICE Account Domain: NT AUTHORITY Logon ID: 0x3e5 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:32:08 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-19 Account Name: LOCAL SERVICE Account Domain: NT AUTHORITY Logon ID: 0x3e5 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:32:08 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-19 Account Name: LOCAL SERVICE Account Domain: NT AUTHORITY Logon ID: 0x3e5 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:32:08 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x1cbe5 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:32:08 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x1cbe5 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:32:08 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x1cbe5 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:32:08 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x1cbe5 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:32:08 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-19 Account Name: LOCAL SERVICE Account Domain: NT AUTHORITY Logon ID: 0x3e5 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:32:08 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-19 Account Name: LOCAL SERVICE Account Domain: NT AUTHORITY Logon ID: 0x3e5 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:32:08 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-19 Account Name: LOCAL SERVICE Account Domain: NT AUTHORITY Logon ID: 0x3e5 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:32:08 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-19 Account Name: LOCAL SERVICE Account Domain: NT AUTHORITY Logon ID: 0x3e5 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:32:08 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x1cbe5 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:32:08 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x1cbe5 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:32:08 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x1cbe5 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:32:08 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x1cbe5 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:32:08 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-19 Account Name: LOCAL SERVICE Account Domain: NT AUTHORITY Logon ID: 0x3e5 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:32:08 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-19 Account Name: LOCAL SERVICE Account Domain: NT AUTHORITY Logon ID: 0x3e5 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:32:08 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-19 Account Name: LOCAL SERVICE Account Domain: NT AUTHORITY Logon ID: 0x3e5 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:32:08 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-19 Account Name: LOCAL SERVICE Account Domain: NT AUTHORITY Logon ID: 0x3e5 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:32:08 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x1cbe5 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:32:08 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x1cbe5 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:32:08 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x1cbe5 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:32:08 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x1cbe5 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 12290 | 2025-11-29 04:32:09 | | Microsoft-Windows-Security-Auditing | 5061: Cryptographic operation. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Cryptographic Parameters: Provider Name: Microsoft Software Key Storage Provider Algorithm Name: RSA Key Name: f8df15d9-56fa-0cb3-682b-838ed74af121 Key Type: %%2500 Cryptographic Operation: Operation: %%2480 Return Code: 0x0
|
| | Security | Audit Success | 12290 | 2025-11-29 04:32:09 | | Microsoft-Windows-Security-Auditing | 5061: Cryptographic operation. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Cryptographic Parameters: Provider Name: Microsoft Software Key Storage Provider Algorithm Name: RSA Key Name: f8df15d9-56fa-0cb3-682b-838ed74af121 Key Type: %%2500 Cryptographic Operation: Operation: %%2480 Return Code: 0x0
|
| | Security | Audit Success | 12292 | 2025-11-29 04:32:09 | | Microsoft-Windows-Security-Auditing | 5058: Key file operation. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Process Information: Process ID: 1740 Process Creation Time: 2025-11-29T12:32:03.1634457Z Cryptographic Parameters: Provider Name: Microsoft Software Key Storage Provider Algorithm Name: UNKNOWN Key Name: f8df15d9-56fa-0cb3-682b-838ed74af121 Key Type: %%2500 Key File Operation Information: File Path: C:\ProgramData\Microsoft\Crypto\SystemKeys\8bb43a3e92c2eb4c420c9abd6e278936_9ee7012e-fa60-42be-b8b4-8dc8b4e1280d Operation: %%2458 Return Code: 0x0
|
| | Security | Audit Success | 12292 | 2025-11-29 04:32:09 | | Microsoft-Windows-Security-Auditing | 5058: Key file operation. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Process Information: Process ID: 1740 Process Creation Time: 2025-11-29T12:32:03.1634457Z Cryptographic Parameters: Provider Name: Microsoft Software Key Storage Provider Algorithm Name: UNKNOWN Key Name: f8df15d9-56fa-0cb3-682b-838ed74af121 Key Type: %%2500 Key File Operation Information: File Path: C:\ProgramData\Microsoft\Crypto\SystemKeys\8bb43a3e92c2eb4c420c9abd6e278936_9ee7012e-fa60-42be-b8b4-8dc8b4e1280d Operation: %%2458 Return Code: 0x0
|
| | Security | Audit Success | 12292 | 2025-11-29 04:32:09 | | Microsoft-Windows-Security-Auditing | 5059: Key migration operation. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Process Information: Process ID: 1740 Process Creation Time: 2025-11-29T12:32:03.1634457Z Cryptographic Parameters: Provider Name: Microsoft Software Key Storage Provider Algorithm Name: RSA Key Name: f8df15d9-56fa-0cb3-682b-838ed74af121 Key Type: %%2500 Additional Information: Operation: %%2464 Return Code: 0x0
|
| | Security | Audit Success | 12544 | 2025-11-29 04:32:09 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4c8 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-29 04:32:09 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4c8 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12548 | 2025-11-29 04:32:09 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-29 04:32:09 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 13824 | 2025-11-29 04:32:09 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x1cbe5 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:32:09 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x1cbe5 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:32:09 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x1cbe5 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:32:09 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x1cbe5 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:32:09 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:32:09 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:32:09 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:32:09 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:32:11 | | Microsoft-Windows-Security-Auditing | 4726: A user account was deleted. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x1c99e Target Account: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1000 Account Name: defaultuser0 Account Domain: DESKTOP-0JV7HJV Additional Information: Privileges -
|
| | Security | Audit Success | 13826 | 2025-11-29 04:32:11 | | Microsoft-Windows-Security-Auditing | 4733: A member was removed from a security-enabled local group. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x1c99e Member: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1000 Account Name: - Group: Security ID: S-1-5-32-545 Group Name: Users Group Domain: Builtin Additional Information: Privileges: -
|
| | Security | Audit Success | 13826 | 2025-11-29 04:32:11 | | Microsoft-Windows-Security-Auditing | 4729: A member was removed from a security-enabled global group. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x1c99e Member: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1000 Account Name: - Group: Security ID: S-1-5-21-2954332259-1466799094-2054226798-513 Group Name: None Group Domain: DESKTOP-0JV7HJV Additional Information: Privileges: -
|
| | Security | Audit Success | 13824 | 2025-11-29 04:32:13 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-19 Account Name: LOCAL SERVICE Account Domain: NT AUTHORITY Logon ID: 0x3e5 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:32:13 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-19 Account Name: LOCAL SERVICE Account Domain: NT AUTHORITY Logon ID: 0x3e5 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:32:13 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-19 Account Name: LOCAL SERVICE Account Domain: NT AUTHORITY Logon ID: 0x3e5 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:32:13 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-19 Account Name: LOCAL SERVICE Account Domain: NT AUTHORITY Logon ID: 0x3e5 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:32:13 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x1cbe5 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:32:13 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x1cbe5 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:32:13 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x1cbe5 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:32:13 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x1cbe5 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:32:13 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-19 Account Name: LOCAL SERVICE Account Domain: NT AUTHORITY Logon ID: 0x3e5 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:32:13 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-19 Account Name: LOCAL SERVICE Account Domain: NT AUTHORITY Logon ID: 0x3e5 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:32:13 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-19 Account Name: LOCAL SERVICE Account Domain: NT AUTHORITY Logon ID: 0x3e5 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:32:13 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-19 Account Name: LOCAL SERVICE Account Domain: NT AUTHORITY Logon ID: 0x3e5 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:32:13 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x1cbe5 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:32:13 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x1cbe5 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:32:13 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x1cbe5 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:32:13 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x1cbe5 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:32:13 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-19 Account Name: LOCAL SERVICE Account Domain: NT AUTHORITY Logon ID: 0x3e5 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:32:13 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-19 Account Name: LOCAL SERVICE Account Domain: NT AUTHORITY Logon ID: 0x3e5 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:32:13 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-19 Account Name: LOCAL SERVICE Account Domain: NT AUTHORITY Logon ID: 0x3e5 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:32:13 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-19 Account Name: LOCAL SERVICE Account Domain: NT AUTHORITY Logon ID: 0x3e5 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:32:13 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x1cbe5 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:32:13 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x1cbe5 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:32:13 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x1cbe5 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:32:13 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x1cbe5 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:32:13 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-19 Account Name: LOCAL SERVICE Account Domain: NT AUTHORITY Logon ID: 0x3e5 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:32:13 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-19 Account Name: LOCAL SERVICE Account Domain: NT AUTHORITY Logon ID: 0x3e5 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:32:13 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-19 Account Name: LOCAL SERVICE Account Domain: NT AUTHORITY Logon ID: 0x3e5 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:32:13 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-19 Account Name: LOCAL SERVICE Account Domain: NT AUTHORITY Logon ID: 0x3e5 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:32:13 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x1cbe5 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:32:13 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x1cbe5 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:32:13 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x1cbe5 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:32:13 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x1cbe5 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 12544 | 2025-11-29 04:32:14 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4c8 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-29 04:32:14 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4c8 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12548 | 2025-11-29 04:32:14 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-29 04:32:14 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 13824 | 2025-11-29 04:32:14 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x1cbe5 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:32:14 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x1cbe5 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:32:14 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x1cbe5 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:32:14 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x1cbe5 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13826 | 2025-11-29 04:32:14 | | Microsoft-Windows-Security-Auditing | 4799: A security-enabled local group membership was enumerated. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x1c99e Group: Security ID: S-1-5-32-544 Group Name: Administrators Group Domain: Builtin Process Information: Process ID: 0x938 Process Name: C:\Windows\System32\svchost.exe
|
| | Security | Audit Success | 13826 | 2025-11-29 04:32:14 | | Microsoft-Windows-Security-Auditing | 4799: A security-enabled local group membership was enumerated. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Group: Security ID: S-1-5-32-544 Group Name: Administrators Group Domain: Builtin Process Information: Process ID: 0x244c Process Name: C:\Windows\System32\SearchIndexer.exe
|
| | Security | Audit Success | 13826 | 2025-11-29 04:32:14 | | Microsoft-Windows-Security-Auditing | 4799: A security-enabled local group membership was enumerated. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Group: Security ID: S-1-5-32-551 Group Name: Backup Operators Group Domain: Builtin Process Information: Process ID: 0x244c Process Name: C:\Windows\System32\SearchIndexer.exe
|
| | Security | Audit Success | 12544 | 2025-11-29 04:32:16 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4c8 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12548 | 2025-11-29 04:32:16 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 13824 | 2025-11-29 04:32:16 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x1cbe5 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:32:16 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x1cbe5 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:32:16 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x1cbe5 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:32:16 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x1cbe5 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:32:16 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x1cbe5 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:32:16 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x1cbe5 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:32:16 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x1cbe5 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:32:16 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x1cbe5 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:32:16 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x1cbe5 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:32:16 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x1cbe5 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:32:16 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x1cbe5 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:32:16 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x1cbe5 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:32:17 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x1cbe5 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:32:17 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x1cbe5 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:32:17 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x1cbe5 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:32:17 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x1cbe5 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:32:17 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x1cbe5 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:32:17 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x1cbe5 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:32:17 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x1cbe5 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:32:17 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x1cbe5 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:32:17 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x1cbe5 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:32:17 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x1cbe5 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:32:17 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x1cbe5 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:32:17 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x1cbe5 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:32:17 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x1cbe5 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:32:17 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x1cbe5 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:32:17 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x1cbe5 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:32:17 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x1cbe5 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:32:17 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x1cbe5 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:32:17 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x1cbe5 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:32:17 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x1cbe5 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:32:17 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x1cbe5 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:32:18 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x1cbe5 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:32:18 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x1cbe5 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:32:18 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x1cbe5 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:32:18 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x1cbe5 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 12544 | 2025-11-29 04:32:19 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4c8 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12548 | 2025-11-29 04:32:19 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12544 | 2025-11-29 04:32:20 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4c8 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12548 | 2025-11-29 04:32:20 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 13824 | 2025-11-29 04:32:20 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x1cbe5 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:32:20 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x1cbe5 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:32:20 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x1cbe5 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:32:20 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x1cbe5 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:32:20 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x1cbe5 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:32:20 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x1cbe5 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:32:20 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x1cbe5 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:32:20 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x1cbe5 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:32:20 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x1cbe5 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:32:20 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x1cbe5 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:32:20 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x1cbe5 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:32:20 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x1cbe5 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:32:20 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x1cbe5 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 12544 | 2025-11-29 04:32:21 | | Microsoft-Windows-Security-Auditing | 4648: A logon was attempted using explicit credentials. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon GUID: {00000000-0000-0000-0000-000000000000} Account Whose Credentials Were Used: Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon GUID: {00000000-0000-0000-0000-000000000000} Target Server: Target Server Name: localhost Additional Information: localhost Process Information: Process ID: 0xa3c Process Name: C:\Windows\System32\svchost.exe Network Information: Network Address: 127.0.0.1 Port: 0 This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
|
| | Security | Audit Success | 12544 | 2025-11-29 04:32:21 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 2 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0xe2a6e Linked Logon ID: 0xe2a9b Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0xa3c Process Name: C:\Windows\System32\svchost.exe Network Information: Workstation Name: DESKTOP-0JV7HJV Source Network Address: 127.0.0.1 Source Port: 0 Detailed Authentication Information: Logon Process: User32 Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-29 04:32:21 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 2 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1843 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0xe2a9b Linked Logon ID: 0xe2a6e Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0xa3c Process Name: C:\Windows\System32\svchost.exe Network Information: Workstation Name: DESKTOP-0JV7HJV Source Network Address: 127.0.0.1 Source Port: 0 Detailed Authentication Information: Logon Process: User32 Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-29 04:32:21 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4c8 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12545 | 2025-11-29 04:32:21 | | Microsoft-Windows-Security-Auditing | 4634: An account was logged off. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0xe2a9b Logon Type: 2 This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
|
| | Security | Audit Success | 12545 | 2025-11-29 04:32:21 | | Microsoft-Windows-Security-Auditing | 4634: An account was logged off. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0xe2a6e Logon Type: 2 This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
|
| | Security | Audit Success | 12548 | 2025-11-29 04:32:21 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0xe2a6e Privileges: SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-29 04:32:21 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 13824 | 2025-11-29 04:32:21 | | Microsoft-Windows-Security-Auditing | 4798: A user's local group membership was enumerated. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 User: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Process Information: Process ID: 0x4dc Process Name: C:\Windows\System32\lsass.exe
|
| | Security | Audit Success | 13826 | 2025-11-29 04:32:24 | | Microsoft-Windows-Security-Auditing | 4799: A security-enabled local group membership was enumerated. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Group: Security ID: S-1-5-32-544 Group Name: Administrators Group Domain: Builtin Process Information: Process ID: 0x2a44 Process Name: C:\Windows\System32\svchost.exe
|
| | Security | Audit Success | 13826 | 2025-11-29 04:32:24 | | Microsoft-Windows-Security-Auditing | 4799: A security-enabled local group membership was enumerated. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Group: Security ID: S-1-5-32-551 Group Name: Backup Operators Group Domain: Builtin Process Information: Process ID: 0x2a44 Process Name: C:\Windows\System32\svchost.exe
|
| | Security | Audit Success | 13824 | 2025-11-29 04:33:08 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-19 Account Name: LOCAL SERVICE Account Domain: NT AUTHORITY Logon ID: 0x3e5 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:33:08 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-19 Account Name: LOCAL SERVICE Account Domain: NT AUTHORITY Logon ID: 0x3e5 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:33:08 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-19 Account Name: LOCAL SERVICE Account Domain: NT AUTHORITY Logon ID: 0x3e5 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:33:08 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-19 Account Name: LOCAL SERVICE Account Domain: NT AUTHORITY Logon ID: 0x3e5 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:33:08 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-20 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e4 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:33:08 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-20 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e4 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:33:08 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-20 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e4 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:33:08 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-20 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e4 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:33:08 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-19 Account Name: LOCAL SERVICE Account Domain: NT AUTHORITY Logon ID: 0x3e5 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:33:08 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-19 Account Name: LOCAL SERVICE Account Domain: NT AUTHORITY Logon ID: 0x3e5 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:33:08 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-19 Account Name: LOCAL SERVICE Account Domain: NT AUTHORITY Logon ID: 0x3e5 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:33:08 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-19 Account Name: LOCAL SERVICE Account Domain: NT AUTHORITY Logon ID: 0x3e5 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:33:08 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x1cbe5 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:33:08 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x1cbe5 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:33:08 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x1cbe5 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:33:08 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x1cbe5 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 12290 | 2025-11-29 04:33:13 | | Microsoft-Windows-Security-Auditing | 5061: Cryptographic operation. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Cryptographic Parameters: Provider Name: Microsoft Software Key Storage Provider Algorithm Name: RSA Key Name: f8df15d9-56fa-0cb3-682b-838ed74af121 Key Type: %%2500 Cryptographic Operation: Operation: %%2480 Return Code: 0x0
|
| | Security | Audit Success | 12290 | 2025-11-29 04:33:13 | | Microsoft-Windows-Security-Auditing | 5061: Cryptographic operation. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Cryptographic Parameters: Provider Name: Microsoft Software Key Storage Provider Algorithm Name: RSA Key Name: f8df15d9-56fa-0cb3-682b-838ed74af121 Key Type: %%2500 Cryptographic Operation: Operation: %%2480 Return Code: 0x0
|
| | Security | Audit Success | 12292 | 2025-11-29 04:33:13 | | Microsoft-Windows-Security-Auditing | 5058: Key file operation. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Process Information: Process ID: 1740 Process Creation Time: 2025-11-29T12:32:03.1634457Z Cryptographic Parameters: Provider Name: Microsoft Software Key Storage Provider Algorithm Name: UNKNOWN Key Name: f8df15d9-56fa-0cb3-682b-838ed74af121 Key Type: %%2500 Key File Operation Information: File Path: C:\ProgramData\Microsoft\Crypto\SystemKeys\8bb43a3e92c2eb4c420c9abd6e278936_9ee7012e-fa60-42be-b8b4-8dc8b4e1280d Operation: %%2458 Return Code: 0x0
|
| | Security | Audit Success | 12292 | 2025-11-29 04:33:13 | | Microsoft-Windows-Security-Auditing | 5058: Key file operation. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Process Information: Process ID: 1740 Process Creation Time: 2025-11-29T12:32:03.1634457Z Cryptographic Parameters: Provider Name: Microsoft Software Key Storage Provider Algorithm Name: UNKNOWN Key Name: f8df15d9-56fa-0cb3-682b-838ed74af121 Key Type: %%2500 Key File Operation Information: File Path: C:\ProgramData\Microsoft\Crypto\SystemKeys\8bb43a3e92c2eb4c420c9abd6e278936_9ee7012e-fa60-42be-b8b4-8dc8b4e1280d Operation: %%2458 Return Code: 0x0
|
| | Security | Audit Success | 12292 | 2025-11-29 04:33:13 | | Microsoft-Windows-Security-Auditing | 5059: Key migration operation. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Process Information: Process ID: 1740 Process Creation Time: 2025-11-29T12:32:03.1634457Z Cryptographic Parameters: Provider Name: Microsoft Software Key Storage Provider Algorithm Name: RSA Key Name: f8df15d9-56fa-0cb3-682b-838ed74af121 Key Type: %%2500 Additional Information: Operation: %%2464 Return Code: 0x0
|
| | Security | Audit Success | 13824 | 2025-11-29 04:33:13 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:33:13 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:33:13 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 12544 | 2025-11-29 04:33:14 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4c8 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-29 04:33:14 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4c8 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12548 | 2025-11-29 04:33:14 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-29 04:33:14 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12290 | 2025-11-29 04:33:15 | | Microsoft-Windows-Security-Auditing | 5061: Cryptographic operation. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Cryptographic Parameters: Provider Name: Microsoft Software Key Storage Provider Algorithm Name: RSA Key Name: f8df15d9-56fa-0cb3-682b-838ed74af121 Key Type: %%2500 Cryptographic Operation: Operation: %%2480 Return Code: 0x0
|
| | Security | Audit Success | 12292 | 2025-11-29 04:33:15 | | Microsoft-Windows-Security-Auditing | 5058: Key file operation. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Process Information: Process ID: 1740 Process Creation Time: 2025-11-29T12:32:03.1634457Z Cryptographic Parameters: Provider Name: Microsoft Software Key Storage Provider Algorithm Name: UNKNOWN Key Name: f8df15d9-56fa-0cb3-682b-838ed74af121 Key Type: %%2500 Key File Operation Information: File Path: C:\ProgramData\Microsoft\Crypto\SystemKeys\8bb43a3e92c2eb4c420c9abd6e278936_9ee7012e-fa60-42be-b8b4-8dc8b4e1280d Operation: %%2458 Return Code: 0x0
|
| | Security | Audit Success | 13824 | 2025-11-29 04:33:15 | | Microsoft-Windows-Security-Auditing | 5381: Vault credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x1cbe5 This event occurs when a user enumerates stored vault credentials.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:33:15 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-19 Account Name: LOCAL SERVICE Account Domain: NT AUTHORITY Logon ID: 0x3e5 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:33:15 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-19 Account Name: LOCAL SERVICE Account Domain: NT AUTHORITY Logon ID: 0x3e5 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:33:15 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-19 Account Name: LOCAL SERVICE Account Domain: NT AUTHORITY Logon ID: 0x3e5 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:33:15 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x1cbe5 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:33:15 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x1cbe5 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:33:15 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x1cbe5 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:33:15 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x1cbe5 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:33:15 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x1cbe5 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:33:15 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x1cbe5 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:33:15 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x1cbe5 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:33:15 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x1cbe5 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:33:15 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x1cbe5 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:33:15 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x1cbe5 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:33:15 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:33:15 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Read Operation: %%8099 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:33:15 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:33:15 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:33:15 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:33:15 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:33:15 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:33:15 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:33:15 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:33:15 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:33:15 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x1cbe5 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:33:15 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x1cbe5 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:33:15 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x1cbe5 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 12290 | 2025-11-29 04:33:16 | | Microsoft-Windows-Security-Auditing | 5061: Cryptographic operation. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Cryptographic Parameters: Provider Name: Microsoft Software Key Storage Provider Algorithm Name: RSA Key Name: f8df15d9-56fa-0cb3-682b-838ed74af121 Key Type: %%2500 Cryptographic Operation: Operation: %%2480 Return Code: 0x0
|
| | Security | Audit Success | 12290 | 2025-11-29 04:33:16 | | Microsoft-Windows-Security-Auditing | 5061: Cryptographic operation. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Cryptographic Parameters: Provider Name: Microsoft Software Key Storage Provider Algorithm Name: RSA Key Name: f8df15d9-56fa-0cb3-682b-838ed74af121 Key Type: %%2500 Cryptographic Operation: Operation: %%2480 Return Code: 0x0
|
| | Security | Audit Success | 12292 | 2025-11-29 04:33:16 | | Microsoft-Windows-Security-Auditing | 5058: Key file operation. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Process Information: Process ID: 1740 Process Creation Time: 2025-11-29T12:32:03.1634457Z Cryptographic Parameters: Provider Name: Microsoft Software Key Storage Provider Algorithm Name: UNKNOWN Key Name: f8df15d9-56fa-0cb3-682b-838ed74af121 Key Type: %%2500 Key File Operation Information: File Path: C:\ProgramData\Microsoft\Crypto\SystemKeys\8bb43a3e92c2eb4c420c9abd6e278936_9ee7012e-fa60-42be-b8b4-8dc8b4e1280d Operation: %%2458 Return Code: 0x0
|
| | Security | Audit Success | 12292 | 2025-11-29 04:33:16 | | Microsoft-Windows-Security-Auditing | 5058: Key file operation. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Process Information: Process ID: 1740 Process Creation Time: 2025-11-29T12:32:03.1634457Z Cryptographic Parameters: Provider Name: Microsoft Software Key Storage Provider Algorithm Name: UNKNOWN Key Name: f8df15d9-56fa-0cb3-682b-838ed74af121 Key Type: %%2500 Key File Operation Information: File Path: C:\ProgramData\Microsoft\Crypto\SystemKeys\8bb43a3e92c2eb4c420c9abd6e278936_9ee7012e-fa60-42be-b8b4-8dc8b4e1280d Operation: %%2458 Return Code: 0x0
|
| | Security | Audit Success | 13824 | 2025-11-29 04:33:16 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x1cbe5 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:33:16 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x1cbe5 Read Operation: %%8099 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:33:16 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x1cbe5 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:33:16 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x1cbe5 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:33:16 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:33:16 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Read Operation: %%8099 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:33:16 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:33:16 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:33:16 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-19 Account Name: LOCAL SERVICE Account Domain: NT AUTHORITY Logon ID: 0x3e5 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:33:16 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-19 Account Name: LOCAL SERVICE Account Domain: NT AUTHORITY Logon ID: 0x3e5 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:33:16 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-19 Account Name: LOCAL SERVICE Account Domain: NT AUTHORITY Logon ID: 0x3e5 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:33:16 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-19 Account Name: LOCAL SERVICE Account Domain: NT AUTHORITY Logon ID: 0x3e5 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:33:16 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x1cbe5 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 12290 | 2025-11-29 04:33:17 | | Microsoft-Windows-Security-Auditing | 5061: Cryptographic operation. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Cryptographic Parameters: Provider Name: Microsoft Software Key Storage Provider Algorithm Name: RSA Key Name: f8df15d9-56fa-0cb3-682b-838ed74af121 Key Type: %%2500 Cryptographic Operation: Operation: %%2480 Return Code: 0x0
|
| | Security | Audit Success | 12290 | 2025-11-29 04:33:17 | | Microsoft-Windows-Security-Auditing | 5061: Cryptographic operation. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Cryptographic Parameters: Provider Name: Microsoft Software Key Storage Provider Algorithm Name: RSA Key Name: f8df15d9-56fa-0cb3-682b-838ed74af121 Key Type: %%2500 Cryptographic Operation: Operation: %%2480 Return Code: 0x0
|
| | Security | Audit Success | 12290 | 2025-11-29 04:33:17 | | Microsoft-Windows-Security-Auditing | 5061: Cryptographic operation. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Cryptographic Parameters: Provider Name: Microsoft Software Key Storage Provider Algorithm Name: RSA Key Name: f8df15d9-56fa-0cb3-682b-838ed74af121 Key Type: %%2500 Cryptographic Operation: Operation: %%2480 Return Code: 0x0
|
| | Security | Audit Success | 12290 | 2025-11-29 04:33:17 | | Microsoft-Windows-Security-Auditing | 5061: Cryptographic operation. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Cryptographic Parameters: Provider Name: Microsoft Software Key Storage Provider Algorithm Name: RSA Key Name: f8df15d9-56fa-0cb3-682b-838ed74af121 Key Type: %%2500 Cryptographic Operation: Operation: %%2480 Return Code: 0x0
|
| | Security | Audit Success | 12292 | 2025-11-29 04:33:17 | | Microsoft-Windows-Security-Auditing | 5058: Key file operation. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Process Information: Process ID: 1740 Process Creation Time: 2025-11-29T12:32:03.1634457Z Cryptographic Parameters: Provider Name: Microsoft Software Key Storage Provider Algorithm Name: UNKNOWN Key Name: f8df15d9-56fa-0cb3-682b-838ed74af121 Key Type: %%2500 Key File Operation Information: File Path: C:\ProgramData\Microsoft\Crypto\SystemKeys\8bb43a3e92c2eb4c420c9abd6e278936_9ee7012e-fa60-42be-b8b4-8dc8b4e1280d Operation: %%2458 Return Code: 0x0
|
| | Security | Audit Success | 12292 | 2025-11-29 04:33:17 | | Microsoft-Windows-Security-Auditing | 5058: Key file operation. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Process Information: Process ID: 1740 Process Creation Time: 2025-11-29T12:32:03.1634457Z Cryptographic Parameters: Provider Name: Microsoft Software Key Storage Provider Algorithm Name: UNKNOWN Key Name: f8df15d9-56fa-0cb3-682b-838ed74af121 Key Type: %%2500 Key File Operation Information: File Path: C:\ProgramData\Microsoft\Crypto\SystemKeys\8bb43a3e92c2eb4c420c9abd6e278936_9ee7012e-fa60-42be-b8b4-8dc8b4e1280d Operation: %%2458 Return Code: 0x0
|
| | Security | Audit Success | 12292 | 2025-11-29 04:33:17 | | Microsoft-Windows-Security-Auditing | 5058: Key file operation. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Process Information: Process ID: 1740 Process Creation Time: 2025-11-29T12:32:03.1634457Z Cryptographic Parameters: Provider Name: Microsoft Software Key Storage Provider Algorithm Name: UNKNOWN Key Name: f8df15d9-56fa-0cb3-682b-838ed74af121 Key Type: %%2500 Key File Operation Information: File Path: C:\ProgramData\Microsoft\Crypto\SystemKeys\8bb43a3e92c2eb4c420c9abd6e278936_9ee7012e-fa60-42be-b8b4-8dc8b4e1280d Operation: %%2458 Return Code: 0x0
|
| | Security | Audit Success | 12292 | 2025-11-29 04:33:17 | | Microsoft-Windows-Security-Auditing | 5058: Key file operation. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Process Information: Process ID: 1740 Process Creation Time: 2025-11-29T12:32:03.1634457Z Cryptographic Parameters: Provider Name: Microsoft Software Key Storage Provider Algorithm Name: UNKNOWN Key Name: f8df15d9-56fa-0cb3-682b-838ed74af121 Key Type: %%2500 Key File Operation Information: File Path: C:\ProgramData\Microsoft\Crypto\SystemKeys\8bb43a3e92c2eb4c420c9abd6e278936_9ee7012e-fa60-42be-b8b4-8dc8b4e1280d Operation: %%2458 Return Code: 0x0
|
| | Security | Audit Success | 12544 | 2025-11-29 04:33:17 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4c8 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-29 04:33:17 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4c8 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12548 | 2025-11-29 04:33:17 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-29 04:33:17 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 13824 | 2025-11-29 04:33:17 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-19 Account Name: LOCAL SERVICE Account Domain: NT AUTHORITY Logon ID: 0x3e5 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:33:17 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-19 Account Name: LOCAL SERVICE Account Domain: NT AUTHORITY Logon ID: 0x3e5 Read Operation: %%8099 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:33:17 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-19 Account Name: LOCAL SERVICE Account Domain: NT AUTHORITY Logon ID: 0x3e5 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:33:17 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-19 Account Name: LOCAL SERVICE Account Domain: NT AUTHORITY Logon ID: 0x3e5 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:33:17 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-19 Account Name: LOCAL SERVICE Account Domain: NT AUTHORITY Logon ID: 0x3e5 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:33:17 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-19 Account Name: LOCAL SERVICE Account Domain: NT AUTHORITY Logon ID: 0x3e5 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:33:17 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-19 Account Name: LOCAL SERVICE Account Domain: NT AUTHORITY Logon ID: 0x3e5 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:33:17 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:33:17 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Read Operation: %%8099 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:33:17 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:33:17 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:33:17 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x1cbe5 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:33:17 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x1cbe5 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:33:17 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x1cbe5 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:33:17 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x1cbe5 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:33:17 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:33:17 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Read Operation: %%8099 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:33:17 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:33:17 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:33:17 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x1cbe5 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:33:17 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x1cbe5 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:33:17 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x1cbe5 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:33:17 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x1cbe5 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:33:17 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x1cbe5 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:33:17 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x1cbe5 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:33:17 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x1cbe5 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:33:17 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x1cbe5 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:33:17 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:33:17 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Read Operation: %%8099 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:33:17 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:33:17 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:33:17 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x1cbe5 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:33:17 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:33:17 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:33:17 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:33:18 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:33:18 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:33:18 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:33:18 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:33:18 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x1cbe5 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:33:18 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x1cbe5 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:33:18 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x1cbe5 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:33:18 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x1cbe5 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:33:18 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x1cbe5 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:33:18 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x1cbe5 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:33:18 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x1cbe5 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:33:18 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:33:18 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:33:18 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:33:18 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:33:18 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-19 Account Name: LOCAL SERVICE Account Domain: NT AUTHORITY Logon ID: 0x3e5 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:33:18 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-19 Account Name: LOCAL SERVICE Account Domain: NT AUTHORITY Logon ID: 0x3e5 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:33:18 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-19 Account Name: LOCAL SERVICE Account Domain: NT AUTHORITY Logon ID: 0x3e5 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:33:18 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-19 Account Name: LOCAL SERVICE Account Domain: NT AUTHORITY Logon ID: 0x3e5 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:33:18 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-19 Account Name: LOCAL SERVICE Account Domain: NT AUTHORITY Logon ID: 0x3e5 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:33:18 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-19 Account Name: LOCAL SERVICE Account Domain: NT AUTHORITY Logon ID: 0x3e5 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:33:18 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-19 Account Name: LOCAL SERVICE Account Domain: NT AUTHORITY Logon ID: 0x3e5 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:33:18 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:33:18 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:33:18 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:33:18 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:33:18 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x1cbe5 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:33:18 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x1cbe5 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:33:18 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x1cbe5 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:33:18 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x1cbe5 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:33:18 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x1cbe5 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:33:18 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x1cbe5 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:33:18 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x1cbe5 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:33:18 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x1cbe5 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:33:18 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-19 Account Name: LOCAL SERVICE Account Domain: NT AUTHORITY Logon ID: 0x3e5 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:33:18 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-19 Account Name: LOCAL SERVICE Account Domain: NT AUTHORITY Logon ID: 0x3e5 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:33:18 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-19 Account Name: LOCAL SERVICE Account Domain: NT AUTHORITY Logon ID: 0x3e5 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:33:18 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-19 Account Name: LOCAL SERVICE Account Domain: NT AUTHORITY Logon ID: 0x3e5 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 12544 | 2025-11-29 04:33:19 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4c8 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12548 | 2025-11-29 04:33:19 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 13824 | 2025-11-29 04:33:19 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:33:19 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-19 Account Name: LOCAL SERVICE Account Domain: NT AUTHORITY Logon ID: 0x3e5 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:33:19 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:33:19 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-19 Account Name: LOCAL SERVICE Account Domain: NT AUTHORITY Logon ID: 0x3e5 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:33:19 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:33:19 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-19 Account Name: LOCAL SERVICE Account Domain: NT AUTHORITY Logon ID: 0x3e5 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:33:19 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x1cbe5 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:33:19 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x1cbe5 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:33:19 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x1cbe5 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:33:19 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x1cbe5 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:33:19 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x1cbe5 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:33:19 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x1cbe5 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:33:19 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:33:19 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:33:19 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:33:19 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:33:19 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:33:19 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:33:19 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:33:19 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x1cbe5 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:33:19 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x1cbe5 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:33:19 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x1cbe5 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:33:19 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x1cbe5 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:33:19 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:33:19 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:33:19 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:33:19 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:33:19 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x1cbe5 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:33:19 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-19 Account Name: LOCAL SERVICE Account Domain: NT AUTHORITY Logon ID: 0x3e5 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:33:19 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x1cbe5 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:33:19 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x1cbe5 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:33:19 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x1cbe5 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:33:19 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-19 Account Name: LOCAL SERVICE Account Domain: NT AUTHORITY Logon ID: 0x3e5 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:33:19 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-19 Account Name: LOCAL SERVICE Account Domain: NT AUTHORITY Logon ID: 0x3e5 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:33:19 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-19 Account Name: LOCAL SERVICE Account Domain: NT AUTHORITY Logon ID: 0x3e5 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:33:19 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-19 Account Name: LOCAL SERVICE Account Domain: NT AUTHORITY Logon ID: 0x3e5 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:33:19 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-19 Account Name: LOCAL SERVICE Account Domain: NT AUTHORITY Logon ID: 0x3e5 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:33:19 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-19 Account Name: LOCAL SERVICE Account Domain: NT AUTHORITY Logon ID: 0x3e5 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:33:19 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:33:19 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:33:19 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:33:19 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-19 Account Name: LOCAL SERVICE Account Domain: NT AUTHORITY Logon ID: 0x3e5 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:33:19 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-19 Account Name: LOCAL SERVICE Account Domain: NT AUTHORITY Logon ID: 0x3e5 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:33:19 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-19 Account Name: LOCAL SERVICE Account Domain: NT AUTHORITY Logon ID: 0x3e5 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:33:19 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-19 Account Name: LOCAL SERVICE Account Domain: NT AUTHORITY Logon ID: 0x3e5 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:33:19 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-19 Account Name: LOCAL SERVICE Account Domain: NT AUTHORITY Logon ID: 0x3e5 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:33:19 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-19 Account Name: LOCAL SERVICE Account Domain: NT AUTHORITY Logon ID: 0x3e5 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:33:19 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-19 Account Name: LOCAL SERVICE Account Domain: NT AUTHORITY Logon ID: 0x3e5 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:33:20 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x1cbe5 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:33:20 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x1cbe5 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:33:20 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x1cbe5 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:33:20 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:33:20 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:33:20 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:33:20 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:33:20 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:33:20 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:33:20 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:33:20 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-19 Account Name: LOCAL SERVICE Account Domain: NT AUTHORITY Logon ID: 0x3e5 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:33:20 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-19 Account Name: LOCAL SERVICE Account Domain: NT AUTHORITY Logon ID: 0x3e5 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:33:20 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-19 Account Name: LOCAL SERVICE Account Domain: NT AUTHORITY Logon ID: 0x3e5 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:33:20 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-19 Account Name: LOCAL SERVICE Account Domain: NT AUTHORITY Logon ID: 0x3e5 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:33:20 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x1cbe5 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:33:20 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x1cbe5 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:33:20 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x1cbe5 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:33:20 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x1cbe5 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:33:20 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:33:20 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:33:20 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:33:20 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:33:20 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-19 Account Name: LOCAL SERVICE Account Domain: NT AUTHORITY Logon ID: 0x3e5 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:33:20 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-19 Account Name: LOCAL SERVICE Account Domain: NT AUTHORITY Logon ID: 0x3e5 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:33:20 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-19 Account Name: LOCAL SERVICE Account Domain: NT AUTHORITY Logon ID: 0x3e5 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:33:20 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:33:20 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:33:20 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:33:20 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:33:20 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:33:20 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:33:20 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:33:20 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-19 Account Name: LOCAL SERVICE Account Domain: NT AUTHORITY Logon ID: 0x3e5 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:33:20 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-19 Account Name: LOCAL SERVICE Account Domain: NT AUTHORITY Logon ID: 0x3e5 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:33:20 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-19 Account Name: LOCAL SERVICE Account Domain: NT AUTHORITY Logon ID: 0x3e5 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:33:20 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-19 Account Name: LOCAL SERVICE Account Domain: NT AUTHORITY Logon ID: 0x3e5 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:33:21 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:33:21 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:33:21 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:33:21 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-19 Account Name: LOCAL SERVICE Account Domain: NT AUTHORITY Logon ID: 0x3e5 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:33:21 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-19 Account Name: LOCAL SERVICE Account Domain: NT AUTHORITY Logon ID: 0x3e5 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:33:21 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-19 Account Name: LOCAL SERVICE Account Domain: NT AUTHORITY Logon ID: 0x3e5 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:33:21 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:33:21 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:33:21 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:33:21 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:33:21 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-19 Account Name: LOCAL SERVICE Account Domain: NT AUTHORITY Logon ID: 0x3e5 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:33:21 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-19 Account Name: LOCAL SERVICE Account Domain: NT AUTHORITY Logon ID: 0x3e5 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:33:21 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-19 Account Name: LOCAL SERVICE Account Domain: NT AUTHORITY Logon ID: 0x3e5 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:33:21 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-19 Account Name: LOCAL SERVICE Account Domain: NT AUTHORITY Logon ID: 0x3e5 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:33:21 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-19 Account Name: LOCAL SERVICE Account Domain: NT AUTHORITY Logon ID: 0x3e5 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:33:21 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-19 Account Name: LOCAL SERVICE Account Domain: NT AUTHORITY Logon ID: 0x3e5 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:33:21 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-19 Account Name: LOCAL SERVICE Account Domain: NT AUTHORITY Logon ID: 0x3e5 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:33:22 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-19 Account Name: LOCAL SERVICE Account Domain: NT AUTHORITY Logon ID: 0x3e5 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:33:22 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-19 Account Name: LOCAL SERVICE Account Domain: NT AUTHORITY Logon ID: 0x3e5 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:33:22 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-19 Account Name: LOCAL SERVICE Account Domain: NT AUTHORITY Logon ID: 0x3e5 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:33:22 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-19 Account Name: LOCAL SERVICE Account Domain: NT AUTHORITY Logon ID: 0x3e5 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:33:22 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-19 Account Name: LOCAL SERVICE Account Domain: NT AUTHORITY Logon ID: 0x3e5 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:33:22 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-19 Account Name: LOCAL SERVICE Account Domain: NT AUTHORITY Logon ID: 0x3e5 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:33:22 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-19 Account Name: LOCAL SERVICE Account Domain: NT AUTHORITY Logon ID: 0x3e5 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:33:22 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-19 Account Name: LOCAL SERVICE Account Domain: NT AUTHORITY Logon ID: 0x3e5 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:33:22 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-19 Account Name: LOCAL SERVICE Account Domain: NT AUTHORITY Logon ID: 0x3e5 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:33:22 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-19 Account Name: LOCAL SERVICE Account Domain: NT AUTHORITY Logon ID: 0x3e5 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:33:22 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-19 Account Name: LOCAL SERVICE Account Domain: NT AUTHORITY Logon ID: 0x3e5 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 12288 | 2025-11-29 04:41:20 | | Microsoft-Windows-Security-Auditing | 4616: The system time was changed. Subject: Security ID: S-1-5-19 Account Name: LOCAL SERVICE Account Domain: NT AUTHORITY Logon ID: 0x3e5 Process Information: Process ID: 0x1860 Name: C:\Windows\System32\svchost.exe Previous Time: 2025-11-29T12:33:22.8078423Z New Time: 2025-11-29T12:41:20.4734944Z This event is generated when the system time is changed. It is normal for the Windows Time Service, which runs with System privilege, to change the system time on a regular basis. Other system time changes may be indicative of attempts to tamper with the computer.
|
| | Security | Audit Success | 12288 | 2025-11-29 04:41:20 | | Microsoft-Windows-Security-Auditing | 4616: The system time was changed. Subject: Security ID: S-1-5-19 Account Name: LOCAL SERVICE Account Domain: NT AUTHORITY Logon ID: 0x3e5 Process Information: Process ID: 0x1860 Name: C:\Windows\System32\svchost.exe Previous Time: 2025-11-29T12:41:20.4734944Z New Time: 2025-11-29T12:41:20.4742609Z This event is generated when the system time is changed. It is normal for the Windows Time Service, which runs with System privilege, to change the system time on a regular basis. Other system time changes may be indicative of attempts to tamper with the computer.
|
| | Security | Audit Success | 12544 | 2025-11-29 04:41:20 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4c8 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12548 | 2025-11-29 04:41:20 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 13824 | 2025-11-29 04:41:20 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-19 Account Name: LOCAL SERVICE Account Domain: NT AUTHORITY Logon ID: 0x3e5 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:41:20 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-19 Account Name: LOCAL SERVICE Account Domain: NT AUTHORITY Logon ID: 0x3e5 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:41:20 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-19 Account Name: LOCAL SERVICE Account Domain: NT AUTHORITY Logon ID: 0x3e5 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:41:20 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-19 Account Name: LOCAL SERVICE Account Domain: NT AUTHORITY Logon ID: 0x3e5 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:41:20 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-19 Account Name: LOCAL SERVICE Account Domain: NT AUTHORITY Logon ID: 0x3e5 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:41:20 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-19 Account Name: LOCAL SERVICE Account Domain: NT AUTHORITY Logon ID: 0x3e5 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:41:20 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-19 Account Name: LOCAL SERVICE Account Domain: NT AUTHORITY Logon ID: 0x3e5 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 12288 | 2025-11-29 04:41:21 | | Microsoft-Windows-Security-Auditing | 4616: The system time was changed. Subject: Security ID: S-1-5-19 Account Name: LOCAL SERVICE Account Domain: NT AUTHORITY Logon ID: 0x3e5 Process Information: Process ID: 0x1860 Name: C:\Windows\System32\svchost.exe Previous Time: 2025-11-29T12:41:21.9469913Z New Time: 2025-11-29T12:41:21.9468748Z This event is generated when the system time is changed. It is normal for the Windows Time Service, which runs with System privilege, to change the system time on a regular basis. Other system time changes may be indicative of attempts to tamper with the computer.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:41:21 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x1cbe5 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:41:21 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x1cbe5 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:41:21 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x1cbe5 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:41:21 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x1cbe5 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:41:21 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x1cbe5 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:41:21 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x1cbe5 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:41:21 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x1cbe5 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:41:21 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x1cbe5 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:41:21 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x1cbe5 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:41:21 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x1cbe5 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:41:21 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x1cbe5 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:41:21 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x1cbe5 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:41:21 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x1cbe5 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:41:21 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x1cbe5 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:41:21 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x1cbe5 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:41:21 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x1cbe5 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:41:21 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x1cbe5 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:41:21 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x1cbe5 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:41:21 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x1cbe5 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:41:21 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x1cbe5 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:41:21 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x1cbe5 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:41:21 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x1cbe5 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:41:21 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x1cbe5 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:41:21 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x1cbe5 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:41:21 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x1cbe5 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:41:21 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x1cbe5 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:41:22 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x1cbe5 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:41:22 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x1cbe5 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:41:22 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:41:22 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:41:22 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:41:22 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:41:22 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:41:22 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:41:22 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:41:30 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-19 Account Name: LOCAL SERVICE Account Domain: NT AUTHORITY Logon ID: 0x3e5 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:41:30 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-19 Account Name: LOCAL SERVICE Account Domain: NT AUTHORITY Logon ID: 0x3e5 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:41:30 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-19 Account Name: LOCAL SERVICE Account Domain: NT AUTHORITY Logon ID: 0x3e5 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:41:30 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-19 Account Name: LOCAL SERVICE Account Domain: NT AUTHORITY Logon ID: 0x3e5 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:41:30 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-19 Account Name: LOCAL SERVICE Account Domain: NT AUTHORITY Logon ID: 0x3e5 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:41:30 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-19 Account Name: LOCAL SERVICE Account Domain: NT AUTHORITY Logon ID: 0x3e5 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:41:30 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-19 Account Name: LOCAL SERVICE Account Domain: NT AUTHORITY Logon ID: 0x3e5 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:41:32 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x1cbe5 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:41:32 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x1cbe5 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:41:32 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x1cbe5 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:41:32 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x1cbe5 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:41:32 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x1cbe5 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:41:32 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x1cbe5 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:41:32 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x1cbe5 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 12544 | 2025-11-29 04:41:42 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4c8 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12548 | 2025-11-29 04:41:42 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12544 | 2025-11-29 04:42:03 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4c8 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-29 04:42:03 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4c8 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12548 | 2025-11-29 04:42:03 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-29 04:42:03 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12544 | 2025-11-29 04:42:35 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4c8 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12548 | 2025-11-29 04:42:35 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12544 | 2025-11-29 04:42:54 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4c8 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12548 | 2025-11-29 04:42:54 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12544 | 2025-11-29 04:43:44 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4c8 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12548 | 2025-11-29 04:43:44 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 13824 | 2025-11-29 04:43:44 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:43:44 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:43:44 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 12544 | 2025-11-29 04:43:45 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4c8 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12548 | 2025-11-29 04:43:45 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 13824 | 2025-11-29 04:43:45 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:43:45 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:43:45 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:43:45 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 12544 | 2025-11-29 04:43:47 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4c8 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12548 | 2025-11-29 04:43:47 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 13824 | 2025-11-29 04:43:50 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x1cbe5 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:43:50 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x1cbe5 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:43:50 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x1cbe5 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:43:50 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x1cbe5 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:44:03 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x1cbe5 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:44:03 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x1cbe5 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:44:03 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x1cbe5 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:44:03 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x1cbe5 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 12544 | 2025-11-29 04:44:10 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4c8 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12548 | 2025-11-29 04:44:10 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12544 | 2025-11-29 04:44:12 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4c8 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12548 | 2025-11-29 04:44:12 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 13824 | 2025-11-29 04:44:44 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:44:44 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:44:44 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:44:45 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:44:45 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:44:45 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:44:45 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:44:45 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:44:45 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:44:45 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:44:45 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:44:45 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:44:45 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:44:45 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 12544 | 2025-11-29 04:45:06 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4c8 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12548 | 2025-11-29 04:45:06 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 13824 | 2025-11-29 04:45:10 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x1cbe5 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:45:10 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x1cbe5 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:45:10 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x1cbe5 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:45:11 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x1cbe5 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:45:11 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x1cbe5 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:45:11 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x1cbe5 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:45:11 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x1cbe5 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:45:11 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x1cbe5 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:45:11 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x1cbe5 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:45:11 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x1cbe5 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:45:11 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x1cbe5 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 12544 | 2025-11-29 04:45:18 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4c8 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-29 04:45:18 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4c8 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12548 | 2025-11-29 04:45:18 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-29 04:45:18 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 13824 | 2025-11-29 04:45:18 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x1cbe5 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:45:18 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x1cbe5 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:45:18 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x1cbe5 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:45:18 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x1cbe5 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:45:18 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x1cbe5 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:45:18 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x1cbe5 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:45:18 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x1cbe5 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:45:23 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:45:23 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:45:23 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:45:23 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:45:23 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:45:23 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:45:23 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:45:30 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x1cbe5 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:45:30 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x1cbe5 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:45:30 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x1cbe5 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:45:31 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x1cbe5 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 12544 | 2025-11-29 04:45:37 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4c8 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-29 04:45:37 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4c8 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-29 04:45:37 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4c8 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-29 04:45:37 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4c8 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-29 04:45:37 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4c8 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-29 04:45:37 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4c8 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-29 04:45:37 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4c8 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12548 | 2025-11-29 04:45:37 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-29 04:45:37 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-29 04:45:37 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-29 04:45:37 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-29 04:45:37 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-29 04:45:37 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-29 04:45:37 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 13824 | 2025-11-29 04:45:39 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:45:39 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:45:39 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:45:40 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:45:40 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:45:40 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:45:40 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 12544 | 2025-11-29 04:45:47 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4c8 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-29 04:45:47 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4c8 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-29 04:45:47 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4c8 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12548 | 2025-11-29 04:45:47 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-29 04:45:47 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-29 04:45:47 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 13824 | 2025-11-29 04:45:51 | | Microsoft-Windows-Security-Auditing | 4798: A user's local group membership was enumerated. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x1cbe5 User: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Process Information: Process ID: 0x59c Process Name: C:\Program Files\WindowsApps\Microsoft.Paint_11.2412.295.0_x64__8wekyb3d8bbwe\PaintApp\mspaint.exe
|
| | Security | Audit Success | 13824 | 2025-11-29 04:46:16 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x1cbe5 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:46:16 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x1cbe5 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:46:16 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x1cbe5 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:46:16 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x1cbe5 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:46:17 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x1cbe5 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:46:17 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x1cbe5 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:46:17 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x1cbe5 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 12544 | 2025-11-29 04:47:38 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4c8 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12548 | 2025-11-29 04:47:38 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 13826 | 2025-11-29 04:47:45 | | Microsoft-Windows-Security-Auditing | 4732: A member was added to a security-enabled local group. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x1c99e Member: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: - Group: Security ID: S-1-5-32-559 Group Name: Performance Log Users Group Domain: Builtin Additional Information: Privileges: - Expiration time: (null)
|
| | Security | Audit Success | 12544 | 2025-11-29 04:48:08 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4c8 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12548 | 2025-11-29 04:48:08 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 13824 | 2025-11-29 04:48:08 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:48:08 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:48:08 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:48:08 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:48:08 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:48:08 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:48:08 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 12544 | 2025-11-29 04:48:15 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4c8 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12548 | 2025-11-29 04:48:15 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12544 | 2025-11-29 04:48:49 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4c8 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12548 | 2025-11-29 04:48:49 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12544 | 2025-11-29 04:49:02 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4c8 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12548 | 2025-11-29 04:49:02 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 13824 | 2025-11-29 04:49:57 | | Microsoft-Windows-Security-Auditing | 4798: A user's local group membership was enumerated. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x1c99e User: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Process Information: Process ID: 0xac4 Process Name: C:\AMD\AMD-Software-Installer\Bin64\AMDSoftwareInstaller.exe
|
| | Security | Audit Success | 12544 | 2025-11-29 04:50:09 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4c8 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-29 04:50:09 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4c8 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12548 | 2025-11-29 04:50:09 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-29 04:50:09 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 13826 | 2025-11-29 04:50:09 | | Microsoft-Windows-Security-Auditing | 4799: A security-enabled local group membership was enumerated. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Group: Security ID: S-1-5-32-544 Group Name: Administrators Group Domain: Builtin Process Information: Process ID: 0x10e0 Process Name: C:\Windows\System32\VSSVC.exe
|
| | Security | Audit Success | 13826 | 2025-11-29 04:50:09 | | Microsoft-Windows-Security-Auditing | 4799: A security-enabled local group membership was enumerated. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Group: Security ID: S-1-5-32-551 Group Name: Backup Operators Group Domain: Builtin Process Information: Process ID: 0x10e0 Process Name: C:\Windows\System32\VSSVC.exe
|
| | Security | Audit Success | 13826 | 2025-11-29 04:50:09 | | Microsoft-Windows-Security-Auditing | 4799: A security-enabled local group membership was enumerated. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Group: Security ID: S-1-5-32-544 Group Name: Administrators Group Domain: Builtin Process Information: Process ID: 0x10e0 Process Name: C:\Windows\System32\VSSVC.exe
|
| | Security | Audit Success | 13826 | 2025-11-29 04:50:09 | | Microsoft-Windows-Security-Auditing | 4799: A security-enabled local group membership was enumerated. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Group: Security ID: S-1-5-32-551 Group Name: Backup Operators Group Domain: Builtin Process Information: Process ID: 0x10e0 Process Name: C:\Windows\System32\VSSVC.exe
|
| | Security | Audit Success | 13826 | 2025-11-29 04:50:09 | | Microsoft-Windows-Security-Auditing | 4799: A security-enabled local group membership was enumerated. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Group: Security ID: S-1-5-32-544 Group Name: Administrators Group Domain: Builtin Process Information: Process ID: 0x10e0 Process Name: C:\Windows\System32\VSSVC.exe
|
| | Security | Audit Success | 13826 | 2025-11-29 04:50:09 | | Microsoft-Windows-Security-Auditing | 4799: A security-enabled local group membership was enumerated. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Group: Security ID: S-1-5-32-551 Group Name: Backup Operators Group Domain: Builtin Process Information: Process ID: 0x10e0 Process Name: C:\Windows\System32\VSSVC.exe
|
| | Security | Audit Success | 13826 | 2025-11-29 04:50:09 | | Microsoft-Windows-Security-Auditing | 4799: A security-enabled local group membership was enumerated. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Group: Security ID: S-1-5-32-544 Group Name: Administrators Group Domain: Builtin Process Information: Process ID: 0x10e0 Process Name: C:\Windows\System32\VSSVC.exe
|
| | Security | Audit Success | 13826 | 2025-11-29 04:50:09 | | Microsoft-Windows-Security-Auditing | 4799: A security-enabled local group membership was enumerated. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Group: Security ID: S-1-5-32-551 Group Name: Backup Operators Group Domain: Builtin Process Information: Process ID: 0x10e0 Process Name: C:\Windows\System32\VSSVC.exe
|
| | Security | Audit Success | 12544 | 2025-11-29 04:50:11 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4c8 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12545 | 2025-11-29 04:50:11 | | Microsoft-Windows-Security-Auditing | 4647: User initiated logoff: Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x1cbe5 This event is generated when a logoff is initiated. No further user-initiated activity can occur. This event can be interpreted as a logoff event.
|
| | Security | Audit Success | 12548 | 2025-11-29 04:50:11 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 103 | 2025-11-29 04:50:12 | | Microsoft-Windows-Eventlog | 1100: The event logging service has shut down.
|
| | Security | Audit Success | 13312 | 2025-11-29 04:50:18 | | Microsoft-Windows-Security-Auditing | 4688: A new process has been created. Creator Subject: Security ID: S-1-5-18 Account Name: - Account Domain: - Logon ID: 0x3e7 Target Subject: Security ID: S-1-0-0 Account Name: - Account Domain: - Logon ID: 0x0 Process Information: New Process ID: 0x170 New Process Name: R Token Elevation Type: %%1936 Mandatory Label: S-1-16-16384 Creator Process ID: 0x4 Creator Process Name: Process Command Line: Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
|
| | Security | Audit Success | 13312 | 2025-11-29 04:50:18 | | Microsoft-Windows-Security-Auditing | 4696: A primary token was assigned to process. Subject: Security ID: S-1-5-18 Account Name: - Account Domain: - Logon ID: 0x3e7 Process Information: Process ID: 0x4 Process Name: Target Process: Target Process ID: 0x170 Target Process Name: Registry New Token Information: Security ID: S-1-0-0 Account Name: - Account Domain: - Logon ID: 0x3e7
|
| | Security | Audit Success | 13312 | 2025-11-29 04:50:18 | | Microsoft-Windows-Security-Auditing | 4688: A new process has been created. Creator Subject: Security ID: S-1-5-18 Account Name: - Account Domain: - Logon ID: 0x3e7 Target Subject: Security ID: S-1-0-0 Account Name: - Account Domain: - Logon ID: 0x0 Process Information: New Process ID: 0x364 New Process Name: C Token Elevation Type: %%1936 Mandatory Label: S-1-16-16384 Creator Process ID: 0x4 Creator Process Name: Process Command Line: Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
|
| | Security | Audit Success | 13573 | 2025-11-29 04:50:18 | | Microsoft-Windows-Security-Auditing | 4826: Boot Configuration Data loaded. Subject: Security ID: S-1-5-18 Account Name: - Account Domain: - Logon ID: 0x3e7 General Settings: Load Options: - Advanced Options: %%1843 Configuration Access Policy: %%1846 System Event Logging: %%1843 Kernel Debugging: %%1843 VSM Launch Type: %%1848 Signature Settings: Test Signing: %%1843 Flight Signing: %%1843 Disable Integrity Checks: %%1843 HyperVisor Settings: HyperVisor Load Options: - HyperVisor Launch Type: %%1848 HyperVisor Debugging: %%1843
|
| | Security | Audit Success | 13312 | 2025-11-29 04:50:19 | | Microsoft-Windows-Security-Auditing | 4688: A new process has been created. Creator Subject: Security ID: S-1-5-18 Account Name: - Account Domain: - Logon ID: 0x3e7 Target Subject: Security ID: S-1-0-0 Account Name: - Account Domain: - Logon ID: 0x0 Process Information: New Process ID: 0x380 New Process Name: C Token Elevation Type: %%1936 Mandatory Label: S-1-16-16384 Creator Process ID: 0x364 Creator Process Name: C Process Command Line: Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
|
| | Security | Audit Success | 13312 | 2025-11-29 04:50:32 | | Microsoft-Windows-Security-Auditing | 4688: A new process has been created. Creator Subject: Security ID: S-1-5-18 Account Name: - Account Domain: - Logon ID: 0x3e7 Target Subject: Security ID: S-1-0-0 Account Name: - Account Domain: - Logon ID: 0x0 Process Information: New Process ID: 0x3fc New Process Name: C Token Elevation Type: %%1936 Mandatory Label: S-1-16-16384 Creator Process ID: 0x364 Creator Process Name: C Process Command Line: Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
|
| | Security | Audit Success | 13312 | 2025-11-29 04:50:33 | | Microsoft-Windows-Security-Auditing | 4688: A new process has been created. Creator Subject: Security ID: S-1-5-18 Account Name: - Account Domain: - Logon ID: 0x3e7 Target Subject: Security ID: S-1-0-0 Account Name: - Account Domain: - Logon ID: 0x0 Process Information: New Process ID: 0x358 New Process Name: C Token Elevation Type: %%1936 Mandatory Label: S-1-16-16384 Creator Process ID: 0x3fc Creator Process Name: C Process Command Line: Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
|
| | Security | Audit Success | 13312 | 2025-11-29 04:50:35 | | Microsoft-Windows-Security-Auditing | 4688: A new process has been created. Creator Subject: Security ID: S-1-5-18 Account Name: - Account Domain: - Logon ID: 0x3e7 Target Subject: Security ID: S-1-0-0 Account Name: - Account Domain: - Logon ID: 0x0 Process Information: New Process ID: 0x480 New Process Name: C Token Elevation Type: %%1936 Mandatory Label: S-1-16-16384 Creator Process ID: 0x364 Creator Process Name: C Process Command Line: Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
|
| | Security | Audit Success | 13312 | 2025-11-29 04:50:35 | | Microsoft-Windows-Security-Auditing | 4688: A new process has been created. Creator Subject: Security ID: S-1-5-18 Account Name: - Account Domain: - Logon ID: 0x3e7 Target Subject: Security ID: S-1-0-0 Account Name: - Account Domain: - Logon ID: 0x0 Process Information: New Process ID: 0x488 New Process Name: C Token Elevation Type: %%1936 Mandatory Label: S-1-16-16384 Creator Process ID: 0x3fc Creator Process Name: C Process Command Line: Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
|
| | Security | Audit Success | 13312 | 2025-11-29 04:50:35 | | Microsoft-Windows-Security-Auditing | 4688: A new process has been created. Creator Subject: Security ID: S-1-5-18 Account Name: - Account Domain: - Logon ID: 0x3e7 Target Subject: Security ID: S-1-0-0 Account Name: - Account Domain: - Logon ID: 0x0 Process Information: New Process ID: 0x490 New Process Name: C Token Elevation Type: %%1936 Mandatory Label: S-1-16-16384 Creator Process ID: 0x480 Creator Process Name: C Process Command Line: Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
|
| | Security | Audit Success | 12288 | 2025-11-29 04:50:36 | | Microsoft-Windows-Security-Auditing | 4608: Windows is starting up. This event is logged when LSASS.EXE starts and the auditing subsystem is initialized.
|
| | Security | Audit Success | 12290 | 2025-11-29 04:50:36 | | Microsoft-Windows-Security-Auditing | 6417: The FIPS mode crypto selftests succeeded. Process ID: 0x538 Process Name: C:\Windows\System32\lsass.exe
|
| | Security | Audit Success | 12544 | 2025-11-29 04:50:36 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-0-0 Account Name: - Account Domain: - Logon ID: 0x0 Logon Information: Logon Type: 0 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: - New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4 Process Name: Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: - Authentication Package: - Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 13312 | 2025-11-29 04:50:36 | | Microsoft-Windows-Security-Auditing | 4688: A new process has been created. Creator Subject: Security ID: S-1-5-18 Account Name: - Account Domain: - Logon ID: 0x3e7 Target Subject: Security ID: S-1-0-0 Account Name: - Account Domain: - Logon ID: 0x0 Process Information: New Process ID: 0x4e0 New Process Name: C Token Elevation Type: %%1936 Mandatory Label: S-1-16-16384 Creator Process ID: 0x488 Creator Process Name: C Process Command Line: Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
|
| | Security | Audit Success | 13312 | 2025-11-29 04:50:36 | | Microsoft-Windows-Security-Auditing | 4688: A new process has been created. Creator Subject: Security ID: S-1-5-18 Account Name: - Account Domain: - Logon ID: 0x3e7 Target Subject: Security ID: S-1-0-0 Account Name: - Account Domain: - Logon ID: 0x0 Process Information: New Process ID: 0x500 New Process Name: C Token Elevation Type: %%1936 Mandatory Label: S-1-16-16384 Creator Process ID: 0x480 Creator Process Name: C Process Command Line: Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
|
| | Security | Audit Success | 13312 | 2025-11-29 04:50:36 | | Microsoft-Windows-Security-Auditing | 4688: A new process has been created. Creator Subject: Security ID: S-1-5-18 Account Name: - Account Domain: - Logon ID: 0x3e7 Target Subject: Security ID: S-1-0-0 Account Name: - Account Domain: - Logon ID: 0x0 Process Information: New Process ID: 0x538 New Process Name: C Token Elevation Type: %%1936 Mandatory Label: S-1-16-16384 Creator Process ID: 0x488 Creator Process Name: C Process Command Line: Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
|
| | Security | Audit Success | 13568 | 2025-11-29 04:50:36 | | Microsoft-Windows-Security-Auditing | 4902: The Per-user audit policy table was created. Number of Elements: 0 Policy ID: 0xf4fe
|
| | Security | Audit Success | 12544 | 2025-11-29 04:50:37 | | Microsoft-Windows-Security-Auditing | 4648: A logon was attempted using explicit credentials. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon GUID: {00000000-0000-0000-0000-000000000000} Account Whose Credentials Were Used: Account Name: UMFD-1 Account Domain: Font Driver Host Logon GUID: {00000000-0000-0000-0000-000000000000} Target Server: Target Server Name: localhost Additional Information: localhost Process Information: Process ID: 0x500 Process Name: C:\Windows\System32\winlogon.exe Network Information: Network Address: - Port: - This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
|
| | Security | Audit Success | 12544 | 2025-11-29 04:50:37 | | Microsoft-Windows-Security-Auditing | 4648: A logon was attempted using explicit credentials. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon GUID: {00000000-0000-0000-0000-000000000000} Account Whose Credentials Were Used: Account Name: UMFD-0 Account Domain: Font Driver Host Logon GUID: {00000000-0000-0000-0000-000000000000} Target Server: Target Server Name: localhost Additional Information: localhost Process Information: Process ID: 0x488 Process Name: C:\Windows\System32\wininit.exe Network Information: Network Address: - Port: - This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
|
| | Security | Audit Success | 12544 | 2025-11-29 04:50:37 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4e0 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-29 04:50:37 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 2 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1842 Elevated Token: %%1843 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-96-0-0 Account Name: UMFD-0 Account Domain: Font Driver Host Logon ID: 0xf93a Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x488 Process Name: C:\Windows\System32\wininit.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-29 04:50:37 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 2 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1842 Elevated Token: %%1843 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-96-0-1 Account Name: UMFD-1 Account Domain: Font Driver Host Logon ID: 0xf93b Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x500 Process Name: C:\Windows\System32\winlogon.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-29 04:50:37 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-20 Account Name: NETWORK SERVICE Account Domain: NT AUTHORITY Logon ID: 0x3e4 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4e0 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-29 04:50:37 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4e0 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-29 04:50:37 | | Microsoft-Windows-Security-Auditing | 4648: A logon was attempted using explicit credentials. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon GUID: {00000000-0000-0000-0000-000000000000} Account Whose Credentials Were Used: Account Name: DWM-1 Account Domain: Window Manager Logon GUID: {00000000-0000-0000-0000-000000000000} Target Server: Target Server Name: localhost Additional Information: localhost Process Information: Process ID: 0x500 Process Name: C:\Windows\System32\winlogon.exe Network Information: Network Address: - Port: - This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
|
| | Security | Audit Success | 12544 | 2025-11-29 04:50:37 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 2 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1842 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-90-0-1 Account Name: DWM-1 Account Domain: Window Manager Logon ID: 0x16014 Linked Logon ID: 0x16064 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x500 Process Name: C:\Windows\System32\winlogon.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-29 04:50:37 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 2 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1842 Elevated Token: %%1843 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-90-0-1 Account Name: DWM-1 Account Domain: Window Manager Logon ID: 0x16064 Linked Logon ID: 0x16014 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x500 Process Name: C:\Windows\System32\winlogon.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-29 04:50:37 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4e0 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-29 04:50:37 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4e0 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-29 04:50:37 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4e0 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-29 04:50:37 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-19 Account Name: LOCAL SERVICE Account Domain: NT AUTHORITY Logon ID: 0x3e5 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4e0 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-29 04:50:37 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4e0 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-29 04:50:37 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4e0 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-29 04:50:37 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4e0 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-29 04:50:37 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4e0 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-29 04:50:37 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4e0 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-29 04:50:37 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4e0 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12548 | 2025-11-29 04:50:37 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-29 04:50:37 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-20 Account Name: NETWORK SERVICE Account Domain: NT AUTHORITY Logon ID: 0x3e4 Privileges: SeAssignPrimaryTokenPrivilege SeAuditPrivilege SeImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-29 04:50:37 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-29 04:50:37 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-90-0-1 Account Name: DWM-1 Account Domain: Window Manager Logon ID: 0x16014 Privileges: SeAssignPrimaryTokenPrivilege SeAuditPrivilege SeImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-29 04:50:37 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-90-0-1 Account Name: DWM-1 Account Domain: Window Manager Logon ID: 0x16064 Privileges: SeAssignPrimaryTokenPrivilege SeAuditPrivilege
|
| | Security | Audit Success | 12548 | 2025-11-29 04:50:37 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-29 04:50:37 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-29 04:50:37 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-29 04:50:37 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-19 Account Name: LOCAL SERVICE Account Domain: NT AUTHORITY Logon ID: 0x3e5 Privileges: SeAssignPrimaryTokenPrivilege SeAuditPrivilege SeImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-29 04:50:37 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-29 04:50:37 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-29 04:50:37 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-29 04:50:37 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-29 04:50:37 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-29 04:50:37 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12292 | 2025-11-29 04:50:38 | | Microsoft-Windows-Security-Auditing | 5033: The Windows Firewall Driver started successfully.
|
| | Security | Audit Success | 12544 | 2025-11-29 04:50:38 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4e0 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-29 04:50:38 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4e0 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-29 04:50:38 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4e0 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-29 04:50:38 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4e0 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-29 04:50:38 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4e0 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-29 04:50:38 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4e0 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-29 04:50:38 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4e0 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-29 04:50:38 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4e0 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-29 04:50:38 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4e0 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-29 04:50:38 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4e0 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-29 04:50:38 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4e0 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-29 04:50:38 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4e0 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-29 04:50:38 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4e0 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-29 04:50:38 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4e0 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-29 04:50:38 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4e0 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-29 04:50:38 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4e0 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12548 | 2025-11-29 04:50:38 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-29 04:50:38 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-29 04:50:38 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-29 04:50:38 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-29 04:50:38 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-29 04:50:38 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-29 04:50:38 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-29 04:50:38 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-29 04:50:38 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-29 04:50:38 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-29 04:50:38 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-29 04:50:38 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-29 04:50:38 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-29 04:50:38 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-29 04:50:38 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-29 04:50:38 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 13826 | 2025-11-29 04:50:38 | | Microsoft-Windows-Security-Auditing | 4799: A security-enabled local group membership was enumerated. Subject: Security ID: S-1-5-20 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e4 Group: Security ID: S-1-5-32-544 Group Name: Administrators Group Domain: Builtin Process Information: Process ID: 0x72c Process Name: C:\Windows\System32\svchost.exe
|
| | Security | Audit Success | 13826 | 2025-11-29 04:50:38 | | Microsoft-Windows-Security-Auditing | 4799: A security-enabled local group membership was enumerated. Subject: Security ID: S-1-5-20 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e4 Group: Security ID: S-1-5-32-551 Group Name: Backup Operators Group Domain: Builtin Process Information: Process ID: 0x72c Process Name: C:\Windows\System32\svchost.exe
|
| | Security | Audit Success | 13824 | 2025-11-29 04:50:39 | | Microsoft-Windows-Security-Auditing | 4798: A user's local group membership was enumerated. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 User: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Process Information: Process ID: 0x6bc Process Name: C:\Windows\System32\LogonUI.exe
|
| | Security | Audit Success | 12288 | 2025-11-29 04:51:18 | | Microsoft-Windows-Security-Auditing | 4616: The system time was changed. Subject: Security ID: S-1-5-19 Account Name: LOCAL SERVICE Account Domain: NT AUTHORITY Logon ID: 0x3e5 Process Information: Process ID: 0x133c Name: C:\Windows\System32\svchost.exe Previous Time: 2025-11-29T12:50:39.9475827Z New Time: 2025-11-29T12:51:18.8449315Z This event is generated when the system time is changed. It is normal for the Windows Time Service, which runs with System privilege, to change the system time on a regular basis. Other system time changes may be indicative of attempts to tamper with the computer.
|
| | Security | Audit Success | 12288 | 2025-11-29 04:51:18 | | Microsoft-Windows-Security-Auditing | 4616: The system time was changed. Subject: Security ID: S-1-5-19 Account Name: LOCAL SERVICE Account Domain: NT AUTHORITY Logon ID: 0x3e5 Process Information: Process ID: 0x133c Name: C:\Windows\System32\svchost.exe Previous Time: 2025-11-29T12:51:18.8449315Z New Time: 2025-11-29T12:51:18.8454236Z This event is generated when the system time is changed. It is normal for the Windows Time Service, which runs with System privilege, to change the system time on a regular basis. Other system time changes may be indicative of attempts to tamper with the computer.
|
| | Security | Audit Success | 12292 | 2025-11-29 04:51:19 | | Microsoft-Windows-Security-Auditing | 5024: The Windows Firewall service started successfully.
|
| | Security | Audit Success | 12544 | 2025-11-29 04:51:19 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4e0 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-29 04:51:19 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4e0 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-29 04:51:19 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4e0 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-29 04:51:19 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4e0 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12548 | 2025-11-29 04:51:19 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-29 04:51:19 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-29 04:51:19 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-29 04:51:19 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12288 | 2025-11-29 04:51:20 | | Microsoft-Windows-Security-Auditing | 4616: The system time was changed. Subject: Security ID: S-1-5-19 Account Name: LOCAL SERVICE Account Domain: NT AUTHORITY Logon ID: 0x3e5 Process Information: Process ID: 0x133c Name: C:\Windows\System32\svchost.exe Previous Time: 2025-11-29T12:51:20.3556240Z New Time: 2025-11-29T12:51:20.3583846Z This event is generated when the system time is changed. It is normal for the Windows Time Service, which runs with System privilege, to change the system time on a regular basis. Other system time changes may be indicative of attempts to tamper with the computer.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:51:25 | | Microsoft-Windows-Security-Auditing | 4798: A user's local group membership was enumerated. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 User: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Process Information: Process ID: 0x538 Process Name: C:\Windows\System32\lsass.exe
|
| | Security | Audit Success | 12290 | 2025-11-29 04:51:26 | | Microsoft-Windows-Security-Auditing | 5061: Cryptographic operation. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x58683 Cryptographic Parameters: Provider Name: Microsoft Software Key Storage Provider Algorithm Name: ECDSA_P256 Key Name: Microsoft Connected Devices Platform device certificate Key Type: %%2500 Cryptographic Operation: Operation: %%2480 Return Code: 0x0
|
| | Security | Audit Success | 12290 | 2025-11-29 04:51:26 | | Microsoft-Windows-Security-Auditing | 5061: Cryptographic operation. Subject: Security ID: S-1-5-19 Account Name: LOCAL SERVICE Account Domain: NT AUTHORITY Logon ID: 0x3e5 Cryptographic Parameters: Provider Name: Microsoft Software Key Storage Provider Algorithm Name: ECDSA_P256 Key Name: Microsoft Connected Devices Platform device certificate Key Type: %%2500 Cryptographic Operation: Operation: %%2480 Return Code: 0x0
|
| | Security | Audit Success | 12292 | 2025-11-29 04:51:26 | | Microsoft-Windows-Security-Auditing | 5058: Key file operation. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x58683 Process Information: Process ID: 2444 Process Creation Time: 2025-11-29T12:51:26.3441327Z Cryptographic Parameters: Provider Name: Microsoft Software Key Storage Provider Algorithm Name: UNKNOWN Key Name: Microsoft Connected Devices Platform device certificate Key Type: %%2500 Key File Operation Information: File Path: C:\Users\CogiArt\AppData\Roaming\Microsoft\Crypto\Keys\de7cf8a7901d2ad13e5c67c29e5d1662_9ee7012e-fa60-42be-b8b4-8dc8b4e1280d Operation: %%2458 Return Code: 0x0
|
| | Security | Audit Success | 12292 | 2025-11-29 04:51:26 | | Microsoft-Windows-Security-Auditing | 5059: Key migration operation. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x58683 Process Information: Process ID: 2444 Process Creation Time: 2025-11-29T12:51:26.3441327Z Cryptographic Parameters: Provider Name: Microsoft Software Key Storage Provider Algorithm Name: ECDSA_P256 Key Name: Microsoft Connected Devices Platform device certificate Key Type: %%2500 Additional Information: Operation: %%2464 Return Code: 0x0
|
| | Security | Audit Success | 12292 | 2025-11-29 04:51:26 | | Microsoft-Windows-Security-Auditing | 5058: Key file operation. Subject: Security ID: S-1-5-19 Account Name: LOCAL SERVICE Account Domain: NT AUTHORITY Logon ID: 0x3e5 Process Information: Process ID: 6552 Process Creation Time: 2025-11-29T12:51:26.6984361Z Cryptographic Parameters: Provider Name: Microsoft Software Key Storage Provider Algorithm Name: UNKNOWN Key Name: Microsoft Connected Devices Platform device certificate Key Type: %%2500 Key File Operation Information: File Path: C:\WINDOWS\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Crypto\Keys\de7cf8a7901d2ad13e5c67c29e5d1662_9ee7012e-fa60-42be-b8b4-8dc8b4e1280d Operation: %%2458 Return Code: 0x0
|
| | Security | Audit Success | 12292 | 2025-11-29 04:51:26 | | Microsoft-Windows-Security-Auditing | 5059: Key migration operation. Subject: Security ID: S-1-5-19 Account Name: LOCAL SERVICE Account Domain: NT AUTHORITY Logon ID: 0x3e5 Process Information: Process ID: 6552 Process Creation Time: 2025-11-29T12:51:26.6984361Z Cryptographic Parameters: Provider Name: Microsoft Software Key Storage Provider Algorithm Name: ECDSA_P256 Key Name: Microsoft Connected Devices Platform device certificate Key Type: %%2500 Additional Information: Operation: %%2464 Return Code: 0x0
|
| | Security | Audit Success | 12544 | 2025-11-29 04:51:26 | | Microsoft-Windows-Security-Auditing | 4648: A logon was attempted using explicit credentials. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon GUID: {00000000-0000-0000-0000-000000000000} Account Whose Credentials Were Used: Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon GUID: {00000000-0000-0000-0000-000000000000} Target Server: Target Server Name: localhost Additional Information: localhost Process Information: Process ID: 0x8f0 Process Name: C:\Windows\System32\svchost.exe Network Information: Network Address: 127.0.0.1 Port: 0 This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
|
| | Security | Audit Success | 12544 | 2025-11-29 04:51:26 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 2 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x5864a Linked Logon ID: 0x58683 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x8f0 Process Name: C:\Windows\System32\svchost.exe Network Information: Workstation Name: DESKTOP-0JV7HJV Source Network Address: 127.0.0.1 Source Port: 0 Detailed Authentication Information: Logon Process: User32 Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-29 04:51:26 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 2 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1843 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x58683 Linked Logon ID: 0x5864a Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x8f0 Process Name: C:\Windows\System32\svchost.exe Network Information: Workstation Name: DESKTOP-0JV7HJV Source Network Address: 127.0.0.1 Source Port: 0 Detailed Authentication Information: Logon Process: User32 Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-29 04:51:26 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4e0 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-29 04:51:26 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4e0 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-29 04:51:26 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4e0 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12548 | 2025-11-29 04:51:26 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x5864a Privileges: SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-29 04:51:26 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-29 04:51:26 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-29 04:51:26 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 13826 | 2025-11-29 04:51:26 | | Microsoft-Windows-Security-Auditing | 4799: A security-enabled local group membership was enumerated. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Group: Security ID: S-1-5-32-544 Group Name: Administrators Group Domain: Builtin Process Information: Process ID: 0x83c Process Name: C:\Windows\System32\svchost.exe
|
| | Security | Audit Success | 13826 | 2025-11-29 04:51:26 | | Microsoft-Windows-Security-Auditing | 4799: A security-enabled local group membership was enumerated. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Group: Security ID: S-1-5-32-544 Group Name: Administrators Group Domain: Builtin Process Information: Process ID: 0x1064 Process Name: C:\Windows\System32\svchost.exe
|
| | Security | Audit Success | 13826 | 2025-11-29 04:51:26 | | Microsoft-Windows-Security-Auditing | 4799: A security-enabled local group membership was enumerated. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Group: Security ID: S-1-5-32-551 Group Name: Backup Operators Group Domain: Builtin Process Information: Process ID: 0x1064 Process Name: C:\Windows\System32\svchost.exe
|
| | Security | Audit Success | 12544 | 2025-11-29 04:51:28 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4e0 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12548 | 2025-11-29 04:51:28 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 13824 | 2025-11-29 04:51:28 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:51:28 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:51:28 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:51:28 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x58683 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:51:28 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x58683 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:51:28 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x58683 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 12290 | 2025-11-29 04:51:29 | | Microsoft-Windows-Security-Auditing | 5061: Cryptographic operation. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Cryptographic Parameters: Provider Name: Microsoft Software Key Storage Provider Algorithm Name: RSA Key Name: f8df15d9-56fa-0cb3-682b-838ed74af121 Key Type: %%2500 Cryptographic Operation: Operation: %%2480 Return Code: 0x0
|
| | Security | Audit Success | 12290 | 2025-11-29 04:51:29 | | Microsoft-Windows-Security-Auditing | 5061: Cryptographic operation. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Cryptographic Parameters: Provider Name: Microsoft Software Key Storage Provider Algorithm Name: RSA Key Name: f8df15d9-56fa-0cb3-682b-838ed74af121 Key Type: %%2500 Cryptographic Operation: Operation: %%2480 Return Code: 0x0
|
| | Security | Audit Success | 12292 | 2025-11-29 04:51:29 | | Microsoft-Windows-Security-Auditing | 5058: Key file operation. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Process Information: Process ID: 7876 Process Creation Time: 2025-11-29T12:51:28.4918435Z Cryptographic Parameters: Provider Name: Microsoft Software Key Storage Provider Algorithm Name: UNKNOWN Key Name: f8df15d9-56fa-0cb3-682b-838ed74af121 Key Type: %%2500 Key File Operation Information: File Path: C:\ProgramData\Microsoft\Crypto\SystemKeys\8bb43a3e92c2eb4c420c9abd6e278936_9ee7012e-fa60-42be-b8b4-8dc8b4e1280d Operation: %%2458 Return Code: 0x0
|
| | Security | Audit Success | 12292 | 2025-11-29 04:51:29 | | Microsoft-Windows-Security-Auditing | 5058: Key file operation. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Process Information: Process ID: 7876 Process Creation Time: 2025-11-29T12:51:28.4918435Z Cryptographic Parameters: Provider Name: Microsoft Software Key Storage Provider Algorithm Name: UNKNOWN Key Name: f8df15d9-56fa-0cb3-682b-838ed74af121 Key Type: %%2500 Key File Operation Information: File Path: C:\ProgramData\Microsoft\Crypto\SystemKeys\8bb43a3e92c2eb4c420c9abd6e278936_9ee7012e-fa60-42be-b8b4-8dc8b4e1280d Operation: %%2458 Return Code: 0x0
|
| | Security | Audit Success | 12544 | 2025-11-29 04:51:29 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4e0 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12548 | 2025-11-29 04:51:29 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 13824 | 2025-11-29 04:51:29 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x58683 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:51:29 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x58683 Read Operation: %%8099 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:51:29 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x58683 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:51:29 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x58683 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:51:29 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x58683 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:51:29 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x58683 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:51:29 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x58683 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:51:29 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x58683 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:51:29 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x58683 Read Operation: %%8099 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:51:29 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x58683 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:51:29 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x58683 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:51:29 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x58683 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 12544 | 2025-11-29 04:51:31 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4e0 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-29 04:51:31 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4e0 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12548 | 2025-11-29 04:51:31 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-29 04:51:31 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 13824 | 2025-11-29 04:51:31 | | Microsoft-Windows-Security-Auditing | 4798: A user's local group membership was enumerated. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x5864a User: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Process Information: Process ID: 0x1a6c Process Name: C:\Program Files\AMD\CIM\Bin64\InstallManagerApp.exe
|
| | Security | Audit Success | 13826 | 2025-11-29 04:51:31 | | Microsoft-Windows-Security-Auditing | 4799: A security-enabled local group membership was enumerated. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Group: Security ID: S-1-5-32-544 Group Name: Administrators Group Domain: Builtin Process Information: Process ID: 0x204c Process Name: C:\Windows\System32\SearchIndexer.exe
|
| | Security | Audit Success | 13826 | 2025-11-29 04:51:31 | | Microsoft-Windows-Security-Auditing | 4799: A security-enabled local group membership was enumerated. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Group: Security ID: S-1-5-32-551 Group Name: Backup Operators Group Domain: Builtin Process Information: Process ID: 0x204c Process Name: C:\Windows\System32\SearchIndexer.exe
|
| | Security | Audit Success | 12544 | 2025-11-29 04:51:36 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4e0 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12548 | 2025-11-29 04:51:36 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12544 | 2025-11-29 04:51:37 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4e0 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12548 | 2025-11-29 04:51:37 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12288 | 2025-11-29 04:51:38 | | Microsoft-Windows-Security-Auditing | 4616: The system time was changed. Subject: Security ID: S-1-5-19 Account Name: LOCAL SERVICE Account Domain: NT AUTHORITY Logon ID: 0x3e5 Process Information: Process ID: 0x29f8 Name: C:\Windows\System32\svchost.exe Previous Time: 2025-11-29T12:51:38.7350868Z New Time: 2025-11-29T12:51:38.7354933Z This event is generated when the system time is changed. It is normal for the Windows Time Service, which runs with System privilege, to change the system time on a regular basis. Other system time changes may be indicative of attempts to tamper with the computer.
|
| | Security | Audit Success | 12544 | 2025-11-29 04:51:41 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4e0 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12548 | 2025-11-29 04:51:41 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 13824 | 2025-11-29 04:51:41 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x58683 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:51:42 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x58683 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 12544 | 2025-11-29 04:51:43 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4e0 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12548 | 2025-11-29 04:51:43 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 13826 | 2025-11-29 04:51:45 | | Microsoft-Windows-Security-Auditing | 4799: A security-enabled local group membership was enumerated. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Group: Security ID: S-1-5-32-544 Group Name: Administrators Group Domain: Builtin Process Information: Process ID: 0x2b40 Process Name: C:\Windows\System32\svchost.exe
|
| | Security | Audit Success | 13826 | 2025-11-29 04:51:45 | | Microsoft-Windows-Security-Auditing | 4799: A security-enabled local group membership was enumerated. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Group: Security ID: S-1-5-32-551 Group Name: Backup Operators Group Domain: Builtin Process Information: Process ID: 0x2b40 Process Name: C:\Windows\System32\svchost.exe
|
| | Security | Audit Success | 12544 | 2025-11-29 04:51:46 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4e0 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12548 | 2025-11-29 04:51:46 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12544 | 2025-11-29 04:51:47 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4e0 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-29 04:51:47 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4e0 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12548 | 2025-11-29 04:51:47 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-29 04:51:47 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12544 | 2025-11-29 04:51:48 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4e0 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12548 | 2025-11-29 04:51:48 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12544 | 2025-11-29 04:51:49 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4e0 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12548 | 2025-11-29 04:51:49 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 13824 | 2025-11-29 04:51:51 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x58683 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:51:51 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x58683 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:51:51 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x58683 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:51:51 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x58683 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 12544 | 2025-11-29 04:51:59 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4e0 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12548 | 2025-11-29 04:51:59 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12544 | 2025-11-29 04:52:01 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4e0 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12548 | 2025-11-29 04:52:01 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 13824 | 2025-11-29 04:52:14 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x58683 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:52:14 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x58683 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:52:14 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x58683 Read Operation: %%8099 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:52:14 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x58683 Read Operation: %%8099 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:52:14 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x58683 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:52:14 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x58683 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:52:19 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x58683 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:52:19 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x58683 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:52:19 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x58683 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 04:52:19 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x58683 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 12544 | 2025-11-29 04:53:19 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4e0 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-29 04:53:19 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4e0 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12548 | 2025-11-29 04:53:19 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-29 04:53:19 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12544 | 2025-11-29 04:53:52 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4e0 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12548 | 2025-11-29 04:53:52 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12544 | 2025-11-29 04:55:22 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4e0 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12548 | 2025-11-29 04:55:22 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12544 | 2025-11-29 04:56:27 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4e0 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12548 | 2025-11-29 04:56:27 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12544 | 2025-11-29 04:59:35 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4e0 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12548 | 2025-11-29 04:59:35 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12544 | 2025-11-29 05:01:08 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4e0 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12548 | 2025-11-29 05:01:08 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12544 | 2025-11-29 05:01:09 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4e0 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12548 | 2025-11-29 05:01:09 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12544 | 2025-11-29 05:01:30 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4e0 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-29 05:01:30 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4e0 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12548 | 2025-11-29 05:01:30 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-29 05:01:30 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 13826 | 2025-11-29 05:01:30 | | Microsoft-Windows-Security-Auditing | 4799: A security-enabled local group membership was enumerated. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Group: Security ID: S-1-5-32-544 Group Name: Administrators Group Domain: Builtin Process Information: Process ID: 0x3144 Process Name: C:\Windows\System32\VSSVC.exe
|
| | Security | Audit Success | 13826 | 2025-11-29 05:01:30 | | Microsoft-Windows-Security-Auditing | 4799: A security-enabled local group membership was enumerated. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Group: Security ID: S-1-5-32-551 Group Name: Backup Operators Group Domain: Builtin Process Information: Process ID: 0x3144 Process Name: C:\Windows\System32\VSSVC.exe
|
| | Security | Audit Success | 13826 | 2025-11-29 05:01:30 | | Microsoft-Windows-Security-Auditing | 4799: A security-enabled local group membership was enumerated. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Group: Security ID: S-1-5-32-544 Group Name: Administrators Group Domain: Builtin Process Information: Process ID: 0x3144 Process Name: C:\Windows\System32\VSSVC.exe
|
| | Security | Audit Success | 13826 | 2025-11-29 05:01:30 | | Microsoft-Windows-Security-Auditing | 4799: A security-enabled local group membership was enumerated. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Group: Security ID: S-1-5-32-551 Group Name: Backup Operators Group Domain: Builtin Process Information: Process ID: 0x3144 Process Name: C:\Windows\System32\VSSVC.exe
|
| | Security | Audit Success | 13826 | 2025-11-29 05:01:30 | | Microsoft-Windows-Security-Auditing | 4799: A security-enabled local group membership was enumerated. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Group: Security ID: S-1-5-32-544 Group Name: Administrators Group Domain: Builtin Process Information: Process ID: 0x3144 Process Name: C:\Windows\System32\VSSVC.exe
|
| | Security | Audit Success | 13826 | 2025-11-29 05:01:30 | | Microsoft-Windows-Security-Auditing | 4799: A security-enabled local group membership was enumerated. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Group: Security ID: S-1-5-32-551 Group Name: Backup Operators Group Domain: Builtin Process Information: Process ID: 0x3144 Process Name: C:\Windows\System32\VSSVC.exe
|
| | Security | Audit Success | 13826 | 2025-11-29 05:01:30 | | Microsoft-Windows-Security-Auditing | 4799: A security-enabled local group membership was enumerated. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Group: Security ID: S-1-5-32-544 Group Name: Administrators Group Domain: Builtin Process Information: Process ID: 0x3144 Process Name: C:\Windows\System32\VSSVC.exe
|
| | Security | Audit Success | 13826 | 2025-11-29 05:01:30 | | Microsoft-Windows-Security-Auditing | 4799: A security-enabled local group membership was enumerated. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Group: Security ID: S-1-5-32-551 Group Name: Backup Operators Group Domain: Builtin Process Information: Process ID: 0x3144 Process Name: C:\Windows\System32\VSSVC.exe
|
| | Security | Audit Success | 12544 | 2025-11-29 05:05:38 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4e0 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12548 | 2025-11-29 05:05:38 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12544 | 2025-11-29 05:06:27 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4e0 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-29 05:06:27 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4e0 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12548 | 2025-11-29 05:06:27 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-29 05:06:27 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12544 | 2025-11-29 05:07:30 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4e0 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12548 | 2025-11-29 05:07:30 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12544 | 2025-11-29 05:07:59 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4e0 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12548 | 2025-11-29 05:07:59 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 13824 | 2025-11-29 05:07:59 | | Microsoft-Windows-Security-Auditing | 4798: A user's local group membership was enumerated. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 User: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Process Information: Process ID: 0x1524 Process Name: C:\Windows\System32\LogonUI.exe
|
| | Security | Audit Success | 12544 | 2025-11-29 07:35:14 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4e0 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-29 07:35:14 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4e0 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12548 | 2025-11-29 07:35:14 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-29 07:35:14 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12544 | 2025-11-29 07:35:19 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4e0 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 13312 | 2025-11-29 07:35:48 | | Microsoft-Windows-Security-Auditing | 4688: A new process has been created. Creator Subject: Security ID: S-1-5-18 Account Name: - Account Domain: - Logon ID: 0x3e7 Target Subject: Security ID: S-1-0-0 Account Name: - Account Domain: - Logon ID: 0x0 Process Information: New Process ID: 0x170 New Process Name: R Token Elevation Type: %%1936 Mandatory Label: S-1-16-16384 Creator Process ID: 0x4 Creator Process Name: Process Command Line: Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
|
| | Security | Audit Success | 13312 | 2025-11-29 07:35:48 | | Microsoft-Windows-Security-Auditing | 4696: A primary token was assigned to process. Subject: Security ID: S-1-5-18 Account Name: - Account Domain: - Logon ID: 0x3e7 Process Information: Process ID: 0x4 Process Name: Target Process: Target Process ID: 0x170 Target Process Name: Registry New Token Information: Security ID: S-1-0-0 Account Name: - Account Domain: - Logon ID: 0x3e7
|
| | Security | Audit Success | 13312 | 2025-11-29 07:35:48 | | Microsoft-Windows-Security-Auditing | 4688: A new process has been created. Creator Subject: Security ID: S-1-5-18 Account Name: - Account Domain: - Logon ID: 0x3e7 Target Subject: Security ID: S-1-0-0 Account Name: - Account Domain: - Logon ID: 0x0 Process Information: New Process ID: 0x378 New Process Name: C Token Elevation Type: %%1936 Mandatory Label: S-1-16-16384 Creator Process ID: 0x4 Creator Process Name: Process Command Line: Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
|
| | Security | Audit Success | 13573 | 2025-11-29 07:35:48 | | Microsoft-Windows-Security-Auditing | 4826: Boot Configuration Data loaded. Subject: Security ID: S-1-5-18 Account Name: - Account Domain: - Logon ID: 0x3e7 General Settings: Load Options: - Advanced Options: %%1843 Configuration Access Policy: %%1846 System Event Logging: %%1843 Kernel Debugging: %%1843 VSM Launch Type: %%1848 Signature Settings: Test Signing: %%1843 Flight Signing: %%1843 Disable Integrity Checks: %%1843 HyperVisor Settings: HyperVisor Load Options: - HyperVisor Launch Type: %%1848 HyperVisor Debugging: %%1843
|
| | Security | Audit Success | 13312 | 2025-11-29 07:35:49 | | Microsoft-Windows-Security-Auditing | 4688: A new process has been created. Creator Subject: Security ID: S-1-5-18 Account Name: - Account Domain: - Logon ID: 0x3e7 Target Subject: Security ID: S-1-0-0 Account Name: - Account Domain: - Logon ID: 0x0 Process Information: New Process ID: 0x388 New Process Name: C Token Elevation Type: %%1936 Mandatory Label: S-1-16-16384 Creator Process ID: 0x378 Creator Process Name: C Process Command Line: Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
|
| | Security | Audit Success | 13312 | 2025-11-29 07:35:55 | | Microsoft-Windows-Security-Auditing | 4688: A new process has been created. Creator Subject: Security ID: S-1-5-18 Account Name: - Account Domain: - Logon ID: 0x3e7 Target Subject: Security ID: S-1-0-0 Account Name: - Account Domain: - Logon ID: 0x0 Process Information: New Process ID: 0x3f8 New Process Name: C Token Elevation Type: %%1936 Mandatory Label: S-1-16-16384 Creator Process ID: 0x378 Creator Process Name: C Process Command Line: Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
|
| | Security | Audit Success | 13312 | 2025-11-29 07:35:57 | | Microsoft-Windows-Security-Auditing | 4688: A new process has been created. Creator Subject: Security ID: S-1-5-18 Account Name: - Account Domain: - Logon ID: 0x3e7 Target Subject: Security ID: S-1-0-0 Account Name: - Account Domain: - Logon ID: 0x0 Process Information: New Process ID: 0x3b4 New Process Name: C Token Elevation Type: %%1936 Mandatory Label: S-1-16-16384 Creator Process ID: 0x3f8 Creator Process Name: C Process Command Line: Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
|
| | Security | Audit Success | 13312 | 2025-11-29 07:35:59 | | Microsoft-Windows-Security-Auditing | 4688: A new process has been created. Creator Subject: Security ID: S-1-5-18 Account Name: - Account Domain: - Logon ID: 0x3e7 Target Subject: Security ID: S-1-0-0 Account Name: - Account Domain: - Logon ID: 0x0 Process Information: New Process ID: 0x474 New Process Name: C Token Elevation Type: %%1936 Mandatory Label: S-1-16-16384 Creator Process ID: 0x378 Creator Process Name: C Process Command Line: Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
|
| | Security | Audit Success | 13312 | 2025-11-29 07:35:59 | | Microsoft-Windows-Security-Auditing | 4688: A new process has been created. Creator Subject: Security ID: S-1-5-18 Account Name: - Account Domain: - Logon ID: 0x3e7 Target Subject: Security ID: S-1-0-0 Account Name: - Account Domain: - Logon ID: 0x0 Process Information: New Process ID: 0x47c New Process Name: C Token Elevation Type: %%1936 Mandatory Label: S-1-16-16384 Creator Process ID: 0x3f8 Creator Process Name: C Process Command Line: Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
|
| | Security | Audit Success | 13312 | 2025-11-29 07:35:59 | | Microsoft-Windows-Security-Auditing | 4688: A new process has been created. Creator Subject: Security ID: S-1-5-18 Account Name: - Account Domain: - Logon ID: 0x3e7 Target Subject: Security ID: S-1-0-0 Account Name: - Account Domain: - Logon ID: 0x0 Process Information: New Process ID: 0x484 New Process Name: C Token Elevation Type: %%1936 Mandatory Label: S-1-16-16384 Creator Process ID: 0x474 Creator Process Name: C Process Command Line: Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
|
| | Security | Audit Success | 13312 | 2025-11-29 07:35:59 | | Microsoft-Windows-Security-Auditing | 4688: A new process has been created. Creator Subject: Security ID: S-1-5-18 Account Name: - Account Domain: - Logon ID: 0x3e7 Target Subject: Security ID: S-1-0-0 Account Name: - Account Domain: - Logon ID: 0x0 Process Information: New Process ID: 0x4d4 New Process Name: C Token Elevation Type: %%1936 Mandatory Label: S-1-16-16384 Creator Process ID: 0x47c Creator Process Name: C Process Command Line: Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
|
| | Security | Audit Success | 13312 | 2025-11-29 07:35:59 | | Microsoft-Windows-Security-Auditing | 4688: A new process has been created. Creator Subject: Security ID: S-1-5-18 Account Name: - Account Domain: - Logon ID: 0x3e7 Target Subject: Security ID: S-1-0-0 Account Name: - Account Domain: - Logon ID: 0x0 Process Information: New Process ID: 0x4f4 New Process Name: C Token Elevation Type: %%1936 Mandatory Label: S-1-16-16384 Creator Process ID: 0x474 Creator Process Name: C Process Command Line: Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
|
| | Security | Audit Success | 13312 | 2025-11-29 07:35:59 | | Microsoft-Windows-Security-Auditing | 4688: A new process has been created. Creator Subject: Security ID: S-1-5-18 Account Name: - Account Domain: - Logon ID: 0x3e7 Target Subject: Security ID: S-1-0-0 Account Name: - Account Domain: - Logon ID: 0x0 Process Information: New Process ID: 0x514 New Process Name: C Token Elevation Type: %%1936 Mandatory Label: S-1-16-16384 Creator Process ID: 0x47c Creator Process Name: C Process Command Line: Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
|
| | Security | Audit Success | 12288 | 2025-11-29 07:36:00 | | Microsoft-Windows-Security-Auditing | 4608: Windows is starting up. This event is logged when LSASS.EXE starts and the auditing subsystem is initialized.
|
| | Security | Audit Success | 12290 | 2025-11-29 07:36:00 | | Microsoft-Windows-Security-Auditing | 6417: The FIPS mode crypto selftests succeeded. Process ID: 0x514 Process Name: C:\Windows\System32\lsass.exe
|
| | Security | Audit Success | 12544 | 2025-11-29 07:36:00 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-0-0 Account Name: - Account Domain: - Logon ID: 0x0 Logon Information: Logon Type: 0 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: - New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4 Process Name: Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: - Authentication Package: - Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-29 07:36:00 | | Microsoft-Windows-Security-Auditing | 4648: A logon was attempted using explicit credentials. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon GUID: {00000000-0000-0000-0000-000000000000} Account Whose Credentials Were Used: Account Name: UMFD-0 Account Domain: Font Driver Host Logon GUID: {00000000-0000-0000-0000-000000000000} Target Server: Target Server Name: localhost Additional Information: localhost Process Information: Process ID: 0x47c Process Name: C:\Windows\System32\wininit.exe Network Information: Network Address: - Port: - This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
|
| | Security | Audit Success | 12544 | 2025-11-29 07:36:00 | | Microsoft-Windows-Security-Auditing | 4648: A logon was attempted using explicit credentials. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon GUID: {00000000-0000-0000-0000-000000000000} Account Whose Credentials Were Used: Account Name: UMFD-1 Account Domain: Font Driver Host Logon GUID: {00000000-0000-0000-0000-000000000000} Target Server: Target Server Name: localhost Additional Information: localhost Process Information: Process ID: 0x4f4 Process Name: C:\Windows\System32\winlogon.exe Network Information: Network Address: - Port: - This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
|
| | Security | Audit Success | 12544 | 2025-11-29 07:36:00 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4d4 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-29 07:36:00 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 2 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1842 Elevated Token: %%1843 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-96-0-0 Account Name: UMFD-0 Account Domain: Font Driver Host Logon ID: 0xf7e1 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x47c Process Name: C:\Windows\System32\wininit.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-29 07:36:00 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 2 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1842 Elevated Token: %%1843 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-96-0-1 Account Name: UMFD-1 Account Domain: Font Driver Host Logon ID: 0xf7e0 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4f4 Process Name: C:\Windows\System32\winlogon.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-29 07:36:00 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-20 Account Name: NETWORK SERVICE Account Domain: NT AUTHORITY Logon ID: 0x3e4 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4d4 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12548 | 2025-11-29 07:36:00 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-29 07:36:00 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-20 Account Name: NETWORK SERVICE Account Domain: NT AUTHORITY Logon ID: 0x3e4 Privileges: SeAssignPrimaryTokenPrivilege SeAuditPrivilege SeImpersonatePrivilege
|
| | Security | Audit Success | 13568 | 2025-11-29 07:36:00 | | Microsoft-Windows-Security-Auditing | 4902: The Per-user audit policy table was created. Number of Elements: 0 Policy ID: 0xf3a6
|
| | Security | Audit Success | 101 | 2025-11-29 07:36:01 | | Microsoft-Windows-Eventlog | 1101: Audit events have been dropped by the transport. 0
|
| | Security | Audit Success | 12292 | 2025-11-29 07:36:01 | | Microsoft-Windows-Security-Auditing | 5033: The Windows Firewall Driver started successfully.
|
| | Security | Audit Success | 12544 | 2025-11-29 07:36:01 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4d4 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-29 07:36:01 | | Microsoft-Windows-Security-Auditing | 4648: A logon was attempted using explicit credentials. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon GUID: {00000000-0000-0000-0000-000000000000} Account Whose Credentials Were Used: Account Name: DWM-1 Account Domain: Window Manager Logon GUID: {00000000-0000-0000-0000-000000000000} Target Server: Target Server Name: localhost Additional Information: localhost Process Information: Process ID: 0x4f4 Process Name: C:\Windows\System32\winlogon.exe Network Information: Network Address: - Port: - This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
|
| | Security | Audit Success | 12544 | 2025-11-29 07:36:01 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 2 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1842 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-90-0-1 Account Name: DWM-1 Account Domain: Window Manager Logon ID: 0x15e45 Linked Logon ID: 0x15e82 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4f4 Process Name: C:\Windows\System32\winlogon.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-29 07:36:01 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 2 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1842 Elevated Token: %%1843 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-90-0-1 Account Name: DWM-1 Account Domain: Window Manager Logon ID: 0x15e82 Linked Logon ID: 0x15e45 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4f4 Process Name: C:\Windows\System32\winlogon.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-29 07:36:01 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4d4 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-29 07:36:01 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4d4 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-29 07:36:01 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-19 Account Name: LOCAL SERVICE Account Domain: NT AUTHORITY Logon ID: 0x3e5 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4d4 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-29 07:36:01 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4d4 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-29 07:36:01 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4d4 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-29 07:36:01 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4d4 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-29 07:36:01 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4d4 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-29 07:36:01 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4d4 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-29 07:36:01 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4d4 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-29 07:36:01 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4d4 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-29 07:36:01 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4d4 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-29 07:36:01 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4d4 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-29 07:36:01 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4d4 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-29 07:36:01 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4d4 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-29 07:36:01 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4d4 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-29 07:36:01 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4d4 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-29 07:36:01 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4d4 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12548 | 2025-11-29 07:36:01 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-29 07:36:01 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-90-0-1 Account Name: DWM-1 Account Domain: Window Manager Logon ID: 0x15e45 Privileges: SeAssignPrimaryTokenPrivilege SeAuditPrivilege SeImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-29 07:36:01 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-90-0-1 Account Name: DWM-1 Account Domain: Window Manager Logon ID: 0x15e82 Privileges: SeAssignPrimaryTokenPrivilege SeAuditPrivilege
|
| | Security | Audit Success | 12548 | 2025-11-29 07:36:01 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-29 07:36:01 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-29 07:36:01 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-19 Account Name: LOCAL SERVICE Account Domain: NT AUTHORITY Logon ID: 0x3e5 Privileges: SeAssignPrimaryTokenPrivilege SeAuditPrivilege SeImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-29 07:36:01 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-29 07:36:01 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-29 07:36:01 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-29 07:36:01 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-29 07:36:01 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-29 07:36:01 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-29 07:36:01 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-29 07:36:01 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-29 07:36:01 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-29 07:36:01 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-29 07:36:01 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-29 07:36:01 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-29 07:36:01 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-29 07:36:01 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 13826 | 2025-11-29 07:36:01 | | Microsoft-Windows-Security-Auditing | 4799: A security-enabled local group membership was enumerated. Subject: Security ID: S-1-5-20 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e4 Group: Security ID: S-1-5-32-544 Group Name: Administrators Group Domain: Builtin Process Information: Process ID: 0x71c Process Name: C:\Windows\System32\svchost.exe
|
| | Security | Audit Success | 13826 | 2025-11-29 07:36:01 | | Microsoft-Windows-Security-Auditing | 4799: A security-enabled local group membership was enumerated. Subject: Security ID: S-1-5-20 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e4 Group: Security ID: S-1-5-32-551 Group Name: Backup Operators Group Domain: Builtin Process Information: Process ID: 0x71c Process Name: C:\Windows\System32\svchost.exe
|
| | Security | Audit Success | 12544 | 2025-11-29 07:36:02 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4d4 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-29 07:36:02 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4d4 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-29 07:36:02 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4d4 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-29 07:36:02 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4d4 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-29 07:36:02 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4d4 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-29 07:36:02 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4d4 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-29 07:36:02 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4d4 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12548 | 2025-11-29 07:36:02 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-29 07:36:02 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-29 07:36:02 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-29 07:36:02 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-29 07:36:02 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-29 07:36:02 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-29 07:36:02 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12288 | 2025-11-29 09:15:48 | | Microsoft-Windows-Security-Auditing | 4616: The system time was changed. Subject: Security ID: S-1-5-19 Account Name: LOCAL SERVICE Account Domain: NT AUTHORITY Logon ID: 0x3e5 Process Information: Process ID: 0x1244 Name: C:\Windows\System32\svchost.exe Previous Time: 2025-11-29T15:36:03.2849361Z New Time: 2025-11-29T17:15:48.0341578Z This event is generated when the system time is changed. It is normal for the Windows Time Service, which runs with System privilege, to change the system time on a regular basis. Other system time changes may be indicative of attempts to tamper with the computer.
|
| | Security | Audit Success | 12288 | 2025-11-29 09:15:48 | | Microsoft-Windows-Security-Auditing | 4616: The system time was changed. Subject: Security ID: S-1-5-19 Account Name: LOCAL SERVICE Account Domain: NT AUTHORITY Logon ID: 0x3e5 Process Information: Process ID: 0x1244 Name: C:\Windows\System32\svchost.exe Previous Time: 2025-11-29T17:15:48.0341578Z New Time: 2025-11-29T17:15:48.0346686Z This event is generated when the system time is changed. It is normal for the Windows Time Service, which runs with System privilege, to change the system time on a regular basis. Other system time changes may be indicative of attempts to tamper with the computer.
|
| | Security | Audit Success | 12292 | 2025-11-29 09:15:48 | | Microsoft-Windows-Security-Auditing | 5024: The Windows Firewall service started successfully.
|
| | Security | Audit Success | 12544 | 2025-11-29 09:15:48 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4d4 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-29 09:15:48 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4d4 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-29 09:15:48 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4d4 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-29 09:15:48 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4d4 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-29 09:15:48 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4d4 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-29 09:15:48 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4d4 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12548 | 2025-11-29 09:15:48 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-29 09:15:48 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-29 09:15:48 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-29 09:15:48 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-29 09:15:48 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-29 09:15:48 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 13824 | 2025-11-29 09:15:48 | | Microsoft-Windows-Security-Auditing | 4798: A user's local group membership was enumerated. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 User: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Process Information: Process ID: 0x6ac Process Name: C:\Windows\System32\LogonUI.exe
|
| | Security | Audit Success | 13824 | 2025-11-29 09:15:48 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 09:15:48 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 09:15:48 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 09:15:48 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 09:15:48 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 09:15:48 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 12288 | 2025-11-29 09:15:49 | | Microsoft-Windows-Security-Auditing | 4616: The system time was changed. Subject: Security ID: S-1-5-19 Account Name: LOCAL SERVICE Account Domain: NT AUTHORITY Logon ID: 0x3e5 Process Information: Process ID: 0x1244 Name: C:\Windows\System32\svchost.exe Previous Time: 2025-11-29T17:15:49.2467546Z New Time: 2025-11-29T17:15:49.2473520Z This event is generated when the system time is changed. It is normal for the Windows Time Service, which runs with System privilege, to change the system time on a regular basis. Other system time changes may be indicative of attempts to tamper with the computer.
|
| | Security | Audit Success | 12290 | 2025-11-29 09:15:49 | | Microsoft-Windows-Security-Auditing | 5061: Cryptographic operation. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Cryptographic Parameters: Provider Name: Microsoft Software Key Storage Provider Algorithm Name: RSA Key Name: f8df15d9-56fa-0cb3-682b-838ed74af121 Key Type: %%2500 Cryptographic Operation: Operation: %%2480 Return Code: 0x0
|
| | Security | Audit Success | 12290 | 2025-11-29 09:15:49 | | Microsoft-Windows-Security-Auditing | 5061: Cryptographic operation. Subject: Security ID: S-1-5-19 Account Name: LOCAL SERVICE Account Domain: NT AUTHORITY Logon ID: 0x3e5 Cryptographic Parameters: Provider Name: Microsoft Software Key Storage Provider Algorithm Name: ECDSA_P256 Key Name: Microsoft Connected Devices Platform device certificate Key Type: %%2500 Cryptographic Operation: Operation: %%2480 Return Code: 0x0
|
| | Security | Audit Success | 12292 | 2025-11-29 09:15:49 | | Microsoft-Windows-Security-Auditing | 5058: Key file operation. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Process Information: Process ID: 5300 Process Creation Time: 2025-11-29T17:15:48.6262024Z Cryptographic Parameters: Provider Name: Microsoft Software Key Storage Provider Algorithm Name: UNKNOWN Key Name: f8df15d9-56fa-0cb3-682b-838ed74af121 Key Type: %%2500 Key File Operation Information: File Path: C:\ProgramData\Microsoft\Crypto\SystemKeys\8bb43a3e92c2eb4c420c9abd6e278936_9ee7012e-fa60-42be-b8b4-8dc8b4e1280d Operation: %%2458 Return Code: 0x0
|
| | Security | Audit Success | 12292 | 2025-11-29 09:15:49 | | Microsoft-Windows-Security-Auditing | 5058: Key file operation. Subject: Security ID: S-1-5-19 Account Name: LOCAL SERVICE Account Domain: NT AUTHORITY Logon ID: 0x3e5 Process Information: Process ID: 5752 Process Creation Time: 2025-11-29T17:15:49.8741964Z Cryptographic Parameters: Provider Name: Microsoft Software Key Storage Provider Algorithm Name: UNKNOWN Key Name: Microsoft Connected Devices Platform device certificate Key Type: %%2500 Key File Operation Information: File Path: C:\WINDOWS\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Crypto\Keys\de7cf8a7901d2ad13e5c67c29e5d1662_9ee7012e-fa60-42be-b8b4-8dc8b4e1280d Operation: %%2458 Return Code: 0x0
|
| | Security | Audit Success | 12292 | 2025-11-29 09:15:49 | | Microsoft-Windows-Security-Auditing | 5059: Key migration operation. Subject: Security ID: S-1-5-19 Account Name: LOCAL SERVICE Account Domain: NT AUTHORITY Logon ID: 0x3e5 Process Information: Process ID: 5752 Process Creation Time: 2025-11-29T17:15:49.8741964Z Cryptographic Parameters: Provider Name: Microsoft Software Key Storage Provider Algorithm Name: ECDSA_P256 Key Name: Microsoft Connected Devices Platform device certificate Key Type: %%2500 Additional Information: Operation: %%2464 Return Code: 0x0
|
| | Security | Audit Success | 13824 | 2025-11-29 09:15:49 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 09:15:49 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Read Operation: %%8099 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 09:15:49 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 09:15:49 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 09:15:49 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 09:15:49 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 09:15:49 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 09:15:49 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 09:15:49 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 09:15:49 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 09:15:49 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 09:15:49 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 09:15:49 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 09:15:49 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 09:15:49 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 09:15:49 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 09:15:49 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 09:15:49 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 09:15:49 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 09:15:49 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 09:15:49 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 09:15:49 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 09:15:49 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 09:15:49 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 09:15:49 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13826 | 2025-11-29 09:15:50 | | Microsoft-Windows-Security-Auditing | 4799: A security-enabled local group membership was enumerated. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Group: Security ID: S-1-5-32-544 Group Name: Administrators Group Domain: Builtin Process Information: Process ID: 0xb28 Process Name: C:\Windows\System32\svchost.exe
|
| | Security | Audit Success | 13826 | 2025-11-29 09:15:50 | | Microsoft-Windows-Security-Auditing | 4799: A security-enabled local group membership was enumerated. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Group: Security ID: S-1-5-32-551 Group Name: Backup Operators Group Domain: Builtin Process Information: Process ID: 0xb28 Process Name: C:\Windows\System32\svchost.exe
|
| | Security | Audit Success | 12290 | 2025-11-29 09:16:09 | | Microsoft-Windows-Security-Auditing | 5061: Cryptographic operation. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x6033c Cryptographic Parameters: Provider Name: Microsoft Software Key Storage Provider Algorithm Name: ECDSA_P256 Key Name: Microsoft Connected Devices Platform device certificate Key Type: %%2500 Cryptographic Operation: Operation: %%2480 Return Code: 0x0
|
| | Security | Audit Success | 12292 | 2025-11-29 09:16:09 | | Microsoft-Windows-Security-Auditing | 5058: Key file operation. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x6033c Process Information: Process ID: 5660 Process Creation Time: 2025-11-29T17:16:09.4683264Z Cryptographic Parameters: Provider Name: Microsoft Software Key Storage Provider Algorithm Name: UNKNOWN Key Name: Microsoft Connected Devices Platform device certificate Key Type: %%2500 Key File Operation Information: File Path: C:\Users\CogiArt\AppData\Roaming\Microsoft\Crypto\Keys\de7cf8a7901d2ad13e5c67c29e5d1662_9ee7012e-fa60-42be-b8b4-8dc8b4e1280d Operation: %%2458 Return Code: 0x0
|
| | Security | Audit Success | 12292 | 2025-11-29 09:16:09 | | Microsoft-Windows-Security-Auditing | 5059: Key migration operation. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x6033c Process Information: Process ID: 5660 Process Creation Time: 2025-11-29T17:16:09.4683264Z Cryptographic Parameters: Provider Name: Microsoft Software Key Storage Provider Algorithm Name: ECDSA_P256 Key Name: Microsoft Connected Devices Platform device certificate Key Type: %%2500 Additional Information: Operation: %%2464 Return Code: 0x0
|
| | Security | Audit Success | 12544 | 2025-11-29 09:16:09 | | Microsoft-Windows-Security-Auditing | 4648: A logon was attempted using explicit credentials. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon GUID: {00000000-0000-0000-0000-000000000000} Account Whose Credentials Were Used: Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon GUID: {00000000-0000-0000-0000-000000000000} Target Server: Target Server Name: localhost Additional Information: localhost Process Information: Process ID: 0x8b8 Process Name: C:\Windows\System32\svchost.exe Network Information: Network Address: 127.0.0.1 Port: 0 This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
|
| | Security | Audit Success | 12544 | 2025-11-29 09:16:09 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 2 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x602c2 Linked Logon ID: 0x6033c Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x8b8 Process Name: C:\Windows\System32\svchost.exe Network Information: Workstation Name: DESKTOP-0JV7HJV Source Network Address: 127.0.0.1 Source Port: 0 Detailed Authentication Information: Logon Process: User32 Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-29 09:16:09 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 2 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1843 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x6033c Linked Logon ID: 0x602c2 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x8b8 Process Name: C:\Windows\System32\svchost.exe Network Information: Workstation Name: DESKTOP-0JV7HJV Source Network Address: 127.0.0.1 Source Port: 0 Detailed Authentication Information: Logon Process: User32 Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-29 09:16:09 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4d4 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-29 09:16:09 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4d4 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-29 09:16:09 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4d4 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-29 09:16:09 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4d4 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12548 | 2025-11-29 09:16:09 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x602c2 Privileges: SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-29 09:16:09 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-29 09:16:09 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-29 09:16:09 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-29 09:16:09 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 13824 | 2025-11-29 09:16:09 | | Microsoft-Windows-Security-Auditing | 4798: A user's local group membership was enumerated. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 User: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Process Information: Process ID: 0x514 Process Name: C:\Windows\System32\lsass.exe
|
| | Security | Audit Success | 13824 | 2025-11-29 09:16:09 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x6033c Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 09:16:09 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x6033c Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 09:16:09 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x6033c Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13826 | 2025-11-29 09:16:09 | | Microsoft-Windows-Security-Auditing | 4799: A security-enabled local group membership was enumerated. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Group: Security ID: S-1-5-32-544 Group Name: Administrators Group Domain: Builtin Process Information: Process ID: 0x80c Process Name: C:\Windows\System32\svchost.exe
|
| | Security | Audit Success | 12544 | 2025-11-29 09:16:10 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4d4 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-29 09:16:10 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4d4 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12548 | 2025-11-29 09:16:10 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-29 09:16:10 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12544 | 2025-11-29 09:16:11 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4d4 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-29 09:16:11 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4d4 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12548 | 2025-11-29 09:16:11 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-29 09:16:11 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 13824 | 2025-11-29 09:16:11 | | Microsoft-Windows-Security-Auditing | 4798: A user's local group membership was enumerated. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x602c2 User: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Process Information: Process ID: 0x18a0 Process Name: C:\Program Files\AMD\CIM\Bin64\InstallManagerApp.exe
|
| | Security | Audit Success | 13824 | 2025-11-29 09:16:12 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x6033c Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 09:16:12 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x6033c Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 09:16:12 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x6033c Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 09:16:12 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x6033c Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 12544 | 2025-11-29 09:16:14 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4d4 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12548 | 2025-11-29 09:16:14 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12544 | 2025-11-29 09:16:15 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4d4 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12548 | 2025-11-29 09:16:15 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 13826 | 2025-11-29 09:16:15 | | Microsoft-Windows-Security-Auditing | 4799: A security-enabled local group membership was enumerated. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Group: Security ID: S-1-5-32-544 Group Name: Administrators Group Domain: Builtin Process Information: Process ID: 0x7c4 Process Name: C:\Windows\System32\SearchIndexer.exe
|
| | Security | Audit Success | 13826 | 2025-11-29 09:16:15 | | Microsoft-Windows-Security-Auditing | 4799: A security-enabled local group membership was enumerated. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Group: Security ID: S-1-5-32-551 Group Name: Backup Operators Group Domain: Builtin Process Information: Process ID: 0x7c4 Process Name: C:\Windows\System32\SearchIndexer.exe
|
| | Security | Audit Success | 12544 | 2025-11-29 09:16:20 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4d4 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12548 | 2025-11-29 09:16:20 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12544 | 2025-11-29 09:17:11 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4d4 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12548 | 2025-11-29 09:17:11 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12544 | 2025-11-29 09:17:18 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4d4 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12548 | 2025-11-29 09:17:18 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12544 | 2025-11-29 09:17:49 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4d4 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-29 09:17:49 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4d4 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-29 09:17:49 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4d4 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12548 | 2025-11-29 09:17:49 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-29 09:17:49 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-29 09:17:49 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 13824 | 2025-11-29 09:19:34 | | Microsoft-Windows-Security-Auditing | 4797: An attempt was made to query the existence of a blank password for an account. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x6033c Additional Information: Caller Workstation: DESKTOP-0JV7HJV Target Account Name: Administrator Target Account Domain: DESKTOP-0JV7HJV
|
| | Security | Audit Success | 13824 | 2025-11-29 09:19:34 | | Microsoft-Windows-Security-Auditing | 4797: An attempt was made to query the existence of a blank password for an account. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x6033c Additional Information: Caller Workstation: DESKTOP-0JV7HJV Target Account Name: DefaultAccount Target Account Domain: DESKTOP-0JV7HJV
|
| | Security | Audit Success | 13824 | 2025-11-29 09:19:34 | | Microsoft-Windows-Security-Auditing | 4797: An attempt was made to query the existence of a blank password for an account. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x6033c Additional Information: Caller Workstation: DESKTOP-0JV7HJV Target Account Name: Guest Target Account Domain: DESKTOP-0JV7HJV
|
| | Security | Audit Success | 13824 | 2025-11-29 09:19:34 | | Microsoft-Windows-Security-Auditing | 4797: An attempt was made to query the existence of a blank password for an account. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x6033c Additional Information: Caller Workstation: DESKTOP-0JV7HJV Target Account Name: WDAGUtilityAccount Target Account Domain: DESKTOP-0JV7HJV
|
| | Security | Audit Success | 12544 | 2025-11-29 09:21:10 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4d4 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12548 | 2025-11-29 09:21:10 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12544 | 2025-11-29 09:21:49 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4d4 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-29 09:21:49 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4d4 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12548 | 2025-11-29 09:21:49 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-29 09:21:49 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12544 | 2025-11-29 09:22:12 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4d4 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12548 | 2025-11-29 09:22:12 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12544 | 2025-11-29 09:22:13 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4d4 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12548 | 2025-11-29 09:22:13 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12544 | 2025-11-29 09:22:21 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4d4 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12548 | 2025-11-29 09:22:21 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12544 | 2025-11-29 09:22:26 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4d4 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12548 | 2025-11-29 09:22:26 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 13824 | 2025-11-29 09:22:44 | | Microsoft-Windows-Security-Auditing | 4798: A user's local group membership was enumerated. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x6033c User: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Process Information: Process ID: 0xa34 Process Name: C:\Users\CogiArt\Downloads\PortableApps.com_Platform_Setup_30.1.3.paf.exe
|
| | Security | Audit Success | 12544 | 2025-11-29 09:22:59 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4d4 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12548 | 2025-11-29 09:22:59 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12544 | 2025-11-29 09:23:17 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4d4 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12548 | 2025-11-29 09:23:17 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 13568 | 2025-11-29 09:23:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Package_for_ServicingStack_7010~31bf3856ad364e35~amd64~~26100.7010.1.8.cat Handle ID: 0x484 Process Information: Process ID: 0x1828 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.5074_none_a5532eb7772ad4c4\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:23:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Package_for_ServicingStack_7010~31bf3856ad364e35~amd64~~26100.7010.1.8.mum Handle ID: 0x484 Process Information: Process ID: 0x1828 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.5074_none_a5532eb7772ad4c4\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:23:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Wrapper-BCCA70B0C08A7AB647A7B2EA71761E15AD6D0520E0D6EC47873B0F645EA82D60~31bf3856ad364e35~amd64~~10.0.26100.7010.cat Handle ID: 0x774 Process Information: Process ID: 0x1828 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.5074_none_a5532eb7772ad4c4\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:23:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Wrapper-BCCA70B0C08A7AB647A7B2EA71761E15AD6D0520E0D6EC47873B0F645EA82D60~31bf3856ad364e35~amd64~~10.0.26100.7010.mum Handle ID: 0x774 Process Information: Process ID: 0x1828 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.5074_none_a5532eb7772ad4c4\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:23:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Shared-C96391D8C1EC2830A050B58DD4D67986A7CFF6A951051505C179DAA7C19FAC17~31bf3856ad364e35~amd64~~10.0.26100.7010.cat Handle ID: 0x774 Process Information: Process ID: 0x1828 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.5074_none_a5532eb7772ad4c4\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:23:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Shared-C96391D8C1EC2830A050B58DD4D67986A7CFF6A951051505C179DAA7C19FAC17~31bf3856ad364e35~amd64~~10.0.26100.7010.mum Handle ID: 0x38c Process Information: Process ID: 0x1828 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.5074_none_a5532eb7772ad4c4\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 12544 | 2025-11-29 09:23:50 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4d4 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12548 | 2025-11-29 09:23:50 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 13826 | 2025-11-29 09:23:55 | | Microsoft-Windows-Security-Auditing | 4799: A security-enabled local group membership was enumerated. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Group: Security ID: S-1-5-32-544 Group Name: Administrators Group Domain: Builtin Process Information: Process ID: 0xb34 Process Name: C:\Windows\System32\svchost.exe
|
| | Security | Audit Success | 13826 | 2025-11-29 09:23:55 | | Microsoft-Windows-Security-Auditing | 4799: A security-enabled local group membership was enumerated. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Group: Security ID: S-1-5-32-551 Group Name: Backup Operators Group Domain: Builtin Process Information: Process ID: 0xb34 Process Name: C:\Windows\System32\svchost.exe
|
| | Security | Audit Success | 12544 | 2025-11-29 09:24:02 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4d4 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12548 | 2025-11-29 09:24:02 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12544 | 2025-11-29 09:24:03 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4d4 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12548 | 2025-11-29 09:24:03 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 13824 | 2025-11-29 09:24:03 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 09:24:03 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 09:24:03 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 09:24:03 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 09:24:03 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 09:24:03 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 09:24:03 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x6033c Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 09:24:03 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x6033c Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 09:24:03 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x6033c Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 09:24:03 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 09:24:03 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 09:24:03 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 09:24:03 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 12544 | 2025-11-29 09:24:53 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4d4 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12548 | 2025-11-29 09:24:53 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12544 | 2025-11-29 09:25:20 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4d4 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-29 09:25:20 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4d4 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12548 | 2025-11-29 09:25:20 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-29 09:25:20 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12544 | 2025-11-29 09:25:55 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4d4 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12548 | 2025-11-29 09:25:55 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12544 | 2025-11-29 09:26:09 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4d4 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12548 | 2025-11-29 09:26:09 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12544 | 2025-11-29 09:26:14 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4d4 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12548 | 2025-11-29 09:26:14 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12544 | 2025-11-29 09:26:15 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4d4 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12548 | 2025-11-29 09:26:15 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12544 | 2025-11-29 09:26:26 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4d4 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12548 | 2025-11-29 09:26:26 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 13568 | 2025-11-29 09:26:58 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Package_for_DotNetRollup_481~31bf3856ad364e35~amd64~~10.0.9321.3.cat Handle ID: 0x2160 Process Information: Process ID: 0x1828 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.5074_none_a5532eb7772ad4c4\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:26:58 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Package_for_DotNetRollup_481~31bf3856ad364e35~amd64~~10.0.9321.3.mum Handle ID: 0x1f8c Process Information: Process ID: 0x1828 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.5074_none_a5532eb7772ad4c4\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:26:58 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Package_2_for_KB5066128~31bf3856ad364e35~amd64~~10.0.9321.3.cat Handle ID: 0x1f8c Process Information: Process ID: 0x1828 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.5074_none_a5532eb7772ad4c4\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:26:58 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Package_2_for_KB5066128~31bf3856ad364e35~amd64~~10.0.9321.3.mum Handle ID: 0x1f8c Process Information: Process ID: 0x1828 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.5074_none_a5532eb7772ad4c4\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:26:58 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Package_3_for_KB5066128~31bf3856ad364e35~amd64~~10.0.9321.3.cat Handle ID: 0x1f8c Process Information: Process ID: 0x1828 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.5074_none_a5532eb7772ad4c4\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:26:58 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Package_3_for_KB5066128~31bf3856ad364e35~amd64~~10.0.9321.3.mum Handle ID: 0x1f8c Process Information: Process ID: 0x1828 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.5074_none_a5532eb7772ad4c4\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:26:58 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Package_4_for_KB5066128~31bf3856ad364e35~amd64~~10.0.9321.3.cat Handle ID: 0x1d68 Process Information: Process ID: 0x1828 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.5074_none_a5532eb7772ad4c4\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:26:58 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Package_4_for_KB5066128~31bf3856ad364e35~amd64~~10.0.9321.3.mum Handle ID: 0x1f2c Process Information: Process ID: 0x1828 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.5074_none_a5532eb7772ad4c4\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:26:58 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Package_5_for_KB5066128~31bf3856ad364e35~amd64~~10.0.9321.3.cat Handle ID: 0x2004 Process Information: Process ID: 0x1828 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.5074_none_a5532eb7772ad4c4\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:26:58 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Package_5_for_KB5066128~31bf3856ad364e35~amd64~~10.0.9321.3.mum Handle ID: 0x1ee0 Process Information: Process ID: 0x1828 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.5074_none_a5532eb7772ad4c4\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:26:58 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Package_6_for_KB5066128~31bf3856ad364e35~amd64~~10.0.9321.3.cat Handle ID: 0x1c34 Process Information: Process ID: 0x1828 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.5074_none_a5532eb7772ad4c4\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:26:58 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Package_6_for_KB5066128~31bf3856ad364e35~amd64~~10.0.9321.3.mum Handle ID: 0x1f90 Process Information: Process ID: 0x1828 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.5074_none_a5532eb7772ad4c4\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:26:58 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Package_7_for_KB5066128~31bf3856ad364e35~amd64~~10.0.9321.3.cat Handle ID: 0x1db0 Process Information: Process ID: 0x1828 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.5074_none_a5532eb7772ad4c4\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:26:58 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Package_7_for_KB5066128~31bf3856ad364e35~amd64~~10.0.9321.3.mum Handle ID: 0x1db0 Process Information: Process ID: 0x1828 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.5074_none_a5532eb7772ad4c4\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:26:58 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Package_8_for_KB5066128~31bf3856ad364e35~amd64~~10.0.9321.3.cat Handle ID: 0x6cc Process Information: Process ID: 0x1828 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.5074_none_a5532eb7772ad4c4\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:26:58 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Package_8_for_KB5066128~31bf3856ad364e35~amd64~~10.0.9321.3.mum Handle ID: 0x1d3c Process Information: Process ID: 0x1828 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.5074_none_a5532eb7772ad4c4\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:26:58 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Package_9_for_KB5066128~31bf3856ad364e35~amd64~~10.0.9321.3.cat Handle ID: 0x1114 Process Information: Process ID: 0x1828 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.5074_none_a5532eb7772ad4c4\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:26:58 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Package_9_for_KB5066128~31bf3856ad364e35~amd64~~10.0.9321.3.mum Handle ID: 0x1ee0 Process Information: Process ID: 0x1828 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.5074_none_a5532eb7772ad4c4\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:26:58 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Package_10_for_KB5066128~31bf3856ad364e35~amd64~~10.0.9321.3.cat Handle ID: 0x13d0 Process Information: Process ID: 0x1828 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.5074_none_a5532eb7772ad4c4\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:26:58 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Package_10_for_KB5066128~31bf3856ad364e35~amd64~~10.0.9321.3.mum Handle ID: 0x18b0 Process Information: Process ID: 0x1828 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.5074_none_a5532eb7772ad4c4\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:26:59 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Package_11_for_KB5066128~31bf3856ad364e35~amd64~~10.0.9321.3.cat Handle ID: 0x1f8c Process Information: Process ID: 0x1828 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.5074_none_a5532eb7772ad4c4\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:26:59 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Package_11_for_KB5066128~31bf3856ad364e35~amd64~~10.0.9321.3.mum Handle ID: 0x1ee0 Process Information: Process ID: 0x1828 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.5074_none_a5532eb7772ad4c4\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:26:59 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Package_12_for_KB5066128~31bf3856ad364e35~amd64~~10.0.9321.3.cat Handle ID: 0x1ee0 Process Information: Process ID: 0x1828 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.5074_none_a5532eb7772ad4c4\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:26:59 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Package_12_for_KB5066128~31bf3856ad364e35~amd64~~10.0.9321.3.mum Handle ID: 0x1ee0 Process Information: Process ID: 0x1828 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.5074_none_a5532eb7772ad4c4\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:26:59 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Package_13_for_KB5066128~31bf3856ad364e35~amd64~~10.0.9321.3.cat Handle ID: 0x1138 Process Information: Process ID: 0x1828 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.5074_none_a5532eb7772ad4c4\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:26:59 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Package_13_for_KB5066128~31bf3856ad364e35~amd64~~10.0.9321.3.mum Handle ID: 0x18b0 Process Information: Process ID: 0x1828 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.5074_none_a5532eb7772ad4c4\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:26:59 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Package_14_for_KB5066128~31bf3856ad364e35~amd64~~10.0.9321.3.cat Handle ID: 0x1d5c Process Information: Process ID: 0x1828 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.5074_none_a5532eb7772ad4c4\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:26:59 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Package_14_for_KB5066128~31bf3856ad364e35~amd64~~10.0.9321.3.mum Handle ID: 0x1ee0 Process Information: Process ID: 0x1828 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.5074_none_a5532eb7772ad4c4\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:26:59 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Package_15_for_KB5066128~31bf3856ad364e35~amd64~~10.0.9321.3.cat Handle ID: 0x1ee0 Process Information: Process ID: 0x1828 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.5074_none_a5532eb7772ad4c4\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:26:59 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Package_15_for_KB5066128~31bf3856ad364e35~amd64~~10.0.9321.3.mum Handle ID: 0x1ee0 Process Information: Process ID: 0x1828 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.5074_none_a5532eb7772ad4c4\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:26:59 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Package_16_for_KB5066128~31bf3856ad364e35~amd64~~10.0.9321.3.cat Handle ID: 0x1ee0 Process Information: Process ID: 0x1828 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.5074_none_a5532eb7772ad4c4\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:26:59 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Package_16_for_KB5066128~31bf3856ad364e35~amd64~~10.0.9321.3.mum Handle ID: 0x1ee0 Process Information: Process ID: 0x1828 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.5074_none_a5532eb7772ad4c4\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:27:23 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Package_2_for_KB5066128~31bf3856ad364e35~amd64~~10.0.9321.3.cat Handle ID: 0x1624 Process Information: Process ID: 0x1828 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.5074_none_a5532eb7772ad4c4\TiWorker.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:27:23 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Package_3_for_KB5066128~31bf3856ad364e35~amd64~~10.0.9321.3.cat Handle ID: 0x13dc Process Information: Process ID: 0x1828 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.5074_none_a5532eb7772ad4c4\TiWorker.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:27:23 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Package_4_for_KB5066128~31bf3856ad364e35~amd64~~10.0.9321.3.cat Handle ID: 0x2134 Process Information: Process ID: 0x1828 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.5074_none_a5532eb7772ad4c4\TiWorker.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:27:30 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Package_5_for_KB5066128~31bf3856ad364e35~amd64~~10.0.9321.3.cat Handle ID: 0x2288 Process Information: Process ID: 0x1828 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.5074_none_a5532eb7772ad4c4\TiWorker.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:27:30 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Package_6_for_KB5066128~31bf3856ad364e35~amd64~~10.0.9321.3.cat Handle ID: 0x1ea0 Process Information: Process ID: 0x1828 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.5074_none_a5532eb7772ad4c4\TiWorker.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:27:30 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Package_7_for_KB5066128~31bf3856ad364e35~amd64~~10.0.9321.3.cat Handle ID: 0x22d4 Process Information: Process ID: 0x1828 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.5074_none_a5532eb7772ad4c4\TiWorker.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:27:30 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Package_8_for_KB5066128~31bf3856ad364e35~amd64~~10.0.9321.3.cat Handle ID: 0xd6c Process Information: Process ID: 0x1828 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.5074_none_a5532eb7772ad4c4\TiWorker.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:27:30 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Package_9_for_KB5066128~31bf3856ad364e35~amd64~~10.0.9321.3.cat Handle ID: 0x22a8 Process Information: Process ID: 0x1828 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.5074_none_a5532eb7772ad4c4\TiWorker.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:27:30 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Package_12_for_KB5066128~31bf3856ad364e35~amd64~~10.0.9321.3.cat Handle ID: 0x22a4 Process Information: Process ID: 0x1828 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.5074_none_a5532eb7772ad4c4\TiWorker.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:27:30 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Package_13_for_KB5066128~31bf3856ad364e35~amd64~~10.0.9321.3.cat Handle ID: 0x7e8 Process Information: Process ID: 0x1828 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.5074_none_a5532eb7772ad4c4\TiWorker.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:27:30 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Package_14_for_KB5066128~31bf3856ad364e35~amd64~~10.0.9321.3.cat Handle ID: 0x1b44 Process Information: Process ID: 0x1828 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.5074_none_a5532eb7772ad4c4\TiWorker.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:27:30 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Package_15_for_KB5066128~31bf3856ad364e35~amd64~~10.0.9321.3.cat Handle ID: 0x1f8c Process Information: Process ID: 0x1828 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.5074_none_a5532eb7772ad4c4\TiWorker.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:27:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\_0000000000000000.cdf-ms Handle ID: 0x2c44 Process Information: Process ID: 0x1828 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.5074_none_a5532eb7772ad4c4\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:27:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$.cdf-ms Handle ID: 0x2c44 Process Information: Process ID: 0x1828 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.5074_none_a5532eb7772ad4c4\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:27:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_microsoft.net_3296b36dbe4c7fa3.cdf-ms Handle ID: 0x2c44 Process Information: Process ID: 0x1828 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.5074_none_a5532eb7772ad4c4\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:27:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_microsoft.net_framework64_083d4e330e766c5d.cdf-ms Handle ID: 0x2c44 Process Information: Process ID: 0x1828 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.5074_none_a5532eb7772ad4c4\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:27:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_microsoft.net_framework64_v4.0.30319_46321ba736a30085.cdf-ms Handle ID: 0x2c44 Process Information: Process ID: 0x1828 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.5074_none_a5532eb7772ad4c4\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:27:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_microsoft.net_framework_83386eac0379231b.cdf-ms Handle ID: 0x2c44 Process Information: Process ID: 0x1828 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.5074_none_a5532eb7772ad4c4\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:27:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_microsoft.net_framework_v4.0.30319_c40c7a995ddd757b.cdf-ms Handle ID: 0x2c44 Process Information: Process ID: 0x1828 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.5074_none_a5532eb7772ad4c4\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:27:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_microsoft.net_assembly_gac_msil_system_v4.0_4.0.0.0_b77a5c561934e089_4348a29e5981af79.cdf-ms Handle ID: 0x2c44 Process Information: Process ID: 0x1828 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.5074_none_a5532eb7772ad4c4\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:27:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\System.dll Handle ID: 0x2314 Process Information: Process ID: 0x1828 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.5074_none_a5532eb7772ad4c4\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 12544 | 2025-11-29 09:27:43 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4d4 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-29 09:27:43 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4d4 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12548 | 2025-11-29 09:27:43 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-29 09:27:43 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12544 | 2025-11-29 09:27:46 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4d4 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12548 | 2025-11-29 09:27:46 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 13824 | 2025-11-29 09:27:46 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 09:27:46 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 09:27:46 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 09:27:46 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 09:27:46 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 09:27:46 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 09:27:46 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x6033c Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 09:27:46 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x6033c Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 09:27:46 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x6033c Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 09:27:47 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 09:27:47 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 09:27:47 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 09:27:47 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 12544 | 2025-11-29 09:28:05 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4d4 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12548 | 2025-11-29 09:28:05 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12544 | 2025-11-29 09:29:06 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4d4 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12548 | 2025-11-29 09:29:06 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12544 | 2025-11-29 09:29:24 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4d4 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12548 | 2025-11-29 09:29:24 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Users\Default\AppData\Local\Microsoft\WindowsApps Handle ID: 0x5c0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\Boot Handle ID: 0x5c0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\schemas\EAPHost Handle ID: 0x5d0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\schemas\EAPMethods Handle ID: 0x5d0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing Handle ID: 0x5d0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages Handle ID: 0x5d0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Sessions Handle ID: 0x5d0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\SQM Handle ID: 0x5d0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\Speech\Common Handle ID: 0x5d0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\System32\AdvancedInstallers Handle ID: 0x5d0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\System32\Boot Handle ID: 0x5d0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:30 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\System32\RasToast Handle ID: 0x5d0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:30 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\System32\Speech\Common Handle ID: 0x5c0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:30 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\SysWOW64\AdvancedInstallers Handle ID: 0x5c0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:30 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\UUS Handle ID: 0x5c0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:30 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\UUS\amd64 Handle ID: 0x5c0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:30 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WaaS Handle ID: 0x5c0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:33 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps Handle ID: 0x5d0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-shell32_31bf3856ad364e35_10.0.26100.1_none_691cd33e7a888844\WindowsShell.Manifest Handle ID: 0x6c4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-b..nt-core-bootmanager_31bf3856ad364e35_10.0.26100.1_none_e8c6741ed7984dd6\BootDebuggerFiles.ini Handle ID: 0x6ac Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-b..ore-bootmanager-efi_31bf3856ad364e35_10.0.26100.5059_none_237243ca4c4282ef\boot.stl Handle ID: 0x6d8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-b..vironment-servicing_31bf3856ad364e35_10.0.26100.1_none_230829930e210d15\bfsvc.exe Handle ID: 0x6e0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-b..ertransport-network_31bf3856ad364e35_10.0.26100.1_none_efab0023f2e46f78\kdnet_uart16550.dll Handle ID: 0x6e4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-b..ertransport-network_31bf3856ad364e35_10.0.26100.1_none_efab0023f2e46f78\kd_02_10df.dll Handle ID: 0x6e8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-b..ggertransport-kdnet_31bf3856ad364e35_10.0.26100.1_none_da5b7157c1851064\kdstub.dll Handle ID: 0x6ec Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-b..ertransport-network_31bf3856ad364e35_10.0.26100.1_none_efab0023f2e46f78\kd_02_1137.dll Handle ID: 0x6f0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-b..ertransport-network_31bf3856ad364e35_10.0.26100.1_none_efab0023f2e46f78\kd_02_1414.dll Handle ID: 0x6f4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-notepad_31bf3856ad364e35_10.0.26100.1_none_6c0e35dbd88c55f8\notepad.exe Handle ID: 0x6e8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-b..ertransport-network_31bf3856ad364e35_10.0.26100.1_none_efab0023f2e46f78\kd_02_15ad.dll Handle ID: 0x6e0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-b..ertransport-network_31bf3856ad364e35_10.0.26100.1_none_efab0023f2e46f78\kd_02_1969.dll Handle ID: 0x6d8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-b..ertransport-network_31bf3856ad364e35_10.0.26100.1_none_efab0023f2e46f78\kd_02_15b3.dll Handle ID: 0x6ac Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-a..ence-mitigations-c7_31bf3856ad364e35_10.0.26100.1_none_091be2465ad39e5c\drvmain.sdb Handle ID: 0x6c4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-b..ertransport-network_31bf3856ad364e35_10.0.26100.1_none_efab0023f2e46f78\kd_02_19a2.dll Handle ID: 0x5d4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-b..ertransport-network_31bf3856ad364e35_10.0.26100.1_none_efab0023f2e46f78\kd_02_1af4.dll Handle ID: 0x5d8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-b..ertransport-network_31bf3856ad364e35_10.0.26100.1_none_efab0023f2e46f78\kd_07_1415.dll Handle ID: 0x6c0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-b..ertransport-network_31bf3856ad364e35_10.0.26100.1_none_efab0023f2e46f78\kd_02_14e4.dll Handle ID: 0x6e8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-b..ertransport-network_31bf3856ad364e35_10.0.26100.1_none_efab0023f2e46f78\kd_0C_8086.dll Handle ID: 0x6f0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-registry-editor_31bf3856ad364e35_10.0.26100.1_none_f1225dc54465411c\regedit.exe Handle ID: 0x6e4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-b..ore-bootmanager-efi_31bf3856ad364e35_10.0.26100.5059_none_237243ca4c4282ef\winsipolicy.p7b Handle ID: 0x6d8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-b..ore-bootmanager-efi_31bf3856ad364e35_10.0.26100.1_none_8474913804ec759d\SecureBootRecovery.efi Handle ID: 0x6fc Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.26100.1_bg-bg_8d6bdb467cf7506b\bootmgfw_EX.efi.mui Handle ID: 0x6ec Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.26100.1_bg-bg_8d6bdb467cf7506b\bootmgfw.efi.mui Handle ID: 0x6f8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-b..ertransport-network_31bf3856ad364e35_10.0.26100.1_none_efab0023f2e46f78\kd_02_10ec.dll Handle ID: 0x700 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.26100.1_bg-bg_8d6bdb467cf7506b\bootmgr_EX.efi.mui Handle ID: 0x5d8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.26100.1_bg-bg_8d6bdb467cf7506b\bootmgr.efi.mui Handle ID: 0x704 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-b..iagnostic.resources_31bf3856ad364e35_10.0.26100.1_cs-cz_7086b4650c9e547c\memtest.efi.mui Handle ID: 0x708 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-b..ertransport-network_31bf3856ad364e35_10.0.26100.1_none_efab0023f2e46f78\kd_02_8086.dll Handle ID: 0x6c0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.26100.1_cs-cz_387551e16a7f2c96\bootmgfw_EX.efi.mui Handle ID: 0x6ac Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.26100.1_cs-cz_387551e16a7f2c96\bootmgfw.efi.mui Handle ID: 0x6e8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.26100.1_cs-cz_387551e16a7f2c96\bootmgr_EX.efi.mui Handle ID: 0x694 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.26100.1_cs-cz_387551e16a7f2c96\bootmgr.efi.mui Handle ID: 0x618 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.26100.1_da-dk_d5af320860c52895\bootmgfw_EX.efi.mui Handle ID: 0x6f8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.26100.1_da-dk_d5af320860c52895\bootmgfw.efi.mui Handle ID: 0x664 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-b..iagnostic.resources_31bf3856ad364e35_10.0.26100.1_da-dk_0dc0948c02e4507b\memtest.efi.mui Handle ID: 0x6fc Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.26100.1_da-dk_d5af320860c52895\bootmgr_EX.efi.mui Handle ID: 0x6d8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.26100.1_da-dk_d5af320860c52895\bootmgr.efi.mui Handle ID: 0x6e4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-b..iagnostic.resources_31bf3856ad364e35_10.0.26100.1_de-de_0aec29c804baa515\memtest.efi.mui Handle ID: 0x6f0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.26100.1_de-de_d2dac744629b7d2f\bootmgfw_EX.efi.mui Handle ID: 0x70c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.26100.1_de-de_d2dac744629b7d2f\bootmgfw.efi.mui Handle ID: 0x6bc Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-b..iagnostic.resources_31bf3856ad364e35_10.0.26100.1_el-gr_b382575af3d00da3\memtest.efi.mui Handle ID: 0x5f8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.26100.1_de-de_d2dac744629b7d2f\bootmgr_EX.efi.mui Handle ID: 0x694 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.26100.1_de-de_d2dac744629b7d2f\bootmgr.efi.mui Handle ID: 0x5cc Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.26100.1_el-gr_7b70f4d751b0e5bd\bootmgfw_EX.efi.mui Handle ID: 0x6bc Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.26100.1_el-gr_7b70f4d751b0e5bd\bootmgfw.efi.mui Handle ID: 0x6e8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.26100.1_el-gr_7b70f4d751b0e5bd\bootmgr_EX.efi.mui Handle ID: 0x6ac Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.26100.1_el-gr_7b70f4d751b0e5bd\bootmgr.efi.mui Handle ID: 0x6c0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.26100.1_en-gb_7442e21f5650d52f\bootmgfw_EX.efi.mui Handle ID: 0x6c0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.26100.1_en-gb_7442e21f5650d52f\bootmgfw.efi.mui Handle ID: 0x6ac Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.26100.1_en-gb_7442e21f5650d52f\bootmgr_EX.efi.mui Handle ID: 0x6e8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.26100.1_en-gb_7442e21f5650d52f\bootmgr.efi.mui Handle ID: 0x6bc Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.26100.1_en-us_7bcb9d3d517988f4\bootmgfw_EX.efi.mui Handle ID: 0x5cc Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.26100.1_en-us_7bcb9d3d517988f4\bootmgfw.efi.mui Handle ID: 0x6bc Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-b..iagnostic.resources_31bf3856ad364e35_10.0.26100.1_en-us_b3dcffc0f398b0da\memtest.efi.mui Handle ID: 0x6e8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.26100.1_en-us_7bcb9d3d517988f4\bootmgr_EX.efi.mui Handle ID: 0x62c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.26100.1_en-us_7bcb9d3d517988f4\bootmgr.efi.mui Handle ID: 0x6e8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-b..iagnostic.resources_31bf3856ad364e35_10.0.26100.1_es-es_b3a85ca4f3bfa27f\memtest.efi.mui Handle ID: 0x694 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.26100.1_es-es_7b96fa2151a07a99\bootmgfw_EX.efi.mui Handle ID: 0x5f8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.26100.1_es-es_7b96fa2151a07a99\bootmgfw.efi.mui Handle ID: 0x6f0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.26100.1_es-es_7b96fa2151a07a99\bootmgr_EX.efi.mui Handle ID: 0x6e4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.26100.1_es-es_7b96fa2151a07a99\bootmgr.efi.mui Handle ID: 0x6d8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.26100.1_es-mx_7dcde7c750345e44\bootmgfw_EX.efi.mui Handle ID: 0x6ac Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.26100.1_es-mx_7dcde7c750345e44\bootmgfw.efi.mui Handle ID: 0x6fc Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.26100.1_es-mx_7dcde7c750345e44\bootmgr_EX.efi.mui Handle ID: 0x664 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.26100.1_es-mx_7dcde7c750345e44\bootmgr.efi.mui Handle ID: 0x6f8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.26100.1_et-ee_7556c5b155a65728\bootmgfw_EX.efi.mui Handle ID: 0x618 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.26100.1_et-ee_7556c5b155a65728\bootmgfw.efi.mui Handle ID: 0x710 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-b..iagnostic.resources_31bf3856ad364e35_10.0.26100.1_fi-fi_52c36151e8d994a9\memtest.efi.mui Handle ID: 0x714 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.26100.1_et-ee_7556c5b155a65728\bootmgr_EX.efi.mui Handle ID: 0x710 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.26100.1_et-ee_7556c5b155a65728\bootmgr.efi.mui Handle ID: 0x714 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.26100.1_fi-fi_1ab1fece46ba6cc3\bootmgfw_EX.efi.mui Handle ID: 0x710 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.26100.1_fi-fi_1ab1fece46ba6cc3\bootmgfw.efi.mui Handle ID: 0x718 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.26100.1_fi-fi_1ab1fece46ba6cc3\bootmgr_EX.efi.mui Handle ID: 0x71c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.26100.1_fi-fi_1ab1fece46ba6cc3\bootmgr.efi.mui Handle ID: 0x618 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.26100.1_fr-ca_16c4ba6a494af721\bootmgfw_EX.efi.mui Handle ID: 0x6f8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.26100.1_fr-ca_16c4ba6a494af721\bootmgfw.efi.mui Handle ID: 0x618 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-b..iagnostic.resources_31bf3856ad364e35_10.0.26100.1_fr-fr_565fd2a3e691b8e1\memtest.efi.mui Handle ID: 0x71c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.26100.1_fr-ca_16c4ba6a494af721\bootmgr_EX.efi.mui Handle ID: 0x720 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.26100.1_fr-ca_16c4ba6a494af721\bootmgr.efi.mui Handle ID: 0x724 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.26100.1_fr-fr_1e4e7020447290fb\bootmgfw_EX.efi.mui Handle ID: 0x728 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.26100.1_fr-fr_1e4e7020447290fb\bootmgfw.efi.mui Handle ID: 0x72c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.26100.1_fr-fr_1e4e7020447290fb\bootmgr_EX.efi.mui Handle ID: 0x718 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.26100.1_fr-fr_1e4e7020447290fb\bootmgr.efi.mui Handle ID: 0x72c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.26100.1_hr-hr_648acaa22994feaf\bootmgr_EX.efi.mui Handle ID: 0x730 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.26100.1_hr-hr_648acaa22994feaf\bootmgr.efi.mui Handle ID: 0x734 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-b..iagnostic.resources_31bf3856ad364e35_10.0.26100.1_hu-hu_9dd052ebcaf187fd\memtest.efi.mui Handle ID: 0x738 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.26100.1_hr-hr_648acaa22994feaf\bootmgfw_EX.efi.mui Handle ID: 0x73c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.26100.1_hr-hr_648acaa22994feaf\bootmgfw.efi.mui Handle ID: 0x738 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.26100.1_hu-hu_65bef06828d26017\bootmgfw_EX.efi.mui Handle ID: 0x740 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.26100.1_hu-hu_65bef06828d26017\bootmgfw.efi.mui Handle ID: 0x738 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.26100.1_hu-hu_65bef06828d26017\bootmgr_EX.efi.mui Handle ID: 0x740 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.26100.1_hu-hu_65bef06828d26017\bootmgr.efi.mui Handle ID: 0x73c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-b..iagnostic.resources_31bf3856ad364e35_10.0.26100.1_it-it_4087c8eabdc39e5f\memtest.efi.mui Handle ID: 0x710 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-b..iagnostic.resources_31bf3856ad364e35_10.0.26100.1_ja-jp_e2ad47f7b0deb03a\memtest.efi.mui Handle ID: 0x714 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.26100.1_it-it_087666671ba47679\bootmgfw_EX.efi.mui Handle ID: 0x6d8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.26100.1_it-it_087666671ba47679\bootmgfw.efi.mui Handle ID: 0x714 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.26100.1_it-it_087666671ba47679\bootmgr_EX.efi.mui Handle ID: 0x710 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.26100.1_it-it_087666671ba47679\bootmgr.efi.mui Handle ID: 0x744 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.26100.1_ja-jp_aa9be5740ebf8854\bootmgfw_EX.efi.mui Handle ID: 0x744 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.26100.1_ja-jp_aa9be5740ebf8854\bootmgfw.efi.mui Handle ID: 0x710 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.26100.1_ja-jp_aa9be5740ebf8854\bootmgr_EX.efi.mui Handle ID: 0x714 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.26100.1_ja-jp_aa9be5740ebf8854\bootmgr.efi.mui Handle ID: 0x6d8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-b..iagnostic.resources_31bf3856ad364e35_10.0.26100.1_ko-kr_861724aca34f7750\memtest.efi.mui Handle ID: 0x6d8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.26100.1_ko-kr_4e05c22901304f6a\bootmgfw_EX.efi.mui Handle ID: 0x714 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.26100.1_ko-kr_4e05c22901304f6a\bootmgfw.efi.mui Handle ID: 0x744 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.26100.1_ko-kr_4e05c22901304f6a\bootmgr_EX.efi.mui Handle ID: 0x714 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.26100.1_ko-kr_4e05c22901304f6a\bootmgr.efi.mui Handle ID: 0x748 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.26100.1_lt-lt_f1d0ee29f3581b07\bootmgfw_EX.efi.mui Handle ID: 0x74c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.26100.1_lt-lt_f1d0ee29f3581b07\bootmgfw.efi.mui Handle ID: 0x750 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.26100.1_lt-lt_f1d0ee29f3581b07\bootmgr_EX.efi.mui Handle ID: 0x754 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.26100.1_lt-lt_f1d0ee29f3581b07\bootmgr.efi.mui Handle ID: 0x758 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.26100.1_lv-lv_f29e5cadf2d65bf7\bootmgfw_EX.efi.mui Handle ID: 0x75c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.26100.1_lv-lv_f29e5cadf2d65bf7\bootmgfw.efi.mui Handle ID: 0x760 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.26100.1_lv-lv_f29e5cadf2d65bf7\bootmgr_EX.efi.mui Handle ID: 0x74c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.26100.1_lv-lv_f29e5cadf2d65bf7\bootmgr.efi.mui Handle ID: 0x748 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.26100.1_nb-no_3698435dd9557b26\bootmgfw_EX.efi.mui Handle ID: 0x714 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.26100.1_nb-no_3698435dd9557b26\bootmgfw.efi.mui Handle ID: 0x74c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-b..iagnostic.resources_31bf3856ad364e35_10.0.26100.1_nb-no_6ea9a5e17b74a30c\memtest.efi.mui Handle ID: 0x748 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.26100.1_nb-no_3698435dd9557b26\bootmgr_EX.efi.mui Handle ID: 0x6bc Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.26100.1_nb-no_3698435dd9557b26\bootmgr.efi.mui Handle ID: 0x75c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-b..iagnostic.resources_31bf3856ad364e35_10.0.26100.1_nl-nl_6ce8f11f7ca0ace1\memtest.efi.mui Handle ID: 0x6e0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.26100.1_nl-nl_34d78e9bda8184fb\bootmgfw_EX.efi.mui Handle ID: 0x764 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.26100.1_nl-nl_34d78e9bda8184fb\bootmgfw.efi.mui Handle ID: 0x75c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.26100.1_nl-nl_34d78e9bda8184fb\bootmgr_EX.efi.mui Handle ID: 0x6bc Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.26100.1_nl-nl_34d78e9bda8184fb\bootmgr.efi.mui Handle ID: 0x758 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-b..iagnostic.resources_31bf3856ad364e35_10.0.26100.1_pl-pl_b3254ba161c31a95\memtest.efi.mui Handle ID: 0x754 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.26100.1_pl-pl_7b13e91dbfa3f2af\bootmgfw_EX.efi.mui Handle ID: 0x758 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.26100.1_pl-pl_7b13e91dbfa3f2af\bootmgfw.efi.mui Handle ID: 0x6bc Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.26100.1_pl-pl_7b13e91dbfa3f2af\bootmgr_EX.efi.mui Handle ID: 0x75c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.26100.1_pl-pl_7b13e91dbfa3f2af\bootmgr.efi.mui Handle ID: 0x764 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-b..iagnostic.resources_31bf3856ad364e35_10.0.26100.1_pt-br_b5793645604cae79\memtest.efi.mui Handle ID: 0x768 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.26100.1_pt-br_7d67d3c1be2d8693\bootmgfw_EX.efi.mui Handle ID: 0x76c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.26100.1_pt-br_7d67d3c1be2d8693\bootmgfw.efi.mui Handle ID: 0x770 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-b..iagnostic.resources_31bf3856ad364e35_10.0.26100.1_pt-pt_b65b05b15fbc1e55\memtest.efi.mui Handle ID: 0x774 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.26100.1_pt-br_7d67d3c1be2d8693\bootmgr_EX.efi.mui Handle ID: 0x778 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.26100.1_pt-br_7d67d3c1be2d8693\bootmgr.efi.mui Handle ID: 0x754 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.26100.1_pt-pt_7e49a32dbd9cf66f\bootmgfw_EX.efi.mui Handle ID: 0x768 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.26100.1_pt-pt_7e49a32dbd9cf66f\bootmgfw.efi.mui Handle ID: 0x754 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.26100.1_pt-pt_7e49a32dbd9cf66f\bootmgr_EX.efi.mui Handle ID: 0x778 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.26100.1_pt-pt_7e49a32dbd9cf66f\bootmgr.efi.mui Handle ID: 0x77c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-b..iagnostic.resources_31bf3856ad364e35_10.0.26100.1_qps-ploc_7278f77236e39cd9\memtest.efi.mui Handle ID: 0x780 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-b..iagnostic.resources_31bf3856ad364e35_10.0.26100.1_qps..ocm_0cd625279cc21622\memtest.efi.mui Handle ID: 0x784 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.26100.1_ro-ro_c2846965a403c1cb\bootmgfw_EX.efi.mui Handle ID: 0x788 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.26100.1_ro-ro_c2846965a403c1cb\bootmgfw.efi.mui Handle ID: 0x78c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-b..iagnostic.resources_31bf3856ad364e35_10.0.26100.1_ru-ru_fcfe1775449dac81\memtest.efi.mui Handle ID: 0x790 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.26100.1_ru-ru_c4ecb4f1a27e849b\bootmgfw_EX.efi.mui Handle ID: 0x794 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.26100.1_ru-ru_c4ecb4f1a27e849b\bootmgfw.efi.mui Handle ID: 0x760 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.26100.1_ro-ro_c2846965a403c1cb\bootmgr_EX.efi.mui Handle ID: 0x704 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.26100.1_ro-ro_c2846965a403c1cb\bootmgr.efi.mui Handle ID: 0x794 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.26100.1_ru-ru_c4ecb4f1a27e849b\bootmgr_EX.efi.mui Handle ID: 0x798 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.26100.1_ru-ru_c4ecb4f1a27e849b\bootmgr.efi.mui Handle ID: 0x794 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.26100.1_sk-sk_6407b99e979876c5\bootmgfw_EX.efi.mui Handle ID: 0x794 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.26100.1_sk-sk_6407b99e979876c5\bootmgfw.efi.mui Handle ID: 0x798 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.26100.1_sk-sk_6407b99e979876c5\bootmgr_EX.efi.mui Handle ID: 0x79c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.26100.1_sk-sk_6407b99e979876c5\bootmgr.efi.mui Handle ID: 0x794 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.26100.1_sl-si_6319db56983289a8\bootmgfw_EX.efi.mui Handle ID: 0x7a0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.26100.1_sl-si_6319db56983289a8\bootmgfw.efi.mui Handle ID: 0x7a4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.26100.1_sl-si_6319db56983289a8\bootmgr_EX.efi.mui Handle ID: 0x7a8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.26100.1_sl-si_6319db56983289a8\bootmgr.efi.mui Handle ID: 0x704 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.26100.1_sr-..-rs_094a439b0d4430d9\bootmgfw_EX.efi.mui Handle ID: 0x7ac Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.26100.1_sr-..-rs_094a439b0d4430d9\bootmgfw.efi.mui Handle ID: 0x7b0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-b..iagnostic.resources_31bf3856ad364e35_10.0.26100.1_sv-se_98f901ea3bc6b6dc\memtest.efi.mui Handle ID: 0x7b4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.26100.1_sr-..-rs_094a439b0d4430d9\bootmgr_EX.efi.mui Handle ID: 0x790 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.26100.1_sr-..-rs_094a439b0d4430d9\bootmgr.efi.mui Handle ID: 0x7b8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.26100.1_sv-se_60e79f6699a78ef6\bootmgfw_EX.efi.mui Handle ID: 0x7bc Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.26100.1_sv-se_60e79f6699a78ef6\bootmgfw.efi.mui Handle ID: 0x7c0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.26100.1_sv-se_60e79f6699a78ef6\bootmgr_EX.efi.mui Handle ID: 0x7c4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.26100.1_sv-se_60e79f6699a78ef6\bootmgr.efi.mui Handle ID: 0x7c8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-b..iagnostic.resources_31bf3856ad364e35_10.0.26100.1_tr-tr_42064c312a82b8cd\memtest.efi.mui Handle ID: 0x7cc Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.26100.1_tr-tr_09f4e9ad886390e7\bootmgfw_EX.efi.mui Handle ID: 0x7d0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.26100.1_tr-tr_09f4e9ad886390e7\bootmgfw.efi.mui Handle ID: 0x7d4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.26100.1_tr-tr_09f4e9ad886390e7\bootmgr_EX.efi.mui Handle ID: 0x7cc Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.26100.1_tr-tr_09f4e9ad886390e7\bootmgr.efi.mui Handle ID: 0x7d4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.26100.1_uk-ua_a5d4cc547f94b733\bootmgfw_EX.efi.mui Handle ID: 0x7d8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.26100.1_uk-ua_a5d4cc547f94b733\bootmgfw.efi.mui Handle ID: 0x7dc Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.26100.1_zh-cn_db5207ab389b6306\bootmgfw_EX.efi.mui Handle ID: 0x7e0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.26100.1_zh-cn_db5207ab389b6306\bootmgfw.efi.mui Handle ID: 0x7e4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.26100.1_zh-cn_db5207ab389b6306\bootmgr_EX.efi.mui Handle ID: 0x7e8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.26100.1_zh-cn_db5207ab389b6306\bootmgr.efi.mui Handle ID: 0x7ec Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-b..iagnostic.resources_31bf3856ad364e35_10.0.26100.1_zh-cn_13636a2edaba8aec\memtest.efi.mui Handle ID: 0x7f0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.26100.1_uk-ua_a5d4cc547f94b733\bootmgr_EX.efi.mui Handle ID: 0x7f4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.26100.1_uk-ua_a5d4cc547f94b733\bootmgr.efi.mui Handle ID: 0x7f8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-b..iagnostic.resources_31bf3856ad364e35_10.0.26100.1_zh-tw_175fa784d82b675c\memtest.efi.mui Handle ID: 0x7f8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.26100.1_zh-tw_df4e4501360c3f76\bootmgfw_EX.efi.mui Handle ID: 0x7fc Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.26100.1_zh-tw_df4e4501360c3f76\bootmgfw.efi.mui Handle ID: 0x7f4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.26100.1_zh-tw_df4e4501360c3f76\bootmgr_EX.efi.mui Handle ID: 0x7f8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.26100.1_zh-tw_df4e4501360c3f76\bootmgr.efi.mui Handle ID: 0x7f4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-b..ore-bootmanager-efi_31bf3856ad364e35_10.0.26100.1_none_8474913804ec759d\bootmgr_EX.efi Handle ID: 0x7fc Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-b..ore-bootmanager-efi_31bf3856ad364e35_10.0.26100.1_none_8474913804ec759d\bootmgr.efi Handle ID: 0x7f4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-b..re-memorydiagnostic_31bf3856ad364e35_10.0.26100.1_none_d528f6ca6d29f543\memtest.efi Handle ID: 0x7f4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-b..core-fonts-jpn-boot_31bf3856ad364e35_10.0.26100.1_none_860fd2cc923e483d\meiryon_boot_EX.ttf Handle ID: 0x7fc Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-b..core-fonts-jpn-boot_31bf3856ad364e35_10.0.26100.1_none_860fd2cc923e483d\meiryon_boot.ttf Handle ID: 0x7f4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-b..core-fonts-kor-boot_31bf3856ad364e35_10.0.26100.1_none_57bb28abfdad269f\malgunn_boot_EX.ttf Handle ID: 0x7f8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-b..core-fonts-kor-boot_31bf3856ad364e35_10.0.26100.1_none_57bb28abfdad269f\malgunn_boot.ttf Handle ID: 0x7f4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-b..core-fonts-kor-boot_31bf3856ad364e35_10.0.26100.1_none_57bb28abfdad269f\malgun_boot_EX.ttf Handle ID: 0x7f8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-b..core-fonts-kor-boot_31bf3856ad364e35_10.0.26100.1_none_57bb28abfdad269f\malgun_boot.ttf Handle ID: 0x7f4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-b..core-fonts-jpn-boot_31bf3856ad364e35_10.0.26100.1_none_860fd2cc923e483d\meiryo_boot_EX.ttf Handle ID: 0x7f8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-b..core-fonts-jpn-boot_31bf3856ad364e35_10.0.26100.1_none_860fd2cc923e483d\meiryo_boot.ttf Handle ID: 0x7d0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-b..core-fonts-cht-boot_31bf3856ad364e35_10.0.26100.1_none_bb09cb2791a91a86\msjhn_boot_EX.ttf Handle ID: 0x7a0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-b..core-fonts-cht-boot_31bf3856ad364e35_10.0.26100.1_none_bb09cb2791a91a86\msjhn_boot.ttf Handle ID: 0x7f4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-b..core-fonts-cht-boot_31bf3856ad364e35_10.0.26100.1_none_bb09cb2791a91a86\msjh_boot_EX.ttf Handle ID: 0x7fc Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-b..core-fonts-cht-boot_31bf3856ad364e35_10.0.26100.1_none_bb09cb2791a91a86\msjh_boot.ttf Handle ID: 0x7d0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-b..core-fonts-eng-boot_31bf3856ad364e35_10.0.26100.1_none_4186c42516bf4787\segmono_boot_EX.ttf Handle ID: 0x7f8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-b..core-fonts-eng-boot_31bf3856ad364e35_10.0.26100.1_none_4186c42516bf4787\segmono_boot.ttf Handle ID: 0x7e8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-b..core-fonts-eng-boot_31bf3856ad364e35_10.0.26100.1_none_4186c42516bf4787\segoen_slboot_EX.ttf Handle ID: 0x7e4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-b..core-fonts-eng-boot_31bf3856ad364e35_10.0.26100.1_none_4186c42516bf4787\segoen_slboot.ttf Handle ID: 0x7e0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-b..core-fonts-chs-boot_31bf3856ad364e35_10.0.26100.1_none_d1d7665f7801cbe7\msyhn_boot_EX.ttf Handle ID: 0x7dc Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-b..core-fonts-chs-boot_31bf3856ad364e35_10.0.26100.1_none_d1d7665f7801cbe7\msyhn_boot.ttf Handle ID: 0x7d8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-b..core-fonts-eng-boot_31bf3856ad364e35_10.0.26100.1_none_4186c42516bf4787\wgl4_boot_EX.ttf Handle ID: 0x7d4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-b..core-fonts-eng-boot_31bf3856ad364e35_10.0.26100.1_none_4186c42516bf4787\wgl4_boot.ttf Handle ID: 0x7cc Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-b..core-fonts-chs-boot_31bf3856ad364e35_10.0.26100.1_none_d1d7665f7801cbe7\msyh_boot_EX.ttf Handle ID: 0x7c8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-b..core-fonts-chs-boot_31bf3856ad364e35_10.0.26100.1_none_d1d7665f7801cbe7\msyh_boot.ttf Handle ID: 0x7c4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-b..core-fonts-eng-boot_31bf3856ad364e35_10.0.26100.1_none_4186c42516bf4787\segoe_slboot_EX.ttf Handle ID: 0x7c0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-b..core-fonts-eng-boot_31bf3856ad364e35_10.0.26100.1_none_4186c42516bf4787\segoe_slboot.ttf Handle ID: 0x78c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\x86_microsoft-windows-b..re-bootmanager-pcat_31bf3856ad364e35_10.0.26100.1_none_63febf60635fac59\bootnxt Handle ID: 0x788 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\x86_microsoft-windows-b..re-bootmanager-pcat_31bf3856ad364e35_10.0.26100.1_none_63febf60635fac59\bootuwf.dll Handle ID: 0x78c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\x86_microsoft-windows-b..re-bootmanager-pcat_31bf3856ad364e35_10.0.26100.1_none_63febf60635fac59\bootvhd.dll Handle ID: 0x7c0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\x86_microsoft-windows-b..re-bootmanager-pcat_31bf3856ad364e35_10.0.26100.1_none_63febf60635fac59\bootmgr Handle ID: 0x788 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\wow64_microsoft-windows-b..iagnostic.resources_31bf3856ad364e35_10.0.26100.1_cs-cz_7adb5eb740ff1677\memtest.exe.mui Handle ID: 0x784 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\x86_microsoft-windows-b..re-bootmanager-pcat_31bf3856ad364e35_10.0.26100.1_none_63febf60635fac59\bootspaces.dll Handle ID: 0x77c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\wow64_microsoft-windows-b..iagnostic.resources_31bf3856ad364e35_10.0.26100.1_da-dk_18153ede37451276\memtest.exe.mui Handle ID: 0x778 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\wow64_microsoft-windows-b..iagnostic.resources_31bf3856ad364e35_10.0.26100.1_de-de_1540d41a391b6710\memtest.exe.mui Handle ID: 0x754 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\wow64_microsoft-windows-b..iagnostic.resources_31bf3856ad364e35_10.0.26100.1_el-gr_bdd701ad2830cf9e\memtest.exe.mui Handle ID: 0x778 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\wow64_microsoft-windows-b..iagnostic.resources_31bf3856ad364e35_10.0.26100.1_en-us_be31aa1327f972d5\memtest.exe.mui Handle ID: 0x768 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\wow64_microsoft-windows-b..iagnostic.resources_31bf3856ad364e35_10.0.26100.1_es-es_bdfd06f72820647a\memtest.exe.mui Handle ID: 0x748 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\wow64_microsoft-windows-b..iagnostic.resources_31bf3856ad364e35_10.0.26100.1_fi-fi_5d180ba41d3a56a4\memtest.exe.mui Handle ID: 0x74c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\wow64_microsoft-windows-b..iagnostic.resources_31bf3856ad364e35_10.0.26100.1_fr-fr_60b47cf61af27adc\memtest.exe.mui Handle ID: 0x714 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\wow64_microsoft-windows-b..iagnostic.resources_31bf3856ad364e35_10.0.26100.1_hu-hu_a824fd3dff5249f8\memtest.exe.mui Handle ID: 0x714 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\wow64_microsoft-windows-b..iagnostic.resources_31bf3856ad364e35_10.0.26100.1_it-it_4adc733cf224605a\memtest.exe.mui Handle ID: 0x744 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\wow64_microsoft-windows-b..iagnostic.resources_31bf3856ad364e35_10.0.26100.1_ja-jp_ed01f249e53f7235\memtest.exe.mui Handle ID: 0x74c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\wow64_microsoft-windows-b..iagnostic.resources_31bf3856ad364e35_10.0.26100.1_ko-kr_906bcefed7b0394b\memtest.exe.mui Handle ID: 0x748 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\wow64_microsoft-windows-b..iagnostic.resources_31bf3856ad364e35_10.0.26100.1_nb-no_78fe5033afd56507\memtest.exe.mui Handle ID: 0x74c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\wow64_microsoft-windows-b..iagnostic.resources_31bf3856ad364e35_10.0.26100.1_nl-nl_773d9b71b1016edc\memtest.exe.mui Handle ID: 0x5d8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\wow64_microsoft-windows-b..iagnostic.resources_31bf3856ad364e35_10.0.26100.1_pl-pl_bd79f5f39623dc90\memtest.exe.mui Handle ID: 0x744 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\wow64_microsoft-windows-b..iagnostic.resources_31bf3856ad364e35_10.0.26100.1_pt-br_bfcde09794ad7074\memtest.exe.mui Handle ID: 0x6d8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\wow64_microsoft-windows-b..iagnostic.resources_31bf3856ad364e35_10.0.26100.1_pt-pt_c0afb003941ce050\memtest.exe.mui Handle ID: 0x6d8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\wow64_microsoft-windows-b..iagnostic.resources_31bf3856ad364e35_10.0.26100.1_qps-ploc_7ccda1c46b445ed4\memtest.exe.mui Handle ID: 0x744 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\wow64_microsoft-windows-b..iagnostic.resources_31bf3856ad364e35_10.0.26100.1_qps..ocm_172acf79d122d81d\memtest.exe.mui Handle ID: 0x714 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\wow64_microsoft-windows-b..iagnostic.resources_31bf3856ad364e35_10.0.26100.1_ru-ru_0752c1c778fe6e7c\memtest.exe.mui Handle ID: 0x73c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\wow64_microsoft-windows-b..iagnostic.resources_31bf3856ad364e35_10.0.26100.1_sv-se_a34dac3c702778d7\memtest.exe.mui Handle ID: 0x6ac Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-b..core-fonts-jpn-boot_31bf3856ad364e35_10.0.26100.1_none_860fd2cc923e483d\jpn_boot_EX.ttf Handle ID: 0x740 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-b..core-fonts-jpn-boot_31bf3856ad364e35_10.0.26100.1_none_860fd2cc923e483d\jpn_boot.ttf Handle ID: 0x6ac Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\wow64_microsoft-windows-b..iagnostic.resources_31bf3856ad364e35_10.0.26100.1_tr-tr_4c5af6835ee37ac8\memtest.exe.mui Handle ID: 0x744 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\x86_microsoft-windows-bootenvironment-pxe_31bf3856ad364e35_10.0.26100.1_none_8e27e0ea41f98e14\abortpxe.com Handle ID: 0x6d8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\wow64_microsoft-windows-b..iagnostic.resources_31bf3856ad364e35_10.0.26100.1_zh-cn_1db814810f1b4ce7\memtest.exe.mui Handle ID: 0x6d8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\wow64_microsoft-windows-b..iagnostic.resources_31bf3856ad364e35_10.0.26100.1_zh-tw_21b451d70c8c2957\memtest.exe.mui Handle ID: 0x744 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\x86_microsoft-windows-bootenvironment-pxe_31bf3856ad364e35_10.0.26100.1_none_8e27e0ea41f98e14\hdlscom1.com Handle ID: 0x6ac Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\x86_microsoft-windows-bootenvironment-pxe_31bf3856ad364e35_10.0.26100.1_none_8e27e0ea41f98e14\hdlscom1.n12 Handle ID: 0x768 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\x86_microsoft-windows-bootenvironment-pxe_31bf3856ad364e35_10.0.26100.1_none_8e27e0ea41f98e14\hdlscom2.com Handle ID: 0x6ac Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\x86_microsoft-windows-bootenvironment-pxe_31bf3856ad364e35_10.0.26100.1_none_8e27e0ea41f98e14\hdlscom2.n12 Handle ID: 0x778 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\x86_microsoft-windows-bootenvironment-pxe_31bf3856ad364e35_10.0.26100.1_none_8e27e0ea41f98e14\pxeboot.com Handle ID: 0x754 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-b..nvironment-pxe-base_31bf3856ad364e35_10.0.26100.1_none_1b8b3b6de6c6ec04\WdsConfig.inf Handle ID: 0x77c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\x86_microsoft-windows-bootenvironment-pxe_31bf3856ad364e35_10.0.26100.1_none_8e27e0ea41f98e14\pxeboot.n12 Handle ID: 0x6f4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\x86_microsoft-windows-bootenvironment-pxe_31bf3856ad364e35_10.0.26100.1_none_8e27e0ea41f98e14\wdsnbp.com Handle ID: 0x5d8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\x86_microsoft-windows-b..nment-pxe.resources_31bf3856ad364e35_10.0.26100.1_en-us_59eaf6dff83de06d\bootmgr_EX.efi.mui Handle ID: 0x690 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\x86_microsoft-windows-b..nment-pxe.resources_31bf3856ad364e35_10.0.26100.1_en-us_59eaf6dff83de06d\bootmgr.efi.mui Handle ID: 0x5d8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\wow64_microsoft-windows-b..re-memorydiagnostic_31bf3856ad364e35_10.0.26100.1_none_df7da11ca18ab73e\memtest.exe Handle ID: 0x754 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-b..-pxe-base.resources_31bf3856ad364e35_10.0.26100.1_en-us_9649457c92ce8e67\wdsmgfw_EX.efi.mui Handle ID: 0x778 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-b..-pxe-base.resources_31bf3856ad364e35_10.0.26100.1_en-us_9649457c92ce8e67\wdsmgfw.efi.mui Handle ID: 0x6ac Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\x86_microsoft-windows-b..nment-pxe.resources_31bf3856ad364e35_10.0.26100.1_en-us_59eaf6dff83de06d\bootmgr.exe.mui Handle ID: 0x690 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\x86_microsoft-windows-b..ager-pcat.resources_31bf3856ad364e35_10.0.26100.1_en-us_c056d698d62023e4\bootmgr.exe.mui Handle ID: 0x744 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-bootres_31bf3856ad364e35_10.0.26100.1_none_3c106983ea7d6f29\bootres.dll Handle ID: 0x77c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-branding-base-client_31bf3856ad364e35_10.0.26100.1_none_9ec3c7e9adb848ec\basebrd.dll Handle ID: 0x714 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-branding-shell-client_31bf3856ad364e35_10.0.26100.1_none_2e6389ec6fdf27a1\shellbrd.dll Handle ID: 0x710 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-u..tings-windowsclient_31bf3856ad364e35_10.0.26100.1_none_773f2e212c50256e\analyticsevents.dat Handle ID: 0x77c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-u..ed-telemetry-client_31bf3856ad364e35_10.0.26100.1_none_9ce698286f793873\GetFileActionAllowedList.dat Handle ID: 0x768 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-u..ed-telemetry-client_31bf3856ad364e35_10.0.26100.1_none_9ce698286f793873\GetFileInfoActionAllowedList.dat Handle ID: 0x6d8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-u..ed-telemetry-client_31bf3856ad364e35_10.0.26100.1_none_9ce698286f793873\RunExeActionAllowedList.dat Handle ID: 0x77c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-u..tings-windowsclient_31bf3856ad364e35_10.0.26100.1_none_773f2e212c50256e\utc.aggregators.diffbase Handle ID: 0x740 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-b..ore-bootmanager-efi_31bf3856ad364e35_10.0.26100.1_none_8474913804ec759d\bootmgfw_EX.efi Handle ID: 0x734 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-u..tings-windowsclient_31bf3856ad364e35_10.0.26100.1_none_773f2e212c50256e\utc.derived.xml Handle ID: 0x730 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\x86_microsoft-windows-bootenvironment-pxe_31bf3856ad364e35_10.0.26100.1_none_8e27e0ea41f98e14\bootmgr.exe Handle ID: 0x6ac Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-u..ed-telemetry-client_31bf3856ad364e35_10.0.26100.1_none_9ce698286f793873\utc.allow.diffbase Handle ID: 0x6d8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-u..tings-windowsclient_31bf3856ad364e35_10.0.26100.1_none_773f2e212c50256e\utc.privacy.diffbase Handle ID: 0x768 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-u..tings-windowsclient_31bf3856ad364e35_10.0.26100.1_none_773f2e212c50256e\telemetry.ASM-WindowsDefault.json Handle ID: 0x710 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-u..tings-windowsclient_31bf3856ad364e35_10.0.26100.1_none_773f2e212c50256e\utc.app.json Handle ID: 0x714 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-u..tings-windowsclient_31bf3856ad364e35_10.0.26100.1_none_773f2e212c50256e\utc.tracing.json Handle ID: 0x744 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-u..tings-windowsclient_31bf3856ad364e35_10.0.26100.1_none_773f2e212c50256e\windows.uif_ondemand.json Handle ID: 0x690 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-u..tings-windowsclient_31bf3856ad364e35_10.0.26100.1_none_773f2e212c50256e\windows.diag_ondemand.xml Handle ID: 0x6f4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-font-bitmap-fixed_31bf3856ad364e35_10.0.26100.1_none_7c038aae972c23b7\8514fix.fon Handle ID: 0x700 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-font-bitmap-fixed_31bf3856ad364e35_10.0.26100.1_none_7c038aae972c23b7\8514fixe.fon Handle ID: 0x730 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-font-bitmap-fixed_31bf3856ad364e35_10.0.26100.1_none_7c038aae972c23b7\8514fixg.fon Handle ID: 0x700 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-font-bitmap-fixed_31bf3856ad364e35_10.0.26100.1_none_7c038aae972c23b7\8514fixr.fon Handle ID: 0x734 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-font-bitmap-fixed_31bf3856ad364e35_10.0.26100.1_none_7c038aae972c23b7\8514fixt.fon Handle ID: 0x72c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-font-bitmap-oem_31bf3856ad364e35_10.0.26100.1_none_fa57c54c16f338be\8514oem.fon Handle ID: 0x734 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-b..core-fonts-chs-boot_31bf3856ad364e35_10.0.26100.1_none_d1d7665f7801cbe7\chs_boot_EX.ttf Handle ID: 0x700 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-b..core-fonts-chs-boot_31bf3856ad364e35_10.0.26100.1_none_d1d7665f7801cbe7\chs_boot.ttf Handle ID: 0x6f4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-font-bitmap-oem_31bf3856ad364e35_10.0.26100.1_none_fa57c54c16f338be\8514oeme.fon Handle ID: 0x744 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-font-bitmap-oem_31bf3856ad364e35_10.0.26100.1_none_fa57c54c16f338be\8514oemg.fon Handle ID: 0x714 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-font-bitmap-oem_31bf3856ad364e35_10.0.26100.1_none_fa57c54c16f338be\8514oemr.fon Handle ID: 0x744 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-font-bitmap-system_31bf3856ad364e35_10.0.26100.1_none_804a75475f6bc4e2\8514sys.fon Handle ID: 0x6f4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-font-bitmap-oem_31bf3856ad364e35_10.0.26100.1_none_fa57c54c16f338be\8514oemt.fon Handle ID: 0x700 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-font-bitmap-system_31bf3856ad364e35_10.0.26100.1_none_804a75475f6bc4e2\8514syse.fon Handle ID: 0x718 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-font-bitmap-system_31bf3856ad364e35_10.0.26100.1_none_804a75475f6bc4e2\8514sysg.fon Handle ID: 0x744 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-font-bitmap-system_31bf3856ad364e35_10.0.26100.1_none_804a75475f6bc4e2\8514sysr.fon Handle ID: 0x714 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-font-bitmap-system_31bf3856ad364e35_10.0.26100.1_none_804a75475f6bc4e2\8514syst.fon Handle ID: 0x6ec Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-b..core-fonts-kor-boot_31bf3856ad364e35_10.0.26100.1_none_57bb28abfdad269f\kor_boot_EX.ttf Handle ID: 0x73c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-b..core-fonts-kor-boot_31bf3856ad364e35_10.0.26100.1_none_57bb28abfdad269f\kor_boot.ttf Handle ID: 0x5d8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-b..core-fonts-cht-boot_31bf3856ad364e35_10.0.26100.1_none_bb09cb2791a91a86\cht_boot_EX.ttf Handle ID: 0x784 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-b..core-fonts-cht-boot_31bf3856ad364e35_10.0.26100.1_none_bb09cb2791a91a86\cht_boot.ttf Handle ID: 0x714 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-font-bitmap-oem_31bf3856ad364e35_10.0.26100.1_none_fa57c54c16f338be\85775.fon Handle ID: 0x744 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-font-bitmap-oem_31bf3856ad364e35_10.0.26100.1_none_fa57c54c16f338be\85855.fon Handle ID: 0x700 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-font-bitmap-fixed_31bf3856ad364e35_10.0.26100.1_none_7c038aae972c23b7\85f1255.fon Handle ID: 0x6f4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-font-bitmap-fixed_31bf3856ad364e35_10.0.26100.1_none_7c038aae972c23b7\85f1256.fon Handle ID: 0x788 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-font-bitmap-fixed_31bf3856ad364e35_10.0.26100.1_none_7c038aae972c23b7\85f1257.fon Handle ID: 0x7c0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-font-bitmap-system_31bf3856ad364e35_10.0.26100.1_none_804a75475f6bc4e2\85s1255.fon Handle ID: 0x78c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-b..nvironment-pxe-base_31bf3856ad364e35_10.0.26100.1_none_1b8b3b6de6c6ec04\wdsmgfw.efi Handle ID: 0x714 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-font-bitmap-fixed_31bf3856ad364e35_10.0.26100.1_none_7c038aae972c23b7\85f874.fon Handle ID: 0x7c4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-font-bitmap-system_31bf3856ad364e35_10.0.26100.1_none_804a75475f6bc4e2\85s1256.fon Handle ID: 0x7c8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-font-bitmap-system_31bf3856ad364e35_10.0.26100.1_none_804a75475f6bc4e2\85s1257.fon Handle ID: 0x7c4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-font-bitmap-system_31bf3856ad364e35_10.0.26100.1_none_804a75475f6bc4e2\85s874.fon Handle ID: 0x714 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-font-bitmap-terminal_31bf3856ad364e35_10.0.26100.1_none_1163014529e926e1\app775.fon Handle ID: 0x78c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-font-bitmap-terminal_31bf3856ad364e35_10.0.26100.1_none_1163014529e926e1\app850.fon Handle ID: 0x7c0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-font-bitmap-terminal_31bf3856ad364e35_10.0.26100.1_none_1163014529e926e1\app852.fon Handle ID: 0x788 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-font-bitmap-terminal_31bf3856ad364e35_10.0.26100.1_none_1163014529e926e1\app855.fon Handle ID: 0x700 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-font-bitmap-terminal_31bf3856ad364e35_10.0.26100.1_none_1163014529e926e1\app857.fon Handle ID: 0x744 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-font-bitmap-terminal_31bf3856ad364e35_10.0.26100.1_none_1163014529e926e1\app866.fon Handle ID: 0x700 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-font-bitmap-fixed_31bf3856ad364e35_10.0.26100.1_none_7c038aae972c23b7\c8514fix.fon Handle ID: 0x744 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-font-bitmap-oem_31bf3856ad364e35_10.0.26100.1_none_fa57c54c16f338be\c8514oem.fon Handle ID: 0x7c8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-font-bitmap-terminal_31bf3856ad364e35_10.0.26100.1_none_1163014529e926e1\cga40737.fon Handle ID: 0x784 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-font-bitmap-terminal_31bf3856ad364e35_10.0.26100.1_none_1163014529e926e1\cga40850.fon Handle ID: 0x7c0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-font-bitmap-system_31bf3856ad364e35_10.0.26100.1_none_804a75475f6bc4e2\c8514sys.fon Handle ID: 0x784 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-font-bitmap-terminal_31bf3856ad364e35_10.0.26100.1_none_1163014529e926e1\app936.fon Handle ID: 0x7c8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-font-bitmap-terminal_31bf3856ad364e35_10.0.26100.1_none_1163014529e926e1\cga40852.fon Handle ID: 0x744 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-font-bitmap-terminal_31bf3856ad364e35_10.0.26100.1_none_1163014529e926e1\app950.fon Handle ID: 0x6f4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-font-bitmap-terminal_31bf3856ad364e35_10.0.26100.1_none_1163014529e926e1\app949.fon Handle ID: 0x778 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-font-bitmap-terminal_31bf3856ad364e35_10.0.26100.1_none_1163014529e926e1\cga40857.fon Handle ID: 0x6cc Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-font-bitmap-terminal_31bf3856ad364e35_10.0.26100.1_none_1163014529e926e1\cga40866.fon Handle ID: 0x6f4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-font-bitmap-terminal_31bf3856ad364e35_10.0.26100.1_none_1163014529e926e1\cga40869.fon Handle ID: 0x700 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-font-bitmap-terminal_31bf3856ad364e35_10.0.26100.1_none_1163014529e926e1\cga80737.fon Handle ID: 0x710 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-font-bitmap-terminal_31bf3856ad364e35_10.0.26100.1_none_1163014529e926e1\cga80850.fon Handle ID: 0x768 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-font-bitmap-terminal_31bf3856ad364e35_10.0.26100.1_none_1163014529e926e1\cga40woa.fon Handle ID: 0x6d8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-font-bitmap-terminal_31bf3856ad364e35_10.0.26100.1_none_1163014529e926e1\app932.fon Handle ID: 0x6ac Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-font-bitmap-terminal_31bf3856ad364e35_10.0.26100.1_none_1163014529e926e1\cga80852.fon Handle ID: 0x710 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-font-bitmap-terminal_31bf3856ad364e35_10.0.26100.1_none_1163014529e926e1\cga80857.fon Handle ID: 0x768 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-font-bitmap-terminal_31bf3856ad364e35_10.0.26100.1_none_1163014529e926e1\cga80866.fon Handle ID: 0x740 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-font-bitmap-terminal_31bf3856ad364e35_10.0.26100.1_none_1163014529e926e1\cga80woa.fon Handle ID: 0x77c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-font-bitmap-terminal_31bf3856ad364e35_10.0.26100.1_none_1163014529e926e1\cga80869.fon Handle ID: 0x738 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-font-bitmap-fixed_31bf3856ad364e35_10.0.26100.1_none_7c038aae972c23b7\cvgafix.fon Handle ID: 0x72c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-font-bitmap-system_31bf3856ad364e35_10.0.26100.1_none_804a75475f6bc4e2\cvgasys.fon Handle ID: 0x768 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-u..tings-windowsclient_31bf3856ad364e35_10.0.26100.1_none_773f2e212c50256e\windows.uif_ondemand.xml Handle ID: 0x730 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-font-bitmap-terminal_31bf3856ad364e35_10.0.26100.1_none_1163014529e926e1\dos737.fon Handle ID: 0x690 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-font-bitmap-terminal_31bf3856ad364e35_10.0.26100.1_none_1163014529e926e1\dos869.fon Handle ID: 0x7c8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-font-bitmap-terminal_31bf3856ad364e35_10.0.26100.1_none_1163014529e926e1\ega40869.fon Handle ID: 0x784 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-font-bitmap-terminal_31bf3856ad364e35_10.0.26100.1_none_1163014529e926e1\ega40737.fon Handle ID: 0x7c0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-font-bitmap-terminal_31bf3856ad364e35_10.0.26100.1_none_1163014529e926e1\ega40850.fon Handle ID: 0x72c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-b..nvironment-pxe-base_31bf3856ad364e35_10.0.26100.1_none_1b8b3b6de6c6ec04\wdsmgfw_EX.efi Handle ID: 0x768 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-font-bitmap-terminal_31bf3856ad364e35_10.0.26100.1_none_1163014529e926e1\ega40852.fon Handle ID: 0x5d8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-font-bitmap-terminal_31bf3856ad364e35_10.0.26100.1_none_1163014529e926e1\dosapp.fon Handle ID: 0x73c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-font-bitmap-terminal_31bf3856ad364e35_10.0.26100.1_none_1163014529e926e1\ega40857.fon Handle ID: 0x7c8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-font-bitmap-terminal_31bf3856ad364e35_10.0.26100.1_none_1163014529e926e1\ega80737.fon Handle ID: 0x690 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-font-bitmap-terminal_31bf3856ad364e35_10.0.26100.1_none_1163014529e926e1\ega40woa.fon Handle ID: 0x6ec Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-font-bitmap-terminal_31bf3856ad364e35_10.0.26100.1_none_1163014529e926e1\ega40866.fon Handle ID: 0x72c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-font-bitmap-terminal_31bf3856ad364e35_10.0.26100.1_none_1163014529e926e1\ega80850.fon Handle ID: 0x7c0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-font-bitmap-terminal_31bf3856ad364e35_10.0.26100.1_none_1163014529e926e1\ega80852.fon Handle ID: 0x784 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-font-bitmap-terminal_31bf3856ad364e35_10.0.26100.1_none_1163014529e926e1\ega80857.fon Handle ID: 0x730 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-font-bitmap-terminal_31bf3856ad364e35_10.0.26100.1_none_1163014529e926e1\ega80866.fon Handle ID: 0x788 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-font-bitmap-terminal_31bf3856ad364e35_10.0.26100.1_none_1163014529e926e1\ega80869.fon Handle ID: 0x734 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-font-bitmap-terminal_31bf3856ad364e35_10.0.26100.1_none_1163014529e926e1\ega80woa.fon Handle ID: 0x5d8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-font-bitmap-fixed_31bf3856ad364e35_10.0.26100.1_none_7c038aae972c23b7\h8514fix.fon Handle ID: 0x738 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-font-bitmap-system_31bf3856ad364e35_10.0.26100.1_none_804a75475f6bc4e2\h8514sys.fon Handle ID: 0x78c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-font-bitmap-oem_31bf3856ad364e35_10.0.26100.1_none_fa57c54c16f338be\h8514oem.fon Handle ID: 0x77c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-font-bitmap-fixed_31bf3856ad364e35_10.0.26100.1_none_7c038aae972c23b7\hvgafix.fon Handle ID: 0x72c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-font-bitmap-system_31bf3856ad364e35_10.0.26100.1_none_804a75475f6bc4e2\hvgasys.fon Handle ID: 0x7c0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-font-bitmap-fixed_31bf3856ad364e35_10.0.26100.1_none_7c038aae972c23b7\j8514fix.fon Handle ID: 0x784 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-font-bitmap-system_31bf3856ad364e35_10.0.26100.1_none_804a75475f6bc4e2\j8514sys.fon Handle ID: 0x730 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-font-bitmap-fixed_31bf3856ad364e35_10.0.26100.1_none_7c038aae972c23b7\jvgafix.fon Handle ID: 0x718 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-font-bitmap-oem_31bf3856ad364e35_10.0.26100.1_none_fa57c54c16f338be\j8514oem.fon Handle ID: 0x728 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-font-bitmap-system_31bf3856ad364e35_10.0.26100.1_none_804a75475f6bc4e2\jvgasys.fon Handle ID: 0x724 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-font-truetype-marlett_31bf3856ad364e35_10.0.26100.1_none_4b489fcd67dd5ec7\marlett.ttf Handle ID: 0x768 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-font-bitmap-fixed_31bf3856ad364e35_10.0.26100.1_none_7c038aae972c23b7\s8514fix.fon Handle ID: 0x700 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-font-truetype-consolas_31bf3856ad364e35_10.0.26100.1_none_66e2fb750dde9fd8\consolab.ttf Handle ID: 0x5d8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-font-truetype-consolas_31bf3856ad364e35_10.0.26100.1_none_66e2fb750dde9fd8\consolaz.ttf Handle ID: 0x78c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-font-bitmap-oem_31bf3856ad364e35_10.0.26100.1_none_fa57c54c16f338be\s8514oem.fon Handle ID: 0x720 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-f..etype-lucidaconsole_31bf3856ad364e35_10.0.26100.1_none_fc3a9a99e1476921\lucon.ttf Handle ID: 0x740 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-font-bitmap-system_31bf3856ad364e35_10.0.26100.1_none_804a75475f6bc4e2\s8514sys.fon Handle ID: 0x77c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-font-truetype-consolas_31bf3856ad364e35_10.0.26100.1_none_66e2fb750dde9fd8\consolai.ttf Handle ID: 0x784 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-font-truetype-consolas_31bf3856ad364e35_10.0.26100.1_none_66e2fb750dde9fd8\consola.ttf Handle ID: 0x730 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-font-truetype-segoeui_31bf3856ad364e35_10.0.26100.1_none_cdafac197ac948ed\segmdl2.ttf Handle ID: 0x734 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-font-truetype-segoeui_31bf3856ad364e35_10.0.26100.1_none_cdafac197ac948ed\seguibl.ttf Handle ID: 0x788 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-font-truetype-segoeui_31bf3856ad364e35_10.0.26100.1_none_cdafac197ac948ed\segoeuiz.ttf Handle ID: 0x768 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-f..i_italicssupplement_31bf3856ad364e35_10.0.26100.1_none_9d15a99f10f998c0\seguibli.ttf Handle ID: 0x724 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-font-truetype-segoeui_31bf3856ad364e35_10.0.26100.1_none_cdafac197ac948ed\segoeuii.ttf Handle ID: 0x728 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-f..-microsoftsansserif_31bf3856ad364e35_10.0.26100.1_none_260dad35b0974194\micross.ttf Handle ID: 0x618 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-font-truetype-segoeui_31bf3856ad364e35_10.0.26100.1_none_cdafac197ac948ed\segoeuisl.ttf Handle ID: 0x6f8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-font-truetype-segoeui_31bf3856ad364e35_10.0.26100.1_none_cdafac197ac948ed\segoeuil.ttf Handle ID: 0x6ec Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-font-truetype-segoeui_31bf3856ad364e35_10.0.26100.1_none_cdafac197ac948ed\segoeuib.ttf Handle ID: 0x714 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-f..i_italicssupplement_31bf3856ad364e35_10.0.26100.1_none_9d15a99f10f998c0\seguili.ttf Handle ID: 0x7c4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-font-bitmap-fixed_31bf3856ad364e35_10.0.26100.1_none_7c038aae972c23b7\svgafix.fon Handle ID: 0x7cc Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-font-bitmap-system_31bf3856ad364e35_10.0.26100.1_none_804a75475f6bc4e2\svgasys.fon Handle ID: 0x738 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-f..i_italicssupplement_31bf3856ad364e35_10.0.26100.1_none_9d15a99f10f998c0\seguisbi.ttf Handle ID: 0x690 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-f..i_italicssupplement_31bf3856ad364e35_10.0.26100.1_none_9d15a99f10f998c0\seguisli.ttf Handle ID: 0x7c8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-font-bitmap-oem_31bf3856ad364e35_10.0.26100.1_none_fa57c54c16f338be\vga737.fon Handle ID: 0x768 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-font-bitmap-oem_31bf3856ad364e35_10.0.26100.1_none_fa57c54c16f338be\vga775.fon Handle ID: 0x730 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-font-truetype-sylfaen_31bf3856ad364e35_10.0.26100.1_none_5ba25ab74fbac404\sylfaen.ttf Handle ID: 0x728 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-font-bitmap-oem_31bf3856ad364e35_10.0.26100.1_none_fa57c54c16f338be\vga850.fon Handle ID: 0x784 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-font-bitmap-oem_31bf3856ad364e35_10.0.26100.1_none_fa57c54c16f338be\vga852.fon Handle ID: 0x77c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-font-bitmap-oem_31bf3856ad364e35_10.0.26100.1_none_fa57c54c16f338be\vga855.fon Handle ID: 0x724 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-font-bitmap-oem_31bf3856ad364e35_10.0.26100.1_none_fa57c54c16f338be\vga857.fon Handle ID: 0x714 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-font-bitmap-oem_31bf3856ad364e35_10.0.26100.1_none_fa57c54c16f338be\vga860.fon Handle ID: 0x740 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-font-bitmap-oem_31bf3856ad364e35_10.0.26100.1_none_fa57c54c16f338be\vga861.fon Handle ID: 0x720 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-font-bitmap-oem_31bf3856ad364e35_10.0.26100.1_none_fa57c54c16f338be\vga863.fon Handle ID: 0x788 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-font-bitmap-oem_31bf3856ad364e35_10.0.26100.1_none_fa57c54c16f338be\vga865.fon Handle ID: 0x734 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-font-bitmap-oem_31bf3856ad364e35_10.0.26100.1_none_fa57c54c16f338be\vga866.fon Handle ID: 0x7d4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-font-bitmap-oem_31bf3856ad364e35_10.0.26100.1_none_fa57c54c16f338be\vga869.fon Handle ID: 0x7d8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-font-bitmap-oem_31bf3856ad364e35_10.0.26100.1_none_fa57c54c16f338be\vga932.fon Handle ID: 0x7dc Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-font-bitmap-oem_31bf3856ad364e35_10.0.26100.1_none_fa57c54c16f338be\vga936.fon Handle ID: 0x6ec Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-font-bitmap-oem_31bf3856ad364e35_10.0.26100.1_none_fa57c54c16f338be\vga949.fon Handle ID: 0x784 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-font-bitmap-oem_31bf3856ad364e35_10.0.26100.1_none_fa57c54c16f338be\vga950.fon Handle ID: 0x728 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-font-bitmap-fixed_31bf3856ad364e35_10.0.26100.1_none_7c038aae972c23b7\vgaf1255.fon Handle ID: 0x6d8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-font-bitmap-fixed_31bf3856ad364e35_10.0.26100.1_none_7c038aae972c23b7\vgaf1256.fon Handle ID: 0x664 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-font-bitmap-fixed_31bf3856ad364e35_10.0.26100.1_none_7c038aae972c23b7\vgaf1257.fon Handle ID: 0x768 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-font-bitmap-fixed_31bf3856ad364e35_10.0.26100.1_none_7c038aae972c23b7\vgaf874.fon Handle ID: 0x720 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-font-bitmap-fixed_31bf3856ad364e35_10.0.26100.1_none_7c038aae972c23b7\vgafix.fon Handle ID: 0x7e0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-font-bitmap-fixed_31bf3856ad364e35_10.0.26100.1_none_7c038aae972c23b7\vgafixe.fon Handle ID: 0x7e4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-font-bitmap-fixed_31bf3856ad364e35_10.0.26100.1_none_7c038aae972c23b7\vgafixg.fon Handle ID: 0x7e8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-font-bitmap-fixed_31bf3856ad364e35_10.0.26100.1_none_7c038aae972c23b7\vgafixr.fon Handle ID: 0x6f4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-font-bitmap-fixed_31bf3856ad364e35_10.0.26100.1_none_7c038aae972c23b7\vgafixt.fon Handle ID: 0x6cc Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-font-bitmap-oem_31bf3856ad364e35_10.0.26100.1_none_fa57c54c16f338be\vgaoem.fon Handle ID: 0x6ec Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-font-bitmap-system_31bf3856ad364e35_10.0.26100.1_none_804a75475f6bc4e2\vgas1255.fon Handle ID: 0x7dc Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-font-bitmap-system_31bf3856ad364e35_10.0.26100.1_none_804a75475f6bc4e2\vgas1256.fon Handle ID: 0x7d8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-font-bitmap-system_31bf3856ad364e35_10.0.26100.1_none_804a75475f6bc4e2\vgas1257.fon Handle ID: 0x7d4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-font-bitmap-system_31bf3856ad364e35_10.0.26100.1_none_804a75475f6bc4e2\vgas874.fon Handle ID: 0x734 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-font-bitmap-system_31bf3856ad364e35_10.0.26100.1_none_804a75475f6bc4e2\vgasys.fon Handle ID: 0x784 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-font-bitmap-system_31bf3856ad364e35_10.0.26100.1_none_804a75475f6bc4e2\vgasyse.fon Handle ID: 0x788 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-font-bitmap-system_31bf3856ad364e35_10.0.26100.1_none_804a75475f6bc4e2\vgasysg.fon Handle ID: 0x714 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-font-bitmap-system_31bf3856ad364e35_10.0.26100.1_none_804a75475f6bc4e2\vgasysr.fon Handle ID: 0x724 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-font-bitmap-system_31bf3856ad364e35_10.0.26100.1_none_804a75475f6bc4e2\vgasyst.fon Handle ID: 0x664 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-font-truetype-segoeui_31bf3856ad364e35_10.0.26100.1_none_cdafac197ac948ed\seguisb.ttf Handle ID: 0x6d8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-shell32_31bf3856ad364e35_10.0.26100.1_none_691cd33e7a888844\apps.inf Handle ID: 0x7e4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-font-truetype-tahoma_31bf3856ad364e35_10.0.26100.1_none_2cc0130cdd3011fe\tahoma.ttf Handle ID: 0x78c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-font-truetype-segoeui_31bf3856ad364e35_10.0.26100.1_none_cdafac197ac948ed\seguihis.ttf Handle ID: 0x710 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-font-truetype-tahoma_31bf3856ad364e35_10.0.26100.1_none_2cc0130cdd3011fe\tahomabd.ttf Handle ID: 0x7cc Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-p..al-securitytemplate_31bf3856ad364e35_10.0.26100.1_none_eadc3b59bb581c41\defltrdsh.inf Handle ID: 0x758 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-p..al-securitytemplate_31bf3856ad364e35_10.0.26100.1_none_eadc3b59bb581c41\defltwk.inf Handle ID: 0x7c4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-p..al-securitytemplate_31bf3856ad364e35_10.0.26100.1_none_eadc3b59bb581c41\defltbase.inf Handle ID: 0x5c8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-p..al-securitytemplate_31bf3856ad364e35_10.0.26100.1_none_eadc3b59bb581c41\dwup.inf Handle ID: 0x750 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-p..al-securitytemplate_31bf3856ad364e35_10.0.26100.1_none_eadc3b59bb581c41\dwup-noregkeys.inf Handle ID: 0x6e4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-erratamanager_31bf3856ad364e35_10.0.26100.1_none_6b1a2003d4666c9d\errata.inf Handle ID: 0x72c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-font-truetype-segoeui_31bf3856ad364e35_10.0.26100.1_none_cdafac197ac948ed\seguisym.ttf Handle ID: 0x600 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-font-registrysettings_31bf3856ad364e35_10.0.26100.1_none_92a4fb9c19a94489\fontsetup.inf Handle ID: 0x6f4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-p..al-securitytemplate_31bf3856ad364e35_10.0.26100.1_none_eadc3b59bb581c41\puwk.inf Handle ID: 0x708 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-p..al-securitytemplate_31bf3856ad364e35_10.0.26100.1_none_eadc3b59bb581c41\rdshup.inf Handle ID: 0x7c0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-s..urationengineclient_31bf3856ad364e35_10.0.26100.1_none_35018abc41a80997\sceregvl.inf Handle ID: 0x87c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-s..urationengineclient_31bf3856ad364e35_10.0.26100.1_none_35018abc41a80997\secrecs.inf Handle ID: 0x750 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-t..localsessionmanager_31bf3856ad364e35_10.0.26100.1_none_a238752173174a12\lagcounterdef.h Handle ID: 0x8d8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-t..localsessionmanager_31bf3856ad364e35_10.0.26100.1_none_a238752173174a12\lagcounterdef.ini Handle ID: 0x724 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-rasctrs_31bf3856ad364e35_10.0.26100.1_none_1111c11fdef502c5\rasctrnm.h Handle ID: 0x664 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-rasbase_31bf3856ad364e35_10.0.26100.1_none_0ad41041e2fbdf9e\rasctrnm.h Handle ID: 0x714 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-rasctrs_31bf3856ad364e35_10.0.26100.1_none_1111c11fdef502c5\rasctrs.ini Handle ID: 0x764 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-rasctrs.resources_31bf3856ad364e35_10.0.26100.1_en-us_bd22249a469c8ffc\rasctrs.ini Handle ID: 0x7d4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-e..ocol-legacy-schemas_31bf3856ad364e35_10.0.26100.1_none_b501bf19b1a58c9d\baseeapconnectionpropertiesv1.xsd Handle ID: 0x5d4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-e..-protocol-host-peer_31bf3856ad364e35_10.0.26100.1_none_6107338d2bf6c2f0\baseeapmethodconfig.xsd Handle ID: 0x8dc Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-e..-protocol-host-peer_31bf3856ad364e35_10.0.26100.1_none_6107338d2bf6c2f0\baseeapmethodusercredentials.xsd Handle ID: 0x5cc Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-e..ocol-legacy-schemas_31bf3856ad364e35_10.0.26100.1_none_b501bf19b1a58c9d\baseeapuserpropertiesv1.xsd Handle ID: 0x7a8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-e..-protocol-host-peer_31bf3856ad364e35_10.0.26100.1_none_6107338d2bf6c2f0\eapcommon.xsd Handle ID: 0x70c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-e..-protocol-host-peer_31bf3856ad364e35_10.0.26100.1_none_6107338d2bf6c2f0\EapGenericUserCredentials.xsd Handle ID: 0x778 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-e..ocol-legacy-schemas_31bf3856ad364e35_10.0.26100.1_none_b501bf19b1a58c9d\eapconnectionpropertiesv1.xsd Handle ID: 0x728 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-e..-protocol-host-peer_31bf3856ad364e35_10.0.26100.1_none_6107338d2bf6c2f0\eaphostconfig.xsd Handle ID: 0x73c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-e..ocol-legacy-schemas_31bf3856ad364e35_10.0.26100.1_none_b501bf19b1a58c9d\eapuserpropertiesv1.xsd Handle ID: 0x690 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-e..-protocol-host-peer_31bf3856ad364e35_10.0.26100.1_none_6107338d2bf6c2f0\eaphostusercredentials.xsd Handle ID: 0x6f4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-eapmethods_31bf3856ad364e35_10.0.26100.1_none_a37f5cafe9cafad5\eaptlsconnectionpropertiesv2.xsd Handle ID: 0x718 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-eapmethods_31bf3856ad364e35_10.0.26100.1_none_a37f5cafe9cafad5\eaptlsuserpropertiesv1.xsd Handle ID: 0x600 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-eapmethods_31bf3856ad364e35_10.0.26100.1_none_a37f5cafe9cafad5\eaptlsconnectionpropertiesv3.xsd Handle ID: 0x8e8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-eapmethods_31bf3856ad364e35_10.0.26100.1_none_a37f5cafe9cafad5\mschapv2connectionpropertiesv1.xsd Handle ID: 0x8ec Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-eapmethods_31bf3856ad364e35_10.0.26100.1_none_a37f5cafe9cafad5\mschapv2userpropertiesv1.xsd Handle ID: 0x8f0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-eapmethods_31bf3856ad364e35_10.0.26100.1_none_a37f5cafe9cafad5\eaptlsconnectionpropertiesv1.xsd Handle ID: 0x8f4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-eapmethods_31bf3856ad364e35_10.0.26100.1_none_a37f5cafe9cafad5\mspeapconnectionpropertiesv3.xsd Handle ID: 0x8f8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-eapmethods_31bf3856ad364e35_10.0.26100.1_none_a37f5cafe9cafad5\mspeapconnectionpropertiesv2.xsd Handle ID: 0x8fc Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-eapmethods_31bf3856ad364e35_10.0.26100.1_none_a37f5cafe9cafad5\mspeapuserpropertiesv1.xsd Handle ID: 0x808 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-eapmethods_31bf3856ad364e35_10.0.26100.1_none_a37f5cafe9cafad5\mspeapconnectionpropertiesv1.xsd Handle ID: 0x758 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..tingversion-default_31bf3856ad364e35_10.0.26100.1_none_9d3ae767b1770ad6\SortDefault.nls Handle ID: 0x80c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-wrp-integrity-api_31bf3856ad364e35_10.0.26100.1_none_05ac63474272db95\wrpintapi.dll Handle ID: 0x788 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-servicingstack-msg_31bf3856ad364e35_10.0.26100.1_none_3b9312539394020b\CbsMsg.dll Handle ID: 0x5c8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-cbsapi_31bf3856ad364e35_10.0.26100.1_none_4b557b7658f39179\CbsApi.dll Handle ID: 0x908 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-trustedinstaller_31bf3856ad364e35_10.0.26100.1_none_8e00dbe4b5b35080\TrustedInstaller.exe Handle ID: 0x854 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\x86_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.5074_none_49349333becd638e\x86_installed Handle ID: 0xec8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.5074_none_a5532eb7772ad4c4\amd64_installed Handle ID: 0xecc Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-a..aextension-hvsocket_31bf3856ad364e35_10.0.26100.1_none_3c2a6e766a753651\4545ffe2-0dc4-4df4-9d02-299ef204635e_hvsocket.dll Handle ID: 0xed0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-onecore-e..ervice-apisetschema_31bf3856ad364e35_10.0.26100.1_none_f7ced21ac554bc4a\69fe178f-26e7-43a9-aa7d-2b616b672dde_eventlogservice.dll Handle ID: 0xed4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-onecore-pnp-drvsetup_31bf3856ad364e35_10.0.26100.1_none_5ad15de8cc234363\6bea57fb-8dfb-4177-9ae8-42e8b3529933_RuntimeDeviceInstall.dll Handle ID: 0xed8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-onecore-ras-base-vpn_31bf3856ad364e35_10.0.26100.1_none_1950fce546b368de\@VpnToastIcon.png Handle ID: 0xedc Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-aero_31bf3856ad364e35_10.0.26100.1_none_a8d6b9eb81f630ce\aero.msstyles Handle ID: 0xee0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-a..es-interface-router_31bf3856ad364e35_10.0.26100.1_none_54e9af08e715c7cc\activeds.tlb Handle ID: 0xee4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-system-counters_31bf3856ad364e35_10.0.26100.1_none_6425b4a30f33208a\advapi32res.dll Handle ID: 0xeec Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-a..es-interface-router_31bf3856ad364e35_10.0.26100.1_none_54e9af08e715c7cc\activeds.dll Handle ID: 0xef0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-a..terface-ldapc-layer_31bf3856ad364e35_10.0.26100.1_none_5c261c99cf09f401\adsldpc.dll Handle ID: 0xef4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-advpack_31bf3856ad364e35_11.0.26100.1_none_dcb088b2c637064c\advpack.dll Handle ID: 0xef8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-aclui_31bf3856ad364e35_10.0.26100.1_none_51fe067e1c335541\aclui.dll Handle ID: 0xefc Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-u..-client-aggregators_31bf3856ad364e35_10.0.26100.1_none_718ba9d05da6acd8\AggregatorHost.exe Handle ID: 0xf00 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-apisetschema-windows_31bf3856ad364e35_10.0.26100.1_none_272037e8c336c288\apisetschema.dll Handle ID: 0xf04 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-tcpip-utility_31bf3856ad364e35_10.0.26100.1_none_2fba9c0ab76abd38\ARP.EXE Handle ID: 0xf08 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-apx-proxyextension_31bf3856ad364e35_10.0.26100.1_none_8eaa16663bbb4edc\Apx01000.dll Handle ID: 0xf0c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-o..mation-asyncfilters_31bf3856ad364e35_10.0.26100.1_none_73bd128621adc521\asycfilt.dll Handle ID: 0xf14 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-atl_31bf3856ad364e35_10.0.26100.1_none_a813e826c23f076c\atl.dll Handle ID: 0x964 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-gdi_31bf3856ad364e35_10.0.26100.1_none_a6c6c0d8c312f7d1\atmlib.dll Handle ID: 0xf1c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-attrib_31bf3856ad364e35_10.0.26100.1_none_af81c311f4c11a95\attrib.exe Handle ID: 0xf20 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-a..ence-inventory-core_31bf3856ad364e35_10.0.26100.1_none_5bc77bf361ec6bb1\aepic.dll Handle ID: 0xf24 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-basesrv_31bf3856ad364e35_10.0.26100.1_none_09be93364c476855\basesrv.dll Handle ID: 0xf28 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-advapi32_31bf3856ad364e35_10.0.26100.1_none_e03bfa0aef0e5335\advapi32.dll Handle ID: 0xf2c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-a..on-authui-component_31bf3856ad364e35_10.0.26100.1_none_d9caf3467864548e\authui.dll Handle ID: 0xf30 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-b..-configuration-data_31bf3856ad364e35_10.0.26100.1_none_ff6019d2887bd9d1\bcd.dll Handle ID: 0xf34 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-s..entication-usermode_31bf3856ad364e35_10.0.26100.1_none_37156b93dce106a3\authz.dll Handle ID: 0x738 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-b..tiondata-com-server_31bf3856ad364e35_10.0.26100.1_none_dc970442cd48e4c9\bcdsrv.dll Handle ID: 0x840 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-bcdboot-cmdlinetool_31bf3856ad364e35_10.0.26100.1_none_5e498cf5a6b10113\bcdboot.exe Handle ID: 0x968 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-msauditevtlog_31bf3856ad364e35_10.0.26100.1_none_c43622aee0fa0f41\adtschema.dll Handle ID: 0xf18 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-bcrypt-dll_31bf3856ad364e35_10.0.26100.1_none_eb803bcd57f24314\bcrypt.dll Handle ID: 0x974 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-bcp47languages_31bf3856ad364e35_10.0.26100.1_none_975df6213f604dfa\BCP47mrm.dll Handle ID: 0x970 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-b..environment-strings_31bf3856ad364e35_10.0.26100.1_none_f575b80d757af501\bootstr.dll Handle ID: 0x980 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-b..ment-bootsectortool_31bf3856ad364e35_10.0.26100.1_none_09820cf4fe1727ff\bootsect.exe Handle ID: 0x984 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-bootvid_31bf3856ad364e35_10.0.26100.1_none_356d23d9eec0f720\BOOTVID.DLL Handle ID: 0x97c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-bcp47languages_31bf3856ad364e35_10.0.26100.1_none_975df6213f604dfa\BCP47Langs.dll Handle ID: 0x858 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-browserservice-netapi_31bf3856ad364e35_10.0.26100.1_none_2a810c3a00476b40\browcli.dll Handle ID: 0x994 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-browseui_31bf3856ad364e35_10.0.26100.1_none_2dd68a134ee267a1\browseui.dll Handle ID: 0xf3c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-b..iondata-cmdlinetool_31bf3856ad364e35_10.0.26100.1_none_851ea5260db83ad0\bcdedit.exe Handle ID: 0xf40 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-b..vironment-servicing_31bf3856ad364e35_10.0.26100.1_none_230829930e210d15\bootsvc.dll Handle ID: 0xf44 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-brokerbase_31bf3856ad364e35_10.0.26100.1_none_806c4d4dd434445f\BrokerLib.dll Handle ID: 0xf48 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-capisp-dll_31bf3856ad364e35_10.0.26100.1_none_cefbe847a5d2aa06\capisp.dll Handle ID: 0xf4c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-cabapi_31bf3856ad364e35_10.0.26100.1_none_5a991ca04424f5e3\cabapi.dll Handle ID: 0xf50 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-cabinet_31bf3856ad364e35_10.0.26100.1_none_3432f97d4a784ecb\cabinet.dll Handle ID: 0xf54 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-bcrypt-primitives-dll_31bf3856ad364e35_10.0.26100.1_none_0f2521c57f96e761\bcryptprimitives.dll Handle ID: 0xf58 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-cfmifs_31bf3856ad364e35_10.0.26100.1_none_ed147d6ec1919337\cfmifs.dll Handle ID: 0xf5c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-cfmifs_31bf3856ad364e35_10.0.26100.1_none_ed147d6ec1919337\cfmifsproxy.dll Handle ID: 0x96c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-m..ommandlineutilities_31bf3856ad364e35_10.0.26100.1_none_7a109607cfe12f00\chcp.com Handle ID: 0x7f4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-lddmcore_31bf3856ad364e35_10.0.26100.1_none_a8bc40ff4c196001\cdd.dll Handle ID: 0x960 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-chkdsk_31bf3856ad364e35_10.0.26100.1_none_beda0240f53d1815\chkdsk.exe Handle ID: 0x99c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-autochk_31bf3856ad364e35_10.0.26100.1_none_dee795aa2a4dbd74\autochk.exe Handle ID: 0x998 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-autochkconfigurator_31bf3856ad364e35_10.0.26100.1_none_15b623f8f051104d\chkntfs.exe Handle ID: 0x978 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-onecore-pnp-devicemanagement_31bf3856ad364e35_10.0.26100.1_none_40549e17c6806703\cfgmgr32.dll Handle ID: 0x708 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-c..tionauthorityclient_31bf3856ad364e35_10.0.26100.1_none_d4715ddca53422ab\certcli.dll Handle ID: 0x9a0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-cimfs_31bf3856ad364e35_10.0.26100.1_none_542d5b1e4da4c6a7\cimfs.dll Handle ID: 0xf10 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-f..utilitylibrariesext_31bf3856ad364e35_10.0.26100.1_none_6df78b860fdb67a4\cmdext.dll Handle ID: 0x7e0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-convert_31bf3856ad364e35_10.0.26100.1_none_99c8f31c10dece84\cnvfat.dll Handle ID: 0x870 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-commandprompt_31bf3856ad364e35_10.0.26100.1_none_88006f1d82e923f4\cmd.exe Handle ID: 0x694 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-com-ole_31bf3856ad364e35_10.0.26100.1_none_f3239941203ad949\comcat.dll Handle ID: 0x854 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-network-security-winpe_31bf3856ad364e35_10.0.26100.1_none_e2fcca147f6c32b0\BFE.DLL Handle ID: 0x6c4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-f..allconfig-installer_31bf3856ad364e35_10.0.26100.1_none_141cd69f6754a8c8\cmifw.dll Handle ID: 0x85c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-compact_31bf3856ad364e35_10.0.26100.1_none_f6e8e32b1e1f23da\compact.exe Handle ID: 0x868 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-com-complus.res_31bf3856ad364e35_10.0.26100.1_none_29a483384ebe73a8\comres.dll Handle ID: 0x93c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-c..services-certca-dll_31bf3856ad364e35_10.0.26100.1_none_00e216c1529aaaf2\certca.dll Handle ID: 0x804 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-com-coml2_31bf3856ad364e35_10.0.26100.1_none_1ab0fc60e6844320\coml2.dll Handle ID: 0x7d0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-codeintegrity_31bf3856ad364e35_10.0.26100.1_none_9d6b999e6d4c7ecb\ci.dll Handle ID: 0x838 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-consolehostv1_31bf3856ad364e35_10.0.26100.1_none_3b9e501322a4ffc1\ConhostV1.dll Handle ID: 0x720 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-convert_31bf3856ad364e35_10.0.26100.1_none_99c8f31c10dece84\convert.exe Handle ID: 0x618 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-onecore-console-host-propsheet_31bf3856ad364e35_10.0.26100.1_none_1acc0a8b863be088\console.dll Handle ID: 0xf38 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-virtualdiskapilibrary_31bf3856ad364e35_10.0.26100.1_none_ea5648aa70fe7df0\convertvhd.exe Handle ID: 0x990 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-comdlg32_31bf3856ad364e35_10.0.26100.1_none_b2a4ba020e342e2a\comdlg32.dll Handle ID: 0x6e4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-consolelogon-library_31bf3856ad364e35_10.0.26100.1_none_82485ab98f8427df\ConsoleLogon.dll Handle ID: 0x7c0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-f..rcluster-clientcore_31bf3856ad364e35_10.0.26100.1_none_8e3b30cca0ec36b8\clusapi.dll Handle ID: 0x6b8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-onecore-c..rivacysettingsstore_31bf3856ad364e35_10.0.26100.1_none_0512d0a13761e5f4\CorePrivacySettingsStore.dll Handle ID: 0x754 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-c..ov2fahelper-library_31bf3856ad364e35_10.0.26100.1_none_adbaca04bdfc2b87\CredProv2faHelper.dll Handle ID: 0x77c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-c..vcommoncore-library_31bf3856ad364e35_10.0.26100.1_none_64059cf6dd08cd16\CredProvCommonCore.dll Handle ID: 0x7fc Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-a..cation-creduibroker_31bf3856ad364e35_10.0.26100.1_none_c7aec83e75c51ffd\CredentialUIBroker.exe Handle ID: 0x864 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-onecore-console-host-core_31bf3856ad364e35_10.0.26100.1_none_6a89ebd08cc1ac19\conhost.exe Handle ID: 0x98c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-c..iderslegacy-library_31bf3856ad364e35_10.0.26100.1_none_5960cc668e9a9747\credprovslegacy.dll Handle ID: 0x87c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-c..alproviders-library_31bf3856ad364e35_10.0.26100.1_none_890ea87bc4aa7c12\credprovs.dll Handle ID: 0x878 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-credui-onecore_31bf3856ad364e35_10.0.26100.1_none_784985418c529a23\credui.dll Handle ID: 0x768 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-cryptbase_31bf3856ad364e35_10.0.26100.1_none_62597dd9168691ba\cryptbase.dll Handle ID: 0x6f0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-credprovhost-library_31bf3856ad364e35_10.0.26100.1_none_b071450a96ada6c0\credprovhost.dll Handle ID: 0x988 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-cryptdlg-dll_31bf3856ad364e35_10.0.26100.1_none_1f7c058280a2aa1f\cryptdlg.dll Handle ID: 0x860 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-cryptdll-dll_31bf3856ad364e35_10.0.26100.1_none_02922e4716520baa\cryptdll.dll Handle ID: 0x9a8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-cryptcatsvc-dll_31bf3856ad364e35_10.0.26100.1_none_aca3518c5bab79d8\cryptcatsvc.dll Handle ID: 0x9a4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-c..ovdatamodel-library_31bf3856ad364e35_10.0.26100.1_none_ab40340fbf9ba049\CredProvDataModel.dll Handle ID: 0x6b0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-cryptext-dll_31bf3856ad364e35_10.0.26100.1_none_fc866b1b7e45bb6d\cryptext.dll Handle ID: 0x72c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-cryptsp-dll_31bf3856ad364e35_10.0.26100.1_none_2651166d6f591ced\cryptsp.dll Handle ID: 0x6b4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-onecore-coremessaging_31bf3856ad364e35_10.0.26100.1_none_44767be84c14895a\CoreMessaging.dll Handle ID: 0x874 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-cryptnet-dll_31bf3856ad364e35_10.0.26100.1_none_140ce97a646253c9\cryptnet.dll Handle ID: 0x734 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-cryptsvc-dll_31bf3856ad364e35_10.0.26100.1_none_72f341c5035be86e\cryptsvc.dll Handle ID: 0x6cc Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-cryptxml_31bf3856ad364e35_10.0.26100.1_none_4bf51833127dd600\cryptxml.dll Handle ID: 0x9b8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-csrsrv_31bf3856ad364e35_10.0.26100.1_none_c67adf660dea3c4e\csrsrv.dll Handle ID: 0x9c0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-csrss_31bf3856ad364e35_10.0.26100.1_none_55d78c384ca248d1\csrss.exe Handle ID: 0x78c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-systemeventsbroker_31bf3856ad364e35_10.0.26100.1_none_c594ec35a6085cf8\CSystemEventsBrokerClient.dll Handle ID: 0x62c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..codepage-additional_31bf3856ad364e35_10.0.26100.1_none_52510bf8a87b298a\C_037.NLS Handle ID: 0x86c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\wow64_microsoft-windows-flighting-settings_31bf3856ad364e35_10.0.26100.1_none_901ea6ad8c047b20\ctac.json Handle ID: 0x9c8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-flighting-settings_31bf3856ad364e35_10.0.26100.1_none_85c9fc5b57a3b925\ctac.json Handle ID: 0x9bc Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..codepage-additional_31bf3856ad364e35_10.0.26100.1_none_52510bf8a87b298a\C_10000.NLS Handle ID: 0x7f0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..codepage-additional_31bf3856ad364e35_10.0.26100.1_none_52510bf8a87b298a\C_10002.NLS Handle ID: 0x7bc Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..codepage-additional_31bf3856ad364e35_10.0.26100.1_none_52510bf8a87b298a\C_10001.NLS Handle ID: 0x750 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..codepage-additional_31bf3856ad364e35_10.0.26100.1_none_52510bf8a87b298a\C_10004.NLS Handle ID: 0x9b0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-cryptui-dll_31bf3856ad364e35_10.0.26100.1_none_82e203bf00afed9c\cryptui.dll Handle ID: 0x9b4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..codepage-additional_31bf3856ad364e35_10.0.26100.1_none_52510bf8a87b298a\C_10005.NLS Handle ID: 0x7b8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..codepage-additional_31bf3856ad364e35_10.0.26100.1_none_52510bf8a87b298a\C_10006.NLS Handle ID: 0x9d0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..codepage-additional_31bf3856ad364e35_10.0.26100.1_none_52510bf8a87b298a\C_10007.NLS Handle ID: 0x790 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..codepage-additional_31bf3856ad364e35_10.0.26100.1_none_52510bf8a87b298a\C_10010.NLS Handle ID: 0x74c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..codepage-additional_31bf3856ad364e35_10.0.26100.1_none_52510bf8a87b298a\C_10017.NLS Handle ID: 0x9cc Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..codepage-additional_31bf3856ad364e35_10.0.26100.1_none_52510bf8a87b298a\C_10003.NLS Handle ID: 0x9c4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..codepage-additional_31bf3856ad364e35_10.0.26100.1_none_52510bf8a87b298a\C_10021.NLS Handle ID: 0x740 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..codepage-additional_31bf3856ad364e35_10.0.26100.1_none_52510bf8a87b298a\C_10008.NLS Handle ID: 0x7a0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..codepage-additional_31bf3856ad364e35_10.0.26100.1_none_52510bf8a87b298a\C_10029.NLS Handle ID: 0xf60 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..codepage-additional_31bf3856ad364e35_10.0.26100.1_none_52510bf8a87b298a\C_10079.NLS Handle ID: 0xf64 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..codepage-additional_31bf3856ad364e35_10.0.26100.1_none_52510bf8a87b298a\C_10081.NLS Handle ID: 0xf68 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..codepage-additional_31bf3856ad364e35_10.0.26100.1_none_52510bf8a87b298a\C_10082.NLS Handle ID: 0x884 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..codepage-additional_31bf3856ad364e35_10.0.26100.1_none_52510bf8a87b298a\C_1026.NLS Handle ID: 0x7e8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..codepage-additional_31bf3856ad364e35_10.0.26100.1_none_52510bf8a87b298a\C_1047.NLS Handle ID: 0x784 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..codepage-additional_31bf3856ad364e35_10.0.26100.1_none_52510bf8a87b298a\C_1140.NLS Handle ID: 0x710 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..codepage-additional_31bf3856ad364e35_10.0.26100.1_none_52510bf8a87b298a\C_1141.NLS Handle ID: 0x888 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..codepage-additional_31bf3856ad364e35_10.0.26100.1_none_52510bf8a87b298a\C_1142.NLS Handle ID: 0x9e4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..codepage-additional_31bf3856ad364e35_10.0.26100.1_none_52510bf8a87b298a\C_1143.NLS Handle ID: 0x9d8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..codepage-additional_31bf3856ad364e35_10.0.26100.1_none_52510bf8a87b298a\C_1144.NLS Handle ID: 0x9d4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..codepage-additional_31bf3856ad364e35_10.0.26100.1_none_52510bf8a87b298a\C_1145.NLS Handle ID: 0x7b4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..codepage-additional_31bf3856ad364e35_10.0.26100.1_none_52510bf8a87b298a\C_1146.NLS Handle ID: 0x5d8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..codepage-additional_31bf3856ad364e35_10.0.26100.1_none_52510bf8a87b298a\C_1147.NLS Handle ID: 0x748 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..codepage-additional_31bf3856ad364e35_10.0.26100.1_none_52510bf8a87b298a\C_1148.NLS Handle ID: 0x814 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..codepage-additional_31bf3856ad364e35_10.0.26100.1_none_52510bf8a87b298a\C_1149.NLS Handle ID: 0x7b0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..ional-codepage-core_31bf3856ad364e35_10.0.26100.1_none_33c86d6465b31eba\C_1250.NLS Handle ID: 0x9e0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..ional-codepage-core_31bf3856ad364e35_10.0.26100.1_none_33c86d6465b31eba\C_1251.NLS Handle ID: 0x9ac Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..ional-codepage-core_31bf3856ad364e35_10.0.26100.1_none_33c86d6465b31eba\C_1252.NLS Handle ID: 0x7e4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..ional-codepage-core_31bf3856ad364e35_10.0.26100.1_none_33c86d6465b31eba\C_1253.NLS Handle ID: 0x9ec Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..ional-codepage-core_31bf3856ad364e35_10.0.26100.1_none_33c86d6465b31eba\C_1254.NLS Handle ID: 0x880 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..ional-codepage-core_31bf3856ad364e35_10.0.26100.1_none_33c86d6465b31eba\C_1255.NLS Handle ID: 0x9e8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..ional-codepage-core_31bf3856ad364e35_10.0.26100.1_none_33c86d6465b31eba\C_1256.NLS Handle ID: 0x794 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..ional-codepage-core_31bf3856ad364e35_10.0.26100.1_none_33c86d6465b31eba\C_1257.NLS Handle ID: 0x9f0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..ional-codepage-core_31bf3856ad364e35_10.0.26100.1_none_33c86d6465b31eba\C_1258.NLS Handle ID: 0x704 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..ional-codepage-core_31bf3856ad364e35_10.0.26100.1_none_33c86d6465b31eba\C_20000.NLS Handle ID: 0x9f4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..ional-codepage-core_31bf3856ad364e35_10.0.26100.1_none_33c86d6465b31eba\C_20001.NLS Handle ID: 0x9dc Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..ional-codepage-core_31bf3856ad364e35_10.0.26100.1_none_33c86d6465b31eba\C_1361.NLS Handle ID: 0x89c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..ional-codepage-core_31bf3856ad364e35_10.0.26100.1_none_33c86d6465b31eba\C_20002.NLS Handle ID: 0x894 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..ional-codepage-core_31bf3856ad364e35_10.0.26100.1_none_33c86d6465b31eba\C_20003.NLS Handle ID: 0x9f8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..codepage-additional_31bf3856ad364e35_10.0.26100.1_none_52510bf8a87b298a\C_20105.NLS Handle ID: 0xf6c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..codepage-additional_31bf3856ad364e35_10.0.26100.1_none_52510bf8a87b298a\C_20106.NLS Handle ID: 0xf70 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..ional-codepage-core_31bf3856ad364e35_10.0.26100.1_none_33c86d6465b31eba\C_20004.NLS Handle ID: 0xf74 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..codepage-additional_31bf3856ad364e35_10.0.26100.1_none_52510bf8a87b298a\C_20107.NLS Handle ID: 0xa00 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..ional-codepage-core_31bf3856ad364e35_10.0.26100.1_none_33c86d6465b31eba\C_20005.NLS Handle ID: 0x79c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..ional-codepage-core_31bf3856ad364e35_10.0.26100.1_none_33c86d6465b31eba\C_20127.NLS Handle ID: 0x898 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..codepage-additional_31bf3856ad364e35_10.0.26100.1_none_52510bf8a87b298a\C_20108.NLS Handle ID: 0x9fc Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..codepage-additional_31bf3856ad364e35_10.0.26100.1_none_52510bf8a87b298a\C_20269.NLS Handle ID: 0x7ac Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..codepage-additional_31bf3856ad364e35_10.0.26100.1_none_52510bf8a87b298a\C_20273.NLS Handle ID: 0x700 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..ional-codepage-core_31bf3856ad364e35_10.0.26100.1_none_33c86d6465b31eba\C_20261.NLS Handle ID: 0x88c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-crypt32-dll_31bf3856ad364e35_10.0.26100.1_none_58636a3c4660615f\crypt32.dll Handle ID: 0xf78 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..codepage-additional_31bf3856ad364e35_10.0.26100.1_none_52510bf8a87b298a\C_20277.NLS Handle ID: 0xf7c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..codepage-additional_31bf3856ad364e35_10.0.26100.1_none_52510bf8a87b298a\C_20278.NLS Handle ID: 0x798 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..codepage-additional_31bf3856ad364e35_10.0.26100.1_none_52510bf8a87b298a\C_20280.NLS Handle ID: 0xf80 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..codepage-additional_31bf3856ad364e35_10.0.26100.1_none_52510bf8a87b298a\C_20284.NLS Handle ID: 0x6fc Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..codepage-additional_31bf3856ad364e35_10.0.26100.1_none_52510bf8a87b298a\C_20285.NLS Handle ID: 0x8a4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..codepage-additional_31bf3856ad364e35_10.0.26100.1_none_52510bf8a87b298a\C_20290.NLS Handle ID: 0xf84 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..codepage-additional_31bf3856ad364e35_10.0.26100.1_none_52510bf8a87b298a\C_20297.NLS Handle ID: 0xa08 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..codepage-additional_31bf3856ad364e35_10.0.26100.1_none_52510bf8a87b298a\C_20420.NLS Handle ID: 0xf88 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..codepage-additional_31bf3856ad364e35_10.0.26100.1_none_52510bf8a87b298a\C_20423.NLS Handle ID: 0xf8c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..codepage-additional_31bf3856ad364e35_10.0.26100.1_none_52510bf8a87b298a\C_20424.NLS Handle ID: 0xf90 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..codepage-additional_31bf3856ad364e35_10.0.26100.1_none_52510bf8a87b298a\C_20833.NLS Handle ID: 0xf94 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..codepage-additional_31bf3856ad364e35_10.0.26100.1_none_52510bf8a87b298a\C_20838.NLS Handle ID: 0xf98 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..ional-codepage-core_31bf3856ad364e35_10.0.26100.1_none_33c86d6465b31eba\C_20866.NLS Handle ID: 0xf9c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..codepage-additional_31bf3856ad364e35_10.0.26100.1_none_52510bf8a87b298a\C_20871.NLS Handle ID: 0xfa0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..codepage-additional_31bf3856ad364e35_10.0.26100.1_none_52510bf8a87b298a\C_20880.NLS Handle ID: 0xfa4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..codepage-additional_31bf3856ad364e35_10.0.26100.1_none_52510bf8a87b298a\C_20905.NLS Handle ID: 0xfa8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..codepage-additional_31bf3856ad364e35_10.0.26100.1_none_52510bf8a87b298a\C_20924.NLS Handle ID: 0x6e0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..codepage-additional_31bf3856ad364e35_10.0.26100.1_none_52510bf8a87b298a\C_21025.NLS Handle ID: 0xa0c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..codepage-additional_31bf3856ad364e35_10.0.26100.1_none_52510bf8a87b298a\C_21027.NLS Handle ID: 0x770 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..ional-codepage-core_31bf3856ad364e35_10.0.26100.1_none_33c86d6465b31eba\C_21866.NLS Handle ID: 0x8a8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..ional-codepage-core_31bf3856ad364e35_10.0.26100.1_none_33c86d6465b31eba\C_20932.NLS Handle ID: 0xa04 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..ional-codepage-core_31bf3856ad364e35_10.0.26100.1_none_33c86d6465b31eba\C_20936.NLS Handle ID: 0xa1c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..ional-codepage-core_31bf3856ad364e35_10.0.26100.1_none_33c86d6465b31eba\C_28591.NLS Handle ID: 0xa20 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..ional-codepage-core_31bf3856ad364e35_10.0.26100.1_none_33c86d6465b31eba\C_28592.NLS Handle ID: 0x760 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..ional-codepage-core_31bf3856ad364e35_10.0.26100.1_none_33c86d6465b31eba\C_28593.NLS Handle ID: 0xa14 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..ional-codepage-core_31bf3856ad364e35_10.0.26100.1_none_33c86d6465b31eba\C_28594.NLS Handle ID: 0xfac Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..ional-codepage-core_31bf3856ad364e35_10.0.26100.1_none_33c86d6465b31eba\C_28595.NLS Handle ID: 0xfb0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..ional-codepage-core_31bf3856ad364e35_10.0.26100.1_none_33c86d6465b31eba\C_28596.NLS Handle ID: 0xa24 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..ional-codepage-core_31bf3856ad364e35_10.0.26100.1_none_33c86d6465b31eba\C_20949.NLS Handle ID: 0x76c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..ional-codepage-core_31bf3856ad364e35_10.0.26100.1_none_33c86d6465b31eba\C_28597.NLS Handle ID: 0xfb4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..ional-codepage-core_31bf3856ad364e35_10.0.26100.1_none_33c86d6465b31eba\C_28598.NLS Handle ID: 0xfb8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..ional-codepage-core_31bf3856ad364e35_10.0.26100.1_none_33c86d6465b31eba\C_28599.NLS Handle ID: 0xfbc Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..ional-codepage-core_31bf3856ad364e35_10.0.26100.1_none_33c86d6465b31eba\c_28603.nls Handle ID: 0xfc0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..ional-codepage-core_31bf3856ad364e35_10.0.26100.1_none_33c86d6465b31eba\C_28605.NLS Handle ID: 0xfc4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..ional-codepage-core_31bf3856ad364e35_10.0.26100.1_none_33c86d6465b31eba\C_437.NLS Handle ID: 0xfc8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..ional-codepage-core_31bf3856ad364e35_10.0.26100.1_none_33c86d6465b31eba\C_708.NLS Handle ID: 0xfcc Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..codepage-additional_31bf3856ad364e35_10.0.26100.1_none_52510bf8a87b298a\C_500.NLS Handle ID: 0xa34 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..ional-codepage-core_31bf3856ad364e35_10.0.26100.1_none_33c86d6465b31eba\C_720.NLS Handle ID: 0xa30 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..ional-codepage-core_31bf3856ad364e35_10.0.26100.1_none_33c86d6465b31eba\C_737.NLS Handle ID: 0x8b0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..ional-codepage-core_31bf3856ad364e35_10.0.26100.1_none_33c86d6465b31eba\C_775.NLS Handle ID: 0x8ac Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..ional-codepage-core_31bf3856ad364e35_10.0.26100.1_none_33c86d6465b31eba\C_850.NLS Handle ID: 0x8b8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..ional-codepage-core_31bf3856ad364e35_10.0.26100.1_none_33c86d6465b31eba\C_852.NLS Handle ID: 0xa3c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..ional-codepage-core_31bf3856ad364e35_10.0.26100.1_none_33c86d6465b31eba\C_855.NLS Handle ID: 0xa38 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..ional-codepage-core_31bf3856ad364e35_10.0.26100.1_none_33c86d6465b31eba\C_857.NLS Handle ID: 0x8b4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..ional-codepage-core_31bf3856ad364e35_10.0.26100.1_none_33c86d6465b31eba\C_858.NLS Handle ID: 0xa28 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..ional-codepage-core_31bf3856ad364e35_10.0.26100.1_none_33c86d6465b31eba\C_860.NLS Handle ID: 0x7a4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..ional-codepage-core_31bf3856ad364e35_10.0.26100.1_none_33c86d6465b31eba\C_861.NLS Handle ID: 0x8c0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..ional-codepage-core_31bf3856ad364e35_10.0.26100.1_none_33c86d6465b31eba\C_862.NLS Handle ID: 0x8bc Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..ional-codepage-core_31bf3856ad364e35_10.0.26100.1_none_33c86d6465b31eba\C_863.NLS Handle ID: 0xa10 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..ional-codepage-core_31bf3856ad364e35_10.0.26100.1_none_33c86d6465b31eba\C_864.NLS Handle ID: 0xa18 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..ional-codepage-core_31bf3856ad364e35_10.0.26100.1_none_33c86d6465b31eba\C_865.NLS Handle ID: 0x780 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..ional-codepage-core_31bf3856ad364e35_10.0.26100.1_none_33c86d6465b31eba\C_866.NLS Handle ID: 0x890 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..ional-codepage-core_31bf3856ad364e35_10.0.26100.1_none_33c86d6465b31eba\C_869.NLS Handle ID: 0x774 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..codepage-additional_31bf3856ad364e35_10.0.26100.1_none_52510bf8a87b298a\C_870.NLS Handle ID: 0x8a0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..codepage-additional_31bf3856ad364e35_10.0.26100.1_none_52510bf8a87b298a\C_875.NLS Handle ID: 0x8cc Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..ional-codepage-core_31bf3856ad364e35_10.0.26100.1_none_33c86d6465b31eba\C_874.NLS Handle ID: 0x724 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..ional-codepage-core_31bf3856ad364e35_10.0.26100.1_none_33c86d6465b31eba\C_936.NLS Handle ID: 0x75c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..ional-codepage-core_31bf3856ad364e35_10.0.26100.1_none_33c86d6465b31eba\C_932.NLS Handle ID: 0xa44 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..ional-codepage-core_31bf3856ad364e35_10.0.26100.1_none_33c86d6465b31eba\C_950.NLS Handle ID: 0x8c8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..ional-codepage-core_31bf3856ad364e35_10.0.26100.1_none_33c86d6465b31eba\c_GSM7.DLL Handle ID: 0x8d0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..ional-codepage-core_31bf3856ad364e35_10.0.26100.1_none_33c86d6465b31eba\C_949.NLS Handle ID: 0xa40 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..codepage-additional_31bf3856ad364e35_10.0.26100.1_none_52510bf8a87b298a\C_ISCII.DLL Handle ID: 0x8c4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..ional-codepage-core_31bf3856ad364e35_10.0.26100.1_none_33c86d6465b31eba\C_IS2022.DLL Handle ID: 0xa2c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..ional-codepage-core_31bf3856ad364e35_10.0.26100.1_none_33c86d6465b31eba\C_G18030.DLL Handle ID: 0xfd0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-d..opactivitybrokerapi_31bf3856ad364e35_10.0.26100.1_none_7a7b9545b6331685\dabapi.dll Handle ID: 0xfd4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-webdavredir-helper_31bf3856ad364e35_10.0.26100.1_none_31925b7566fb2acf\davhlpr.dll Handle ID: 0x714 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-desktopactivitybroker_31bf3856ad364e35_10.0.26100.1_none_d4b89b3daaaa86d1\dab.dll Handle ID: 0x8d4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-com-base_31bf3856ad364e35_10.0.26100.1_none_0ae1ded78f1218c8\combase.dll Handle ID: 0x8d8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-gdi_31bf3856ad364e35_10.0.26100.1_none_a6c6c0d8c312f7d1\dciman32.dll Handle ID: 0x764 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-debugcore_31bf3856ad364e35_10.0.26100.1_none_f9641774b3f85ea7\dbgcore.dll Handle ID: 0x5d4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-font-truetype-segoeui_31bf3856ad364e35_10.0.26100.1_none_cdafac197ac948ed\seguiemj.ttf Handle ID: 0x8e0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-defrag-core_31bf3856ad364e35_10.0.26100.1_none_155210e6209935ae\defragres.dll Handle ID: 0xa58 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-defrag-core_31bf3856ad364e35_10.0.26100.1_none_155210e6209935ae\defragproxy.dll Handle ID: 0xfd8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-devicecensus_31bf3856ad364e35_10.0.26100.1_none_ac6617ea63136600\DeviceCensus.exe Handle ID: 0xfdc Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-cryptoss-dll_31bf3856ad364e35_10.0.26100.1_none_bb7c31cba4095b37\cryptoss.dll Handle ID: 0xa60 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-deviceupdateagent_31bf3856ad364e35_10.0.26100.1_none_557793db256d7501\DeviceUpdateAgent.dll Handle ID: 0xa50 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-s..authfactor-credprov_31bf3856ad364e35_10.0.26100.1_none_e5216e40b725294d\devicengccredprov.dll Handle ID: 0x7cc Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-onecore-p..evicemanagement-rtl_31bf3856ad364e35_10.0.26100.1_none_25b8b81fe5538812\devrtl.dll Handle ID: 0xa48 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-onecore-p..evicemanagement-rtl_31bf3856ad364e35_10.0.26100.1_none_25b8b81fe5538812\devobj.dll Handle ID: 0xa4c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-defrag-core_31bf3856ad364e35_10.0.26100.1_none_155210e6209935ae\defragsvc.dll Handle ID: 0x73c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-dhcpcmonitor_31bf3856ad364e35_10.0.26100.1_none_d2f2fd80d3405033\dhcpcmonitor.dll Handle ID: 0x6c0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-dfsclient-netapi_31bf3856ad364e35_10.0.26100.1_none_5d8fe3b099043a25\dfscli.dll Handle ID: 0x744 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-coreuicomponents_31bf3856ad364e35_10.0.26100.1_none_409e7587a657d082\CoreUIComponents.dll Handle ID: 0xfe0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-dhcp-client-dll-minwin_31bf3856ad364e35_10.0.26100.1_none_69e859eec19752a4\dhcpcsvc.dll Handle ID: 0xfe4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-dhcp-client-dll-minwin_31bf3856ad364e35_10.0.26100.1_none_69e859eec19752a4\dhcpcsvc6.dll Handle ID: 0xfe8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-u..ed-telemetry-client_31bf3856ad364e35_10.0.26100.1_none_9ce698286f793873\diagnosticdataquery.dll Handle ID: 0xfec Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-telemetrypermission_31bf3856ad364e35_10.0.26100.1_none_ec30ab447cffbefd\DiagnosticDataSettings.dll Handle ID: 0xff0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-dhcp-client-dll-minwin_31bf3856ad364e35_10.0.26100.1_none_69e859eec19752a4\dhcpcore6.dll Handle ID: 0xff4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-dhcp-client-dll-minwin_31bf3856ad364e35_10.0.26100.1_none_69e859eec19752a4\dhcpcore.dll Handle ID: 0xff8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-wer-sdktools_31bf3856ad364e35_10.0.26100.1_none_3d159ca749751acb\DbgModel.dll Handle ID: 0xffc Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-diskpart_31bf3856ad364e35_10.0.26100.1_none_65cc0dbafe798149\diskpart.exe Handle ID: 0x8f4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-difxapi_31bf3856ad364e35_10.0.26100.1_none_053745eefebeb6e2\difxapi.dll Handle ID: 0x690 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-devicecensus_31bf3856ad364e35_10.0.26100.1_none_ac6617ea63136600\dcntel.dll Handle ID: 0x8f8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-com-surrogate-core_31bf3856ad364e35_10.0.26100.1_none_31de38653f24ac6d\dllhost.exe Handle ID: 0x8e8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-com-surrogate_31bf3856ad364e35_10.0.26100.1_none_411797165c0e9bfb\dllhst3g.exe Handle ID: 0x5cc Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-directmanipulation_31bf3856ad364e35_10.0.26100.1_none_4a0fc0420a1ab8c1\directmanipulation.dll Handle ID: 0xa64 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-d..agement-commandline_31bf3856ad364e35_10.0.26100.1_none_2c71a164fb9ef26f\Dism.exe Handle ID: 0x6d8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-diskraid_31bf3856ad364e35_10.0.26100.1_none_627d4c710086cc28\diskraid.exe Handle ID: 0x7ec Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-m..ommandlineutilities_31bf3856ad364e35_10.0.26100.1_none_7a109607cfe12f00\doskey.exe Handle ID: 0x7c8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-dns-client_31bf3856ad364e35_10.0.26100.1_none_ded6253deae5fdf0\dnscacheugc.exe Handle ID: 0xa5c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-dpapi-dll_31bf3856ad364e35_10.0.26100.1_none_74d8046e7b0b2982\dpapi.dll Handle ID: 0x70c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-dpapi-keys_31bf3856ad364e35_10.0.26100.1_none_7ac67b5c35fd6e5c\dpapimig.exe Handle ID: 0x664 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-dpapisrv-dll_31bf3856ad364e35_10.0.26100.1_none_10a7f1fb246f13d1\dpapisrv.dll Handle ID: 0x788 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-driverquery_31bf3856ad364e35_10.0.26100.1_none_931673d5fd963a61\driverquery.exe Handle ID: 0xa54 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-dns-client-minwin_31bf3856ad364e35_10.0.26100.1_none_927f5c208bb2346b\dnsrslvr.dll Handle ID: 0x71c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-debughelp_31bf3856ad364e35_10.0.26100.1_none_f5404076b698209d\dbghelp.dll Handle ID: 0x80c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-winpe-drvload_31bf3856ad364e35_10.0.26100.1_none_890c729d587d6d97\drvload.exe Handle ID: 0x8f0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-onecore-pnp-drvsetup_31bf3856ad364e35_10.0.26100.1_none_5ad15de8cc234363\drvsetup.dll Handle ID: 0xa70 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-d..oryservices-dsparse_31bf3856ad364e35_10.0.26100.1_none_4d0b6f27ead429db\dsparse.dll Handle ID: 0x8fc Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-onecore-pnp-drvinst_31bf3856ad364e35_10.0.26100.1_none_525185f0d2776a36\drvinst.exe Handle ID: 0xa74 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-dns-client-minwin_31bf3856ad364e35_10.0.26100.1_none_927f5c208bb2346b\dnsapi.dll Handle ID: 0x908 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-dssetupcli_31bf3856ad364e35_10.0.26100.1_none_f62dc9a9212d2ea3\dsrole.dll Handle ID: 0xa6c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-d..cing-management-api_31bf3856ad364e35_10.0.26100.1_none_a3b580c1c7d8bd08\DismApi.dll Handle ID: 0xa7c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-d..ellman_software_csp_31bf3856ad364e35_10.0.26100.1_none_38ec63e3ed7147db\dssenh.dll Handle ID: 0xa78 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-u..ed-telemetry-client_31bf3856ad364e35_10.0.26100.1_none_9ce698286f793873\dtdump.exe Handle ID: 0x7c4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-deltapackageexpander_31bf3856ad364e35_10.0.26100.1_none_66d23e8f9d9475d0\dpx.dll Handle ID: 0x758 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-d..opwindowmanager-api_31bf3856ad364e35_10.0.26100.1_none_dd028ceda889f579\dwmapi.dll Handle ID: 0x8ec Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-graphics-wdi_31bf3856ad364e35_10.0.26100.1_none_05e50520facd289d\dxgwdi.dll Handle ID: 0xa94 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-e..otocol-host-service_31bf3856ad364e35_10.0.26100.1_none_873d904166aaaa8f\Eap3Host.exe Handle ID: 0xa98 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-e..-protocol-host-peer_31bf3856ad364e35_10.0.26100.1_none_6107338d2bf6c2f0\eapp3hst.dll Handle ID: 0xa9c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-duser_31bf3856ad364e35_10.0.26100.1_none_576856a965071c7e\duser.dll Handle ID: 0xaa0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-e..-protocol-host-peer_31bf3856ad364e35_10.0.26100.1_none_6107338d2bf6c2f0\eappcfg.dll Handle ID: 0xaa4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-eappcfgui_31bf3856ad364e35_10.0.26100.1_none_8b5059ad045929cb\eappcfgui.dll Handle ID: 0xa90 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-e..-protocol-host-peer_31bf3856ad364e35_10.0.26100.1_none_6107338d2bf6c2f0\eappgnui.dll Handle ID: 0xaa8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-drvstore_31bf3856ad364e35_10.0.26100.1_none_ede7fd8bac11c80e\drvstore.dll Handle ID: 0xa8c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-e..-protocol-host-peer_31bf3856ad364e35_10.0.26100.1_none_6107338d2bf6c2f0\eappprxy.dll Handle ID: 0xa88 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-onecoreuap-raschap_31bf3856ad364e35_10.0.26100.1_none_b7e4795b8183fb51\eapprovp.dll Handle ID: 0xab0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-e..-protocol-host-peer_31bf3856ad364e35_10.0.26100.1_none_6107338d2bf6c2f0\eapphost.dll Handle ID: 0xaac Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-u..eregistration-winpe_31bf3856ad364e35_10.0.26100.1_none_4fedd2aed06339e3\dsreg.dll Handle ID: 0xab4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-e..otocol-host-service_31bf3856ad364e35_10.0.26100.1_none_873d904166aaaa8f\eapsvc.dll Handle ID: 0xa80 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-eapprivateutil_31bf3856ad364e35_10.0.26100.1_none_f51c23e44928fbea\eapputil.dll Handle ID: 0xa68 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-eapteap_31bf3856ad364e35_10.0.26100.1_none_1ea7230ec2293767\EapTeapAuth.dll Handle ID: 0xac0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-eapteap_31bf3856ad364e35_10.0.26100.1_none_1ea7230ec2293767\EapTeapConfig.dll Handle ID: 0xabc Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-efs-lsa-extension_31bf3856ad364e35_10.0.26100.1_none_c62e0cab1d83b8ac\efslsaext.dll Handle ID: 0xab8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-efs-service_31bf3856ad364e35_10.0.26100.1_none_53386c678d48f1a1\efssvc.dll Handle ID: 0xacc Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-dui70_31bf3856ad364e35_10.0.26100.1_none_54a8583166a7617c\dui70.dll Handle ID: 0xac8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-ie-runtimeutilities_31bf3856ad364e35_11.0.26100.1_none_7888cd925feaa89f\edgeIso.dll Handle ID: 0x6f4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-efs-util-library_31bf3856ad364e35_10.0.26100.1_none_440d09c80b5b2f00\efsutil.dll Handle ID: 0xad8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-etw-ese_31bf3856ad364e35_10.0.26100.1_none_cc4e7afeeee8d3b1\ETWESEProviderResources.dll Handle ID: 0xadc Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-eventaggregation_31bf3856ad364e35_10.0.26100.1_none_aaaa33b385affacd\EventAggregation.dll Handle ID: 0xad4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-vss-eventcls_31bf3856ad364e35_10.0.26100.1_none_df539bdb67b9e130\eventcls.dll Handle ID: 0xae0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-expand_31bf3856ad364e35_10.0.26100.1_none_556624dcc06d0b8d\expand.exe Handle ID: 0xae4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..humb-shift_keyboard_31bf3856ad364e35_10.0.26100.1_none_eab513c0f88a5464\f3ahvoas.dll Handle ID: 0xad0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-e..lestorageengine-vss_31bf3856ad364e35_10.0.26100.1_none_b57e2974c0735fde\esevss.dll Handle ID: 0xaec Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-f..sedwritefilter-util_31bf3856ad364e35_10.0.26100.1_none_2f809c85c98e2ef0\fbwflib.dll Handle ID: 0xac4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-directwrite_31bf3856ad364e35_10.0.26100.1_none_cf91178267fbaa39\DWrite.dll Handle ID: 0xae8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-e..ageengine-utilities_31bf3856ad364e35_10.0.26100.1_none_d67f955e2dcdbbb2\esentutl.exe Handle ID: 0xaf0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-m..ommandlineutilities_31bf3856ad364e35_10.0.26100.1_none_457f9751bea691f1\find.exe Handle ID: 0xaf8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-errorreportingfaults_31bf3856ad364e35_10.0.26100.1_none_6cfac502a555ebbe\Faultrep.dll Handle ID: 0x1004 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-tcpip-utility_31bf3856ad364e35_10.0.26100.1_none_2fba9c0ab76abd38\finger.exe Handle ID: 0xafc Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-efs-core-library_31bf3856ad364e35_10.0.26100.1_none_53958be600172965\efscore.dll Handle ID: 0xaf4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-mapi_31bf3856ad364e35_10.0.26100.1_none_a840e9af824c49aa\fixmapi.exe Handle ID: 0x1008 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-filtermanager-utils_31bf3856ad364e35_10.0.26100.1_none_16815b628de44866\fltLib.dll Handle ID: 0x100c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-filtermanager-utils_31bf3856ad364e35_10.0.26100.1_none_16815b628de44866\fltMC.exe Handle ID: 0x1010 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-feclient_31bf3856ad364e35_10.0.26100.1_none_bbcdb98bc0216f65\feclient.dll Handle ID: 0x1014 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-fmifs_31bf3856ad364e35_10.0.26100.1_none_540219e59a23d04a\fmifs.dll Handle ID: 0x1018 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-f..eatureconfiguration_31bf3856ad364e35_10.0.26100.1_none_54d97650293b92b2\fcon.dll Handle ID: 0x101c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-filtermanager-core_31bf3856ad364e35_10.0.26100.1_none_0dfd1b529358ac0a\fltmgrres.dll Handle ID: 0x1020 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-gdi_31bf3856ad364e35_10.0.26100.1_none_a6c6c0d8c312f7d1\fontsub.dll Handle ID: 0x1024 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-font-fms_31bf3856ad364e35_10.0.26100.1_none_44c65dfe1cdcce4b\fms.dll Handle ID: 0xb04 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-format_31bf3856ad364e35_10.0.26100.1_none_237c8b12f2862d5e\format.com Handle ID: 0xb00 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-f..utilitylibrariesext_31bf3856ad364e35_10.0.26100.1_none_6df78b860fdb67a4\fsutilext.dll Handle ID: 0x1028 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-u..ed-telemetry-client_31bf3856ad364e35_10.0.26100.1_none_9ce698286f793873\diagtrack.dll Handle ID: 0x102c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-ftp_31bf3856ad364e35_10.0.26100.1_none_a9df0650c116983b\ftp.exe Handle ID: 0x1030 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_networking-mpssvc-svc_31bf3856ad364e35_10.0.26100.1_none_9707e3d93069581e\FirewallAPI.dll Handle ID: 0x1034 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-fsutil_31bf3856ad364e35_10.0.26100.1_none_c957bcd9587936b6\fsutil.exe Handle ID: 0x1038 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-s..ertificates-utility_31bf3856ad364e35_10.0.26100.1_none_85f1549293367603\fvecerts.dll Handle ID: 0x103c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_networking-mpssvc-svc_31bf3856ad364e35_10.0.26100.1_none_9707e3d93069581e\fwbase.dll Handle ID: 0x614 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-gdi_31bf3856ad364e35_10.0.26100.1_none_a6c6c0d8c312f7d1\fontdrvhost.exe Handle ID: 0xb0c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_networking-mpssvc-svc_31bf3856ad364e35_10.0.26100.1_none_9707e3d93069581e\fwpolicyiomgr.dll Handle ID: 0x7f8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-flighting-settings_31bf3856ad364e35_10.0.26100.1_none_85c9fc5b57a3b925\FlightSettings.dll Handle ID: 0xa84 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-onecore-n..rity-domain-clients_31bf3856ad364e35_10.0.26100.1_none_f1312171c7b6e6c6\FwRemoteSvr.dll Handle ID: 0xb08 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-gdi32_31bf3856ad364e35_10.0.26100.1_none_5672525cb1de25f0\gdi32.dll Handle ID: 0xb1c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-securestartup-core_31bf3856ad364e35_10.0.26100.1_none_31ce4e495aab9357\fveapibase.dll Handle ID: 0x914 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-s..-gmsaclient-library_31bf3856ad364e35_10.0.26100.1_none_28b1ae71c51cac91\gmsaclient.dll Handle ID: 0xb18 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-grouppolicy-base_31bf3856ad364e35_10.0.26100.1_none_25170a3f4f8f408a\gpapi.dll Handle ID: 0x810 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-hal_31bf3856ad364e35_10.0.26100.1_none_a81c9b04c236d1da\hal.dll Handle ID: 0xb14 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-network-security-winpe_31bf3856ad364e35_10.0.26100.1_none_e2fcca147f6c32b0\FWPUCLNT.DLL Handle ID: 0x1040 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-hid-dll_31bf3856ad364e35_10.0.26100.1_none_c5a1e25d7ad7318f\hid.dll Handle ID: 0xb28 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-hid-user_31bf3856ad364e35_10.0.26100.1_none_d39ff0cdeffb42bc\hidserv.dll Handle ID: 0x828 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-tcpip-utility_31bf3856ad364e35_10.0.26100.1_none_2fba9c0ab76abd38\HOSTNAME.EXE Handle ID: 0x1044 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_hyperv-hvsocketapi_31bf3856ad364e35_10.0.26100.1_none_207a457471be6900\HvSocket.dll Handle ID: 0x910 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-http-api_31bf3856ad364e35_10.0.26100.1_none_f29fe56005d87458\httpapi.dll Handle ID: 0x81c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-icacls_31bf3856ad364e35_10.0.26100.1_none_2fa847710e86cbe0\icacls.exe Handle ID: 0x730 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-t..-platform-libraries_31bf3856ad364e35_10.0.26100.1_none_e764934603dac597\icmp.dll Handle ID: 0x82c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_networking-mpssvc-svc_31bf3856ad364e35_10.0.26100.1_none_9707e3d93069581e\icfupgd.dll Handle ID: 0x1048 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-securestartup-core_31bf3856ad364e35_10.0.26100.1_none_31ce4e495aab9357\fveapi.dll Handle ID: 0x830 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-rasifmon_31bf3856ad364e35_10.0.26100.1_none_c7c3723355bb1a5c\ifmon.dll Handle ID: 0x904 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-ifsutilx_31bf3856ad364e35_10.0.26100.1_none_703d6c195c4d0d8d\ifsutilx.dll Handle ID: 0x918 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-gdi32full_31bf3856ad364e35_10.0.26100.1_none_52df1bd08fcf91c9\gdi32full.dll Handle ID: 0x90c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-coreos_31bf3856ad364e35_10.0.26100.1_none_2245eea7a6dde1bc\imagehlp.dll Handle ID: 0xb10 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-f..temutilitylibraries_31bf3856ad364e35_10.0.26100.1_none_e68a00385839f41d\ifsutil.dll Handle ID: 0x104c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-wer-sdktools_31bf3856ad364e35_10.0.26100.1_none_3d159ca749751acb\dbgeng.dll Handle ID: 0x1050 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-imagesp1-embedded_31bf3856ad364e35_10.0.26100.1_none_dcbf969a79c2cdaf\imagesp1.dll Handle ID: 0x1054 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-grouppolicy-base_31bf3856ad364e35_10.0.26100.1_none_25170a3f4f8f408a\gpsvc.dll Handle ID: 0x6bc Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-imapiv2-legacyshim_31bf3856ad364e35_10.0.26100.1_none_30f035d10307996c\imapi.dll Handle ID: 0x824 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-imm32_31bf3856ad364e35_10.0.26100.1_none_5949c676e2f79787\imm32.dll Handle ID: 0x928 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft.windows.gdiplus.systemcopy_31bf3856ad364e35_10.0.26100.1_none_e3ce3ee55e9a1e83\GdiPlus.dll Handle ID: 0xb34 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-infdefaultinstall_31bf3856ad364e35_10.0.26100.1_none_69882c20049c047e\InfDefaultInstall.exe Handle ID: 0x1058 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-snmp-inetmib1-raw-file_31bf3856ad364e35_10.0.26100.1_none_1f90b8083f3136a1\inetmib1.dll Handle ID: 0xb40 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-ipconfig_31bf3856ad364e35_10.0.26100.1_none_492d9960807b3cd6\ipconfig.exe Handle ID: 0xb3c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-t..rm-libraries-minwin_31bf3856ad364e35_10.0.26100.1_none_9ca69317d98a1dee\IPHLPAPI.DLL Handle ID: 0xb2c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-imapiv2-base_31bf3856ad364e35_10.0.26100.1_none_bffe18467b2e52f1\imapi2.dll Handle ID: 0xb48 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-t..sframework-inputdll_31bf3856ad364e35_10.0.26100.1_none_598a9b142de20f07\input.dll Handle ID: 0x105c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-c..-joinprovideronline_31bf3856ad364e35_10.0.26100.1_none_5317d6d38a66572b\joinproviderol.dll Handle ID: 0xb50 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_11.0.26100.1_none_32ce16b675398a42\jsproxy.dll Handle ID: 0xb4c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..se_standard_101_key_31bf3856ad364e35_10.0.26100.1_none_0661ef83809589a4\kbd101.dll Handle ID: 0xb44 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..eyboard-korean_101a_31bf3856ad364e35_10.0.26100.1_none_82ba447c8329fb26\kbd101a.dll Handle ID: 0xb58 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-e..estorageengine-isam_31bf3856ad364e35_10.0.26100.1_none_eed7ef419498598e\esent.dll Handle ID: 0xb5c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..eyboard-korean_101b_31bf3856ad364e35_10.0.26100.1_none_82ba2db4832a14c7\kbd101b.dll Handle ID: 0xb60 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-c..tprovision-joinutil_31bf3856ad364e35_10.0.26100.1_none_7216eb82e8b81677\joinutil.dll Handle ID: 0x1064 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..eyboard-korean_101c_31bf3856ad364e35_10.0.26100.1_none_82ba16ec832a2e68\kbd101c.dll Handle ID: 0xb54 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..keyboard-korean_103_31bf3856ad364e35_10.0.26100.1_none_b43892250b7c4831\kbd103.dll Handle ID: 0xb68 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..rd-japanese_106_key_31bf3856ad364e35_10.0.26100.1_none_d9fb12d37c280a2b\kbd106.dll Handle ID: 0xb6c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-network-security-winpe_31bf3856ad364e35_10.0.26100.1_none_e2fcca147f6c32b0\IKEEXT.DLL Handle ID: 0xb64 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..l-keyboard-00000401_31bf3856ad364e35_10.0.26100.1_none_e435ccabccc4540f\KBDA1.DLL Handle ID: 0x106c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..rd-japanese_106_key_31bf3856ad364e35_10.0.26100.1_none_d9fb12d37c280a2b\kbd106n.dll Handle ID: 0x1070 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..l-keyboard-00010401_31bf3856ad364e35_10.0.26100.1_none_875410b4bf557148\KBDA2.DLL Handle ID: 0x1074 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..l-keyboard-0000041c_31bf3856ad364e35_10.0.26100.1_none_fa621cdfbe83500e\KBDAL.DLL Handle ID: 0x1078 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..l-keyboard-00140c00_31bf3856ad364e35_10.0.26100.1_none_599ec7ffb0ceba04\KBDADLM.DLL Handle ID: 0x107c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..l-keyboard-00020401_31bf3856ad364e35_10.0.26100.1_none_2a7254bdb1e68e81\KBDA3.DLL Handle ID: 0x1080 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..l-keyboard-0000042b_31bf3856ad364e35_10.0.26100.1_none_f9f07ee9becc6528\KBDARME.DLL Handle ID: 0xb88 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..l-keyboard-0002042b_31bf3856ad364e35_10.0.26100.1_none_402d06fba3ee9f9a\kbdarmph.dll Handle ID: 0xb84 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..l-keyboard-0003042b_31bf3856ad364e35_10.0.26100.1_none_e34b4b04967fbcd3\kbdarmty.dll Handle ID: 0xb80 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..l-keyboard-0001042b_31bf3856ad364e35_10.0.26100.1_none_9d0ec2f2b15d8261\KBDARMW.DLL Handle ID: 0xb7c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..panese_ax2_keyboard_31bf3856ad364e35_10.0.26100.1_none_b99b5691348e86d7\kbdax2.dll Handle ID: 0xb78 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..l-keyboard-0000082c_31bf3856ad364e35_10.0.26100.1_none_fa66073fbe7fcf0b\KBDAZE.DLL Handle ID: 0xb74 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..l-keyboard-0000042c_31bf3856ad364e35_10.0.26100.1_none_fa620617be8369af\KBDAZEL.DLL Handle ID: 0xb8c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..l-keyboard-0001042c_31bf3856ad364e35_10.0.26100.1_none_9d804a20b11486e8\KBDAZST.DLL Handle ID: 0xb70 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..2-filesystemsupport_31bf3856ad364e35_10.0.26100.1_none_7ead1b37cd8e97f8\imapi2fs.dll Handle ID: 0xba0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..l-keyboard-0000046d_31bf3856ad364e35_10.0.26100.1_none_fad33225be3ad4ba\KBDBASH.DLL Handle ID: 0x1068 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..l-keyboard-00020402_31bf3856ad364e35_10.0.26100.1_none_2ae3dbebb19d9308\KBDBGPH.DLL Handle ID: 0xb9c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..onal-keyboard-kbdbe_31bf3856ad364e35_10.0.26100.1_none_73d01b0e82185452\KBDBE.DLL Handle ID: 0xba8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..l-keyboard-0001080c_31bf3856ad364e35_10.0.26100.1_none_9d8478d8b110b902\KBDBENE.DLL Handle ID: 0xba4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..l-keyboard-00040402_31bf3856ad364e35_10.0.26100.1_none_712063fd96bfcd7a\KBDBGPH1.DLL Handle ID: 0xbb0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..l-keyboard-0000201a_31bf3856ad364e35_10.0.26100.1_none_f9656d83bf291986\KBDBHC.DLL Handle ID: 0xbac Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..l-keyboard-00000423_31bf3856ad364e35_10.0.26100.1_none_e518ad77cc32905f\KBDBLR.DLL Handle ID: 0xbb8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..l-keyboard-00000402_31bf3856ad364e35_10.0.26100.1_none_e4a753d9cc7b5896\KBDBU.DLL Handle ID: 0xbbc Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..onal-keyboard-kbdbr_31bf3856ad364e35_10.0.26100.1_none_73438c128281bf8f\KBDBR.DLL Handle ID: 0xbb4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..l-keyboard-000b0c00_31bf3856ad364e35_10.0.26100.1_none_bfdc9cd32d3aaba3\KBDBUG.DLL Handle ID: 0x820 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..l-keyboard-00030402_31bf3856ad364e35_10.0.26100.1_none_ce021ff4a42eb041\KBDBULG.DLL Handle ID: 0x8e4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..l-keyboard-00001009_31bf3856ad364e35_10.0.26100.1_none_e7b33507ca882edc\KBDCA.DLL Handle ID: 0xb98 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..l-keyboard-00011009_31bf3856ad364e35_10.0.26100.1_none_8ad17910bd194c15\KBDCAN.DLL Handle ID: 0x6ac Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..l-keyboard-0001045c_31bf3856ad364e35_10.0.26100.1_none_9d8005c8b114d3cb\KBDCHERP.DLL Handle ID: 0x83c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..l-keyboard-0000045c_31bf3856ad364e35_10.0.26100.1_none_fa61c1bfbe83b692\KBDCHER.DLL Handle ID: 0xbc4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..l-keyboard-00060409_31bf3856ad364e35_10.0.26100.1_none_ba779e5179e3279d\KBDCMK.DLL Handle ID: 0xbc8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..onal-keyboard-kbdcr_31bf3856ad364e35_10.0.26100.1_none_73b513408238c416\KBDCR.DLL Handle ID: 0x92c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..l-keyboard-00000405_31bf3856ad364e35_10.0.26100.1_none_e5fbe963cba0662b\KBDCZ.DLL Handle ID: 0x938 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..l-keyboard-00010405_31bf3856ad364e35_10.0.26100.1_none_891a2d6cbe318364\KBDCZ1.DLL Handle ID: 0xbc0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..l-keyboard-00020405_31bf3856ad364e35_10.0.26100.1_none_2c387175b0c2a09d\KBDCZ2.DLL Handle ID: 0x84c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..l-keyboard-00000406_31bf3856ad364e35_10.0.26100.1_none_e66d7091cb576ab2\KBDDA.DLL Handle ID: 0xbcc Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-n..-domain-clients-svc_31bf3856ad364e35_10.0.26100.1_none_410220325491d8f1\IPSECSVC.DLL Handle ID: 0xbd0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..l-keyboard-00000465_31bf3856ad364e35_10.0.26100.1_none_e5fb60b3cba0fff1\KBDDIV1.DLL Handle ID: 0xbd4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..l-keyboard-00010465_31bf3856ad364e35_10.0.26100.1_none_8919a4bcbe321d2a\KBDDIV2.DLL Handle ID: 0xb94 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..l-keyboard-00010409_31bf3856ad364e35_10.0.26100.1_none_8ae04a24bd0d9580\KBDDV.DLL Handle ID: 0xbd8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..l-keyboard-00000c51_31bf3856ad364e35_10.0.26100.1_none_e4646859cc9a7b2d\KBDDZO.DLL Handle ID: 0x1084 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..l-keyboard-0001040a_31bf3856ad364e35_10.0.26100.1_none_9c9d6954b1a64a98\KBDES.DLL Handle ID: 0x1088 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..l-keyboard-00000425_31bf3856ad364e35_10.0.26100.1_none_e5fbbbd3cba0996d\KBDEST.DLL Handle ID: 0x108c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..l-keyboard-00000429_31bf3856ad364e35_10.0.26100.1_none_e7c1d88bca7cab89\KBDFA.DLL Handle ID: 0x1090 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..l-keyboard-00050429_31bf3856ad364e35_10.0.26100.1_none_17592cb887523da6\kbdfar.dll Handle ID: 0x1094 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..l-keyboard-00000c0c_31bf3856ad364e35_10.0.26100.1_none_fa91413dbe58dd66\KBDFC.DLL Handle ID: 0x1098 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..l-keyboard-0000040b_31bf3856ad364e35_10.0.26100.1_none_f9f0ac79becc31e6\KBDFI.DLL Handle ID: 0x109c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..nal-keyboard-kbdfi1_31bf3856ad364e35_10.0.26100.1_none_59cba34a338ab81b\KBDFI1.DLL Handle ID: 0x10a0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..l-keyboard-00000438_31bf3856ad364e35_10.0.26100.1_none_e7503a95cac5c0a3\KBDFO.DLL Handle ID: 0x10a4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..l-keyboard-0000040c_31bf3856ad364e35_10.0.26100.1_none_fa6233a7be83366d\KBDFR.DLL Handle ID: 0x10a8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..l-keyboard-00120c00_31bf3856ad364e35_10.0.26100.1_none_13623fedcbac7f92\KBDFTHRK.DLL Handle ID: 0x10ac Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..l-keyboard-0001040c_31bf3856ad364e35_10.0.26100.1_none_9d8077b0b11453a6\KBDFRNA.DLL Handle ID: 0x10b0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..l-keyboard-0002040c_31bf3856ad364e35_10.0.26100.1_none_409ebbb9a3a570df\KBDFRNB.DLL Handle ID: 0x10b4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..l-keyboard-00000437_31bf3856ad364e35_10.0.26100.1_none_e6deb367cb0ebc1c\KBDGEO.DLL Handle ID: 0x10b8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..l-keyboard-00011809_31bf3856ad364e35_10.0.26100.1_none_8ad97b60bd1216cd\KBDGAE.DLL Handle ID: 0x10bc Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..l-keyboard-00020437_31bf3856ad364e35_10.0.26100.1_none_2d1b3b79b030f68e\kbdgeoer.dll Handle ID: 0x10c0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..l-keyboard-00030437_31bf3856ad364e35_10.0.26100.1_none_d0397f82a2c213c7\kbdgeome.dll Handle ID: 0x834 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..l-keyboard-00040437_31bf3856ad364e35_10.0.26100.1_none_7357c38b95533100\kbdgeooa.dll Handle ID: 0x10c4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..l-keyboard-00010437_31bf3856ad364e35_10.0.26100.1_none_89fcf770bd9fd955\kbdgeoqw.dll Handle ID: 0x900 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..l-keyboard-00050408_31bf3856ad364e35_10.0.26100.1_none_16e7d31a879b05dd\KBDGKL.DLL Handle ID: 0x10c8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..l-keyboard-00000474_31bf3856ad364e35_10.0.26100.1_none_e589c2bdcbea150b\KBDGN.DLL Handle ID: 0x10cc Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..l-keyboard-00000407_31bf3856ad364e35_10.0.26100.1_none_e6def7bfcb0e6f39\KBDGR.DLL Handle ID: 0x10d0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..l-keyboard-00020407_31bf3856ad364e35_10.0.26100.1_none_2d1b7fd1b030a9ab\KBDGRE1.DLL Handle ID: 0x10d4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..l-keyboard-00010407_31bf3856ad364e35_10.0.26100.1_none_89fd3bc8bd9f8c72\KBDGR1.DLL Handle ID: 0x10d8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..l-keyboard-00030407_31bf3856ad364e35_10.0.26100.1_none_d039c3daa2c1c6e4\KBDGRE2.DLL Handle ID: 0x10dc Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..l-keyboard-0000046f_31bf3856ad364e35_10.0.26100.1_none_fbb64081bda8ddc8\KBDGRLND.DLL Handle ID: 0xc0c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..l-keyboard-000c0c00_31bf3856ad364e35_10.0.26100.1_none_62fae0dc1fcbc8dc\KBDGTHC.DLL Handle ID: 0x10e0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..l-keyboard-00000468_31bf3856ad364e35_10.0.26100.1_none_e74ff63dcac60d86\KBDHAU.DLL Handle ID: 0xc08 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..l-keyboard-00000475_31bf3856ad364e35_10.0.26100.1_none_e5fb49ebcba11992\KBDHAW.DLL Handle ID: 0xc04 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..l-keyboard-00000408_31bf3856ad364e35_10.0.26100.1_none_e7507eedcac573c0\KBDHE.DLL Handle ID: 0x7a8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..l-keyboard-00010408_31bf3856ad364e35_10.0.26100.1_none_8a6ec2f6bd5690f9\KBDHE220.DLL Handle ID: 0x778 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..l-keyboard-00020408_31bf3856ad364e35_10.0.26100.1_none_2d8d06ffafe7ae32\KBDHE319.DLL Handle ID: 0x728 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..l-keyboard-0000040d_31bf3856ad364e35_10.0.26100.1_none_fad3bad5be3a3af4\KBDHEB.DLL Handle ID: 0x718 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..l-keyboard-0002040d_31bf3856ad364e35_10.0.26100.1_none_411042e7a35c7566\kbdhebl3.dll Handle ID: 0x600 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..l-keyboard-0003040d_31bf3856ad364e35_10.0.26100.1_none_e42e86f095ed929f\kbdhebsi.dll Handle ID: 0xc28 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..l-keyboard-00030408_31bf3856ad364e35_10.0.26100.1_none_d0ab4b08a278cb6b\KBDHELA2.DLL Handle ID: 0xc30 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..l-keyboard-00040408_31bf3856ad364e35_10.0.26100.1_none_73c98f119509e8a4\KBDHELA3.DLL Handle ID: 0xc24 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..l-keyboard-0001040e_31bf3856ad364e35_10.0.26100.1_none_9e63860cb0825cb4\KBDHU1.DLL Handle ID: 0xc38 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..l-keyboard-00060408_31bf3856ad364e35_10.0.26100.1_none_ba0617237a2c2316\KBDHEPT.DLL Handle ID: 0x5c8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..l-keyboard-0000040e_31bf3856ad364e35_10.0.26100.1_none_fb454203bdf13f7b\KBDHU.DLL Handle ID: 0x930 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..oard-japanese_ibm02_31bf3856ad364e35_10.0.26100.1_none_4f6ee089f2b18dc4\kbdibm02.dll Handle ID: 0x934 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..l-keyboard-00000470_31bf3856ad364e35_10.0.26100.1_none_e3c3a605cd0e02ef\KBDIBO.DLL Handle ID: 0xbfc Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..l-keyboard-0000040f_31bf3856ad364e35_10.0.26100.1_none_fbb6c931bda84402\KBDIC.DLL Handle ID: 0xbf8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..l-keyboard-0000044d_31bf3856ad364e35_10.0.26100.1_none_fad35fb5be3aa178\KBDINASA.DLL Handle ID: 0xbf4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..l-keyboard-00010445_31bf3856ad364e35_10.0.26100.1_none_8919d24cbe31e9e8\KBDINBE1.DLL Handle ID: 0xbf0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..l-keyboard-00020445_31bf3856ad364e35_10.0.26100.1_none_2c381655b0c30721\KBDINBE2.DLL Handle ID: 0xbec Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..l-keyboard-00000445_31bf3856ad364e35_10.0.26100.1_none_e5fb8e43cba0ccaf\KBDINBEN.DLL Handle ID: 0xbe8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..l-keyboard-00000439_31bf3856ad364e35_10.0.26100.1_none_e7c1c1c3ca7cc52a\KBDINDEV.DLL Handle ID: 0xbe4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..l-keyboard-00000447_31bf3856ad364e35_10.0.26100.1_none_e6de9c9fcb0ed5bd\KBDINGUJ.DLL Handle ID: 0xc44 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..l-keyboard-00004009_31bf3856ad364e35_10.0.26100.1_none_e792c543caa082af\KBDINEN.DLL Handle ID: 0xc40 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..l-keyboard-00010439_31bf3856ad364e35_10.0.26100.1_none_8ae005ccbd0de263\KBDINHIN.DLL Handle ID: 0x6e8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..l-keyboard-0000044b_31bf3856ad364e35_10.0.26100.1_none_f9f05159becc986a\KBDINKAN.DLL Handle ID: 0x5f8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..l-keyboard-0000044c_31bf3856ad364e35_10.0.26100.1_none_fa61d887be839cf1\KBDINMAL.DLL Handle ID: 0xc20 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..l-keyboard-0000044e_31bf3856ad364e35_10.0.26100.1_none_fb44e6e3bdf1a5ff\KBDINMAR.DLL Handle ID: 0xc58 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..l-keyboard-00000448_31bf3856ad364e35_10.0.26100.1_none_e75023cdcac5da44\KBDINORI.DLL Handle ID: 0xc54 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..l-keyboard-00000446_31bf3856ad364e35_10.0.26100.1_none_e66d1571cb57d136\KBDINPUN.DLL Handle ID: 0xc50 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..l-keyboard-00000449_31bf3856ad364e35_10.0.26100.1_none_e7c1aafbca7cdecb\KBDINTAM.DLL Handle ID: 0xc1c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..l-keyboard-0000044a_31bf3856ad364e35_10.0.26100.1_none_f97eca2bbf1593e3\KBDINTEL.DLL Handle ID: 0xc4c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..l-keyboard-0001045d_31bf3856ad364e35_10.0.26100.1_none_9df18cf6b0cbd852\KBDINUK2.DLL Handle ID: 0xc48 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..l-keyboard-00001809_31bf3856ad364e35_10.0.26100.1_none_e7bb3757ca80f994\KBDIR.DLL Handle ID: 0xc18 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..l-keyboard-00000410_31bf3856ad364e35_10.0.26100.1_none_e3c42eb5cd0d6929\KBDIT.DLL Handle ID: 0xc68 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..l-keyboard-00010410_31bf3856ad364e35_10.0.26100.1_none_86e272bebf9e8662\KBDIT142.DLL Handle ID: 0xc64 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..l-keyboard-0000085d_31bf3856ad364e35_10.0.26100.1_none_fad74a15be372075\KBDIULAT.DLL Handle ID: 0xc60 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..l-keyboard-00110c00_31bf3856ad364e35_10.0.26100.1_none_7043fbe4d91b6259\KBDJAV.DLL Handle ID: 0xc5c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..l-keyboard-00000411_31bf3856ad364e35_10.0.26100.1_none_e435b5e3ccc46db0\KBDJPN.DLL Handle ID: 0xc34 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..l-keyboard-0000043f_31bf3856ad364e35_10.0.26100.1_none_fbb684d9bda890e5\KBDKAZ.DLL Handle ID: 0x7dc Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..l-keyboard-00000453_31bf3856ad364e35_10.0.26100.1_none_e518691fcc32dd42\KBDKHMR.DLL Handle ID: 0xc3c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..l-keyboard-00010453_31bf3856ad364e35_10.0.26100.1_none_8836ad28bec3fa7b\KBDKNI.DLL Handle ID: 0x844 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..l-keyboard-00000412_31bf3856ad364e35_10.0.26100.1_none_e4a73d11cc7b7237\KBDKOR.DLL Handle ID: 0xc14 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..l-keyboard-00000492_31bf3856ad364e35_10.0.26100.1_none_e4a686d1cc7c3f3f\KBDKURD.DLL Handle ID: 0xc10 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..l-keyboard-00000440_31bf3856ad364e35_10.0.26100.1_none_e3c3ea5dcd0db60c\KBDKYR.DLL Handle ID: 0xc88 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..l-keyboard-0000080a_31bf3856ad364e35_10.0.26100.1_none_f9832673bf1192bb\KBDLA.DLL Handle ID: 0xc84 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..l-keyboard-00070c00_31bf3856ad364e35_10.0.26100.1_none_59c72f526edac310\kbdlisub.dll Handle ID: 0xc80 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..l-keyboard-00080c00_31bf3856ad364e35_10.0.26100.1_none_fce5735b616be049\kbdlisus.dll Handle ID: 0x10e4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..l-keyboard-00000454_31bf3856ad364e35_10.0.26100.1_none_e589f04dcbe9e1c9\KBDLAO.DLL Handle ID: 0xc98 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..panese_dec_lk411-aj_31bf3856ad364e35_10.0.26100.1_none_4eb38db7e40c2cd0\kbdlk41a.dll Handle ID: 0x10e8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..l-keyboard-00000427_31bf3856ad364e35_10.0.26100.1_none_e6deca2fcb0ea27b\KBDLT.DLL Handle ID: 0x10ec Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..l-keyboard-00010427_31bf3856ad364e35_10.0.26100.1_none_89fd0e38bd9fbfb4\KBDLT1.DLL Handle ID: 0x10f4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..l-keyboard-00020427_31bf3856ad364e35_10.0.26100.1_none_2d1b5241b030dced\KBDLT2.DLL Handle ID: 0x10f8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..l-keyboard-00000426_31bf3856ad364e35_10.0.26100.1_none_e66d4301cb579df4\KBDLV.DLL Handle ID: 0x10fc Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..l-keyboard-00010426_31bf3856ad364e35_10.0.26100.1_none_898b870abde8bb2d\KBDLV1.DLL Handle ID: 0x1100 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..l-keyboard-0000042f_31bf3856ad364e35_10.0.26100.1_none_fbb69ba1bda87744\KBDMAC.DLL Handle ID: 0x1104 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..l-keyboard-0001042f_31bf3856ad364e35_10.0.26100.1_none_9ed4dfaab039947d\KBDMACST.DLL Handle ID: 0xcb0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..l-keyboard-00020426_31bf3856ad364e35_10.0.26100.1_none_2ca9cb13b079d866\KBDLVST.DLL Handle ID: 0xcac Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..l-keyboard-00000481_31bf3856ad364e35_10.0.26100.1_none_e435166bccc52117\KBDMAORI.DLL Handle ID: 0x110c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..l-keyboard-0000043a_31bf3856ad364e35_10.0.26100.1_none_f97ee0f3bf157a42\KBDMLT47.DLL Handle ID: 0xcb4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..l-keyboard-0001043a_31bf3856ad364e35_10.0.26100.1_none_9c9d24fcb1a6977b\KBDMLT48.DLL Handle ID: 0x1108 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..l-keyboard-00000450_31bf3856ad364e35_10.0.26100.1_none_e3c3d395cd0dcfad\KBDMON.DLL Handle ID: 0x1110 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..l-keyboard-00000850_31bf3856ad364e35_10.0.26100.1_none_e3c7d4bdcd0a3509\KBDMONMO.DLL Handle ID: 0x1114 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..l-keyboard-00010850_31bf3856ad364e35_10.0.26100.1_none_86e618c6bf9b5242\KBDMONST.DLL Handle ID: 0xcc4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..l-keyboard-00010c00_31bf3856ad364e35_10.0.26100.1_none_8711971cbf7413ba\KBDMYAN.DLL Handle ID: 0xcc0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..l-keyboard-00000413_31bf3856ad364e35_10.0.26100.1_none_e518c43fcc3276be\KBDNE.DLL Handle ID: 0xcbc Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..-japanese_nec_win95_31bf3856ad364e35_10.0.26100.1_none_75433f9619f9dd17\kbdnec95.dll Handle ID: 0xcd0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..nese_nec98_usb_only_31bf3856ad364e35_10.0.26100.1_none_d835463422735291\kbdnec.dll Handle ID: 0xccc Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..ard-japanese_nec-at_31bf3856ad364e35_10.0.26100.1_none_456ee775fc7f12c8\kbdnecat.dll Handle ID: 0xcd8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..d-japanese_nec98-nt_31bf3856ad364e35_10.0.26100.1_none_3b1527d6317b7234\kbdnecnt.dll Handle ID: 0xcd4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..l-keyboard-00000461_31bf3856ad364e35_10.0.26100.1_none_e43543fbccc4edd5\KBDNEPR.DLL Handle ID: 0xcb8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..l-keyboard-00090c00_31bf3856ad364e35_10.0.26100.1_none_a003b76453fcfd82\kbdnko.dll Handle ID: 0x1118 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..l-keyboard-00000414_31bf3856ad364e35_10.0.26100.1_none_e58a4b6dcbe97b45\KBDNO.DLL Handle ID: 0xce4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..l-keyboard-0000043b_31bf3856ad364e35_10.0.26100.1_none_f9f06821becc7ec9\KBDNO1.DLL Handle ID: 0xca8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..l-keyboard-00040c00_31bf3856ad364e35_10.0.26100.1_none_706c633797276b65\KBDOGHAM.DLL Handle ID: 0xca4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..l-keyboard-00020c00_31bf3856ad364e35_10.0.26100.1_none_2a2fdb25b20530f3\KBDNTL.DLL Handle ID: 0x10f0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..l-keyboard-000d0c00_31bf3856ad364e35_10.0.26100.1_none_061924e5125ce615\KBDOLCH.DLL Handle ID: 0xca0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..l-keyboard-0000046c_31bf3856ad364e35_10.0.26100.1_none_fa61aaf7be83d033\KBDNSO.DLL Handle ID: 0xc9c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..l-keyboard-000f0c00_31bf3856ad364e35_10.0.26100.1_none_4c55acf6f77f2087\KBDOLDIT.DLL Handle ID: 0xce8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..l-keyboard-00150c00_31bf3856ad364e35_10.0.26100.1_none_fcbd0c08a35fd73d\KBDOSA.DLL Handle ID: 0x111c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..l-keyboard-000e0c00_31bf3856ad364e35_10.0.26100.1_none_a93768ee04ee034e\KBDOSM.DLL Handle ID: 0xd00 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..l-keyboard-00000463_31bf3856ad364e35_10.0.26100.1_none_e5185257cc32f6e3\KBDPASH.DLL Handle ID: 0xd04 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..l-keyboard-000a0c00_31bf3856ad364e35_10.0.26100.1_none_1cbe58ca3aa98e6a\kbdphags.dll Handle ID: 0xcfc Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..l-keyboard-00010415_31bf3856ad364e35_10.0.26100.1_none_891a16a4be319d05\KBDPL.DLL Handle ID: 0x1120 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..l-keyboard-00000415_31bf3856ad364e35_10.0.26100.1_none_e5fbd29bcba07fcc\KBDPL1.DLL Handle ID: 0xcf8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..l-keyboard-00000816_31bf3856ad364e35_10.0.26100.1_none_e6715af1cb53e9af\KBDPO.DLL Handle ID: 0x1124 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..l-keyboard-00000418_31bf3856ad364e35_10.0.26100.1_none_e7506825cac58d61\KBDRO.DLL Handle ID: 0xd10 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..l-keyboard-00020418_31bf3856ad364e35_10.0.26100.1_none_2d8cf037afe7c7d3\KBDROPR.DLL Handle ID: 0xd0c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..l-keyboard-00010418_31bf3856ad364e35_10.0.26100.1_none_8a6eac2ebd56aa9a\KBDROST.DLL Handle ID: 0xd14 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..l-keyboard-00000419_31bf3856ad364e35_10.0.26100.1_none_e7c1ef53ca7c91e8\KBDRU.DLL Handle ID: 0xc7c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..l-keyboard-00010419_31bf3856ad364e35_10.0.26100.1_none_8ae0335cbd0daf21\KBDRU1.DLL Handle ID: 0xd1c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..l-keyboard-00020419_31bf3856ad364e35_10.0.26100.1_none_2dfe7765af9ecc5a\KBDRUM.DLL Handle ID: 0xd08 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..onal-keyboard-kbdsf_31bf3856ad364e35_10.0.26100.1_none_7b4f45307d47bd3a\KBDSF.DLL Handle ID: 0xd20 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..l-keyboard-0000041b_31bf3856ad364e35_10.0.26100.1_none_f9f095b1becc4b87\KBDSL.DLL Handle ID: 0xc78 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..l-keyboard-00000807_31bf3856ad364e35_10.0.26100.1_none_e6e2f8e7cb0ad495\KBDSG.DLL Handle ID: 0xd28 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..l-keyboard-0001041b_31bf3856ad364e35_10.0.26100.1_none_9d0ed9bab15d68c0\KBDSL1.DLL Handle ID: 0xd24 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..l-keyboard-0002083b_31bf3856ad364e35_10.0.26100.1_none_4030f15ba3eb1e97\KBDSMSFI.DLL Handle ID: 0xd18 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..l-keyboard-0001043b_31bf3856ad364e35_10.0.26100.1_none_9d0eac2ab15d9c02\KBDSMSNO.DLL Handle ID: 0x1128 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..l-keyboard-0000045b_31bf3856ad364e35_10.0.26100.1_none_f9f03a91beccb20b\KBDSN1.DLL Handle ID: 0x112c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..l-keyboard-00100c00_31bf3856ad364e35_10.0.26100.1_none_cd25b7dbe68a4520\KBDSORA.DLL Handle ID: 0xd3c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..l-keyboard-0001042e_31bf3856ad364e35_10.0.26100.1_none_9e63587cb0828ff6\KBDSOREX.DLL Handle ID: 0xcf4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..l-keyboard-0002042e_31bf3856ad364e35_10.0.26100.1_none_41819c85a313ad2f\KBDSORS1.DLL Handle ID: 0xd34 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..l-keyboard-0000042e_31bf3856ad364e35_10.0.26100.1_none_fb451473bdf172bd\KBDSORST.DLL Handle ID: 0xd30 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..l-keyboard-0000040a_31bf3856ad364e35_10.0.26100.1_none_f97f254bbf152d5f\KBDSP.DLL Handle ID: 0xcf0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..l-keyboard-0000041d_31bf3856ad364e35_10.0.26100.1_none_fad3a40dbe3a5495\KBDSW.DLL Handle ID: 0xd4c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..l-keyboard-0001045b_31bf3856ad364e35_10.0.26100.1_none_9d0e7e9ab15dcf44\KBDSW09.DLL Handle ID: 0xd2c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..l-keyboard-0000045a_31bf3856ad364e35_10.0.26100.1_none_f97eb363bf15ad84\KBDSYR1.DLL Handle ID: 0xc74 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..l-keyboard-0001045a_31bf3856ad364e35_10.0.26100.1_none_9c9cf76cb1a6cabd\KBDSYR2.DLL Handle ID: 0xc70 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..l-keyboard-00030c00_31bf3856ad364e35_10.0.26100.1_none_cd4e1f2ea4964e2c\KBDTAILE.DLL Handle ID: 0xc6c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..l-keyboard-00000428_31bf3856ad364e35_10.0.26100.1_none_e750515dcac5a702\KBDTAJIK.DLL Handle ID: 0xd48 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..l-keyboard-00020449_31bf3856ad364e35_10.0.26100.1_none_2dfe330daf9f193d\KBDTAM99.DLL Handle ID: 0x850 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..l-keyboard-0000041e_31bf3856ad364e35_10.0.26100.1_none_fb452b3bbdf1591c\KBDTH0.DLL Handle ID: 0xd58 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..l-keyboard-0001041e_31bf3856ad364e35_10.0.26100.1_none_9e636f44b0827655\KBDTH1.DLL Handle ID: 0xd54 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..l-keyboard-00000444_31bf3856ad364e35_10.0.26100.1_none_e58a0715cbe9c828\KBDTAT.DLL Handle ID: 0xd50 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..l-keyboard-0002041e_31bf3856ad364e35_10.0.26100.1_none_4181b34da313938e\KBDTH2.DLL Handle ID: 0xd44 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..l-keyboard-0003041e_31bf3856ad364e35_10.0.26100.1_none_e49ff75695a4b0c7\KBDTH3.DLL Handle ID: 0xd40 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..l-keyboard-0000105f_31bf3856ad364e35_10.0.26100.1_none_fba78635bdb47abc\KBDTIFI.DLL Handle ID: 0xcec Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..l-keyboard-0001105f_31bf3856ad364e35_10.0.26100.1_none_9ec5ca3eb04597f5\KBDTIFI2.DLL Handle ID: 0xce0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..l-keyboard-00000451_31bf3856ad364e35_10.0.26100.1_none_e4355ac3ccc4d434\KBDTIPRC.DLL Handle ID: 0x1130 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..l-keyboard-00010451_31bf3856ad364e35_10.0.26100.1_none_87539eccbf55f16d\KBDTIPRD.DLL Handle ID: 0xd74 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..l-keyboard-00010444_31bf3856ad364e35_10.0.26100.1_none_88a84b1ebe7ae561\KBDTT102.DLL Handle ID: 0xd70 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..l-keyboard-0001041f_31bf3856ad364e35_10.0.26100.1_none_9ed4f672b0397adc\KBDTUF.DLL Handle ID: 0xd6c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..l-keyboard-0000041f_31bf3856ad364e35_10.0.26100.1_none_fbb6b269bda85da3\KBDTUQ.DLL Handle ID: 0xd7c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..l-keyboard-00000442_31bf3856ad364e35_10.0.26100.1_none_e4a6f8b9cc7bbf1a\KBDTURME.DLL Handle ID: 0xd80 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..l-keyboard-00000480_31bf3856ad364e35_10.0.26100.1_none_e3c38f3dcd0e1c90\KBDUGHR.DLL Handle ID: 0xd68 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..l-keyboard-00010480_31bf3856ad364e35_10.0.26100.1_none_86e1d346bf9f39c9\KBDUGHR1.DLL Handle ID: 0xd64 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..l-keyboard-0000085f_31bf3856ad364e35_10.0.26100.1_none_fbba5871bda52983\KBDTZM.DLL Handle ID: 0xd60 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..l-keyboard-00000809_31bf3856ad364e35_10.0.26100.1_none_e7c60743ca78dda3\KBDUK.DLL Handle ID: 0xd5c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..l-keyboard-00000452_31bf3856ad364e35_10.0.26100.1_none_e4a6e1f1cc7bd8bb\KBDUKX.DLL Handle ID: 0xd8c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..l-keyboard-00000422_31bf3856ad364e35_10.0.26100.1_none_e4a72649cc7b8bd8\KBDUR.DLL Handle ID: 0xd88 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..onal-keyboard-kbdus_31bf3856ad364e35_10.0.26100.1_none_7ba5c4907d1f3185\KBDUS.DLL Handle ID: 0xcdc Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..l-keyboard-00000420_31bf3856ad364e35_10.0.26100.1_none_e3c417edcd0d82ca\KBDURDU.DLL Handle ID: 0xcc8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..l-keyboard-00020422_31bf3856ad364e35_10.0.26100.1_none_2ae3ae5bb19dc64a\KBDUR1.DLL Handle ID: 0x6ec Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..l-keyboard-00050409_31bf3856ad364e35_10.0.26100.1_none_17595a4887520a64\KBDUSA.DLL Handle ID: 0x940 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..l-keyboard-00030409_31bf3856ad364e35_10.0.26100.1_none_d11cd236a22fcff2\KBDUSL.DLL Handle ID: 0xbe0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..l-keyboard-00040409_31bf3856ad364e35_10.0.26100.1_none_743b163f94c0ed2b\KBDUSR.DLL Handle ID: 0x948 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..l-keyboard-00000843_31bf3856ad364e35_10.0.26100.1_none_e51c810fcc2f28fd\KBDUZB.DLL Handle ID: 0x950 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..l-keyboard-0000042a_31bf3856ad364e35_10.0.26100.1_none_f97ef7bbbf1560a1\KBDVNTC.DLL Handle ID: 0x94c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..l-keyboard-00020409_31bf3856ad364e35_10.0.26100.1_none_2dfe8e2daf9eb2b9\KBDUSX.DLL Handle ID: 0xd90 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..l-keyboard-00000488_31bf3856ad364e35_10.0.26100.1_none_e74fc8adcac640c8\KBDWOL.DLL Handle ID: 0xc2c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..l-keyboard-00000485_31bf3856ad364e35_10.0.26100.1_none_e5fb3323cba13333\KBDYAK.DLL Handle ID: 0x848 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..l-keyboard-0000046a_31bf3856ad364e35_10.0.26100.1_none_f97e9c9bbf15c725\KBDYBA.DLL Handle ID: 0x944 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..l-keyboard-00000c1a_31bf3856ad364e35_10.0.26100.1_none_f9ae1c19beeaedf9\KBDYCC.DLL Handle ID: 0xbdc Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..l-keyboard-0000081a_31bf3856ad364e35_10.0.26100.1_none_f9830fabbf11ac5c\KBDYCL.DLL Handle ID: 0xb90 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-b..ggertransport-local_31bf3856ad364e35_10.0.26100.1_none_d625f75addadfa6f\kd.dll Handle ID: 0xd94 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-b..gertransport-serial_31bf3856ad364e35_10.0.26100.1_none_0ea9357f1537899a\kdcom.dll Handle ID: 0x958 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-b..buggertransport-usb_31bf3856ad364e35_10.0.26100.1_none_9a7151fb73140258\kdusb.dll Handle ID: 0x954 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-kdscli-dll_31bf3856ad364e35_10.0.26100.1_none_3bcdb44e99b0ecba\KdsCli.dll Handle ID: 0x7d8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-b..ggertransport-kdnet_31bf3856ad364e35_10.0.26100.1_none_da5b7157c1851064\kdnet.dll Handle ID: 0xd38 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-security-kerberos_31bf3856ad364e35_10.0.26100.1_none_e3ca858c195a2a7d\kerb3961.dll Handle ID: 0xda0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-kernel-appcore_31bf3856ad364e35_10.0.26100.1_none_c8689b3c165c77e5\kernel.appcore.dll Handle ID: 0xda4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-s..-credential-manager_31bf3856ad364e35_10.0.26100.1_none_4e8a6be4efe48b8a\KeyCredMgr.dll Handle ID: 0xda8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-s..ty-cng-keyisolation_31bf3856ad364e35_10.0.26100.1_none_c13044cc5ea67248\keyiso.dll Handle ID: 0xdac Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-s..ty-kerbclientshared_31bf3856ad364e35_10.0.26100.1_none_deec5b10247be7a4\KerbClientShared.dll Handle ID: 0x95c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-rasbase_31bf3856ad364e35_10.0.26100.1_none_0ad41041e2fbdf9e\kmddsp.tsp Handle ID: 0xdb0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-transactionmanagerapi_31bf3856ad364e35_10.0.26100.1_none_53caf86c3c84b622\ktmw32.dll Handle ID: 0xdb4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-linkinfo_31bf3856ad364e35_10.0.26100.1_none_3558da7d0de0ac37\linkinfo.dll Handle ID: 0xdb8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-lmhsvc_31bf3856ad364e35_10.0.26100.1_none_4fb490c758e2d568\lmhsvc.dll Handle ID: 0xd84 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-p..structureexecutable_31bf3856ad364e35_10.0.26100.1_none_f4fc28dfbe94dd08\loadperf.dll Handle ID: 0xd78 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-security-kerberos_31bf3856ad364e35_10.0.26100.1_none_e3ca858c195a2a7d\localkdcsvc.dll Handle ID: 0xdbc Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-p..structureexecutable_31bf3856ad364e35_10.0.26100.1_none_f4fc28dfbe94dd08\lodctr.exe Handle ID: 0xd9c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-s..ity-netlogon-netapi_31bf3856ad364e35_10.0.26100.1_none_d0299340be8686e6\logoncli.dll Handle ID: 0xdc8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-gdi_31bf3856ad364e35_10.0.26100.1_none_a6c6c0d8c312f7d1\lpk.dll Handle ID: 0x1134 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-kernel32_31bf3856ad364e35_10.0.26100.1_none_90b18da1bed82333\kernel32.dll Handle ID: 0x1138 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-lsa_31bf3856ad364e35_10.0.26100.1_none_a33e3322c557d2bb\lsaadt.dll Handle ID: 0xdc0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-lsa-minwin_31bf3856ad364e35_10.0.26100.1_none_3a5f49fdfadb01a4\lsass.exe Handle ID: 0x113c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-ie-runtimeutilities_31bf3856ad364e35_11.0.26100.1_none_7888cd925feaa89f\iertutil.dll Handle ID: 0x1140 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-lz32_31bf3856ad364e35_10.0.26100.1_none_8f83259b91f59c1a\lz32.dll Handle ID: 0xc94 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..e-defaultcasingfile_31bf3856ad364e35_10.0.26100.1_none_7102ff18f817d458\l_intl.nls Handle ID: 0xdd8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-security-kerberos_31bf3856ad364e35_10.0.26100.1_none_e3ca858c195a2a7d\kerberos.dll Handle ID: 0xdd4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-l..ncontroller-library_31bf3856ad364e35_10.0.26100.1_none_afcc8ea94178351c\LogonController.dll Handle ID: 0xdd0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-mapi_31bf3856ad364e35_10.0.26100.1_none_a840e9af824c49aa\mapistub.dll Handle ID: 0xdcc Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-mapi_31bf3856ad364e35_10.0.26100.1_none_a840e9af824c49aa\mapi32.dll Handle ID: 0xdc4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\wow64_microsoft-windows-i..nal-core-locale-nls_31bf3856ad364e35_10.0.26100.1_none_7200838c46331e51\locale.nls Handle ID: 0x1144 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-m..update-authenticamd_31bf3856ad364e35_10.0.26100.1_none_fa97401eba266233\mcupdate_AuthenticAMD.dll Handle ID: 0x1148 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-muicachebuilder_31bf3856ad364e35_10.0.26100.1_none_1700449c1d64ef6d\mcbuilder.exe Handle ID: 0x114c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-gdi-painting_31bf3856ad364e35_10.0.26100.1_none_745f807b8498ac46\mf3216.dll Handle ID: 0x1150 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-setup-mbr2gpt_31bf3856ad364e35_10.0.26100.1_none_f3a596ba2679af55\MBR2GPT.EXE Handle ID: 0x1154 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-b..ry-events-container_31bf3856ad364e35_10.0.26100.1_none_69ee5787ebb516ae\microsoft-windows-battery-events.dll Handle ID: 0x1158 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-hal-events-container_31bf3856ad364e35_10.0.26100.1_none_2338f0a4c4f660c0\microsoft-windows-hal-events.dll Handle ID: 0x115c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-k..np-events-container_31bf3856ad364e35_10.0.26100.1_none_e2b4d98eef65cc79\microsoft-windows-kernel-pnp-events.dll Handle ID: 0x1160 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-t..localsessionmanager_31bf3856ad364e35_10.0.26100.1_none_a238752173174a12\lsm.dll Handle ID: 0x1164 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-k..er-events-container_31bf3856ad364e35_10.0.26100.1_none_c8f7aa40fa1a8802\microsoft-windows-kernel-power-events.dll Handle ID: 0xe04 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-k..er-events-container_31bf3856ad364e35_10.0.26100.1_none_ce3d877a4eb749b7\microsoft-windows-kernel-processor-power-events.dll Handle ID: 0xe00 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-e..ymanagementservices_31bf3856ad364e35_10.0.26100.1_none_f0686e235fa185fd\microsoft-windows-sac-events.dll Handle ID: 0xdfc Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-pdc-events-container_31bf3856ad364e35_10.0.26100.1_none_c5accc6515f6a28e\microsoft-windows-pdc.dll Handle ID: 0xdf8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-m..update-genuineintel_31bf3856ad364e35_10.0.26100.1_none_b9b3b4c21ad9e8c9\mcupdate_GenuineIntel.dll Handle ID: 0xe14 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-s..ng-events-container_31bf3856ad364e35_10.0.26100.1_none_3e6dba323fcd0467\microsoft-windows-storage-tiering-events.dll Handle ID: 0xe18 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-lsa_31bf3856ad364e35_10.0.26100.1_none_a33e3322c557d2bb\lsasrv.dll Handle ID: 0xe1c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-s..dy-events-container_31bf3856ad364e35_10.0.26100.1_none_aa2153cdb79ff999\microsoft-windows-sleepstudy-events.dll Handle ID: 0xe20 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-m..ommandlineutilities_31bf3856ad364e35_10.0.26100.1_none_7a109607cfe12f00\mode.com Handle ID: 0xe24 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-more_31bf3856ad364e35_10.0.26100.1_none_a94df8cb819b49c2\more.com Handle ID: 0xe08 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-mountvol_31bf3856ad364e35_10.0.26100.1_none_af4d21cdb9ffe687\mountvol.exe Handle ID: 0xc90 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-mpr_31bf3856ad364e35_10.0.26100.1_none_aac971d2c07dec26\mpr.dll Handle ID: 0xe2c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-mpr-extension_31bf3856ad364e35_10.0.26100.1_none_99baaa075d7ded98\mprext.dll Handle ID: 0xe0c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-mprmsg_31bf3856ad364e35_10.0.26100.1_none_10819caabbef9dcd\mprmsg.dll Handle ID: 0xe10 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-mprapi_31bf3856ad364e35_10.0.26100.1_none_11002d4cbb9135be\mprapi.dll Handle ID: 0x1168 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-mfc42x_31bf3856ad364e35_10.0.26100.1_none_f00876a1be1b539f\mfc42.dll Handle ID: 0x116c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-winsock-legacy-afd_31bf3856ad364e35_10.0.26100.1_none_e87a9bbd1c7ef305\msafd.dll Handle ID: 0x1170 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-tcpip-utility_31bf3856ad364e35_10.0.26100.1_none_2fba9c0ab76abd38\MRINFO.EXE Handle ID: 0xe38 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-s..em-events-container_31bf3856ad364e35_10.0.26100.1_none_a54b26da7662d1e6\microsoft-windows-system-events.dll Handle ID: 0xe34 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-mscat32-dll_31bf3856ad364e35_10.0.26100.1_none_7dd7bc57881209ab\mscat32.dll Handle ID: 0xe30 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-mfc42x_31bf3856ad364e35_10.0.26100.1_none_f00876a1be1b539f\mfc42u.dll Handle ID: 0xe44 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-msasn1_31bf3856ad364e35_10.0.26100.1_none_c44dbe2b0dedfdb0\msasn1.dll Handle ID: 0xe40 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-msauditevtlog_31bf3856ad364e35_10.0.26100.1_none_c43622aee0fa0f41\msaudite.dll Handle ID: 0xe4c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-installer-liteconfig_31bf3856ad364e35_10.0.26100.1_none_807df852f92562d0\msiltcfg.dll Handle ID: 0xe48 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-gdi-painting_31bf3856ad364e35_10.0.26100.1_none_745f807b8498ac46\msimg32.dll Handle ID: 0xe28 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-ie-runtimeutilities_31bf3856ad364e35_11.0.26100.1_none_7888cd925feaa89f\msIso.dll Handle ID: 0xe50 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-mskeyprotect-dll_31bf3856ad364e35_10.0.26100.1_none_cf48242e380983cc\mskeyprotect.dll Handle ID: 0x1174 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-deltacompressionengine_31bf3856ad364e35_10.0.26100.1_none_3d201078ee4bb447\msdelta.dll Handle ID: 0x1178 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-msauditevtlog_31bf3856ad364e35_10.0.26100.1_none_c43622aee0fa0f41\msobjs.dll Handle ID: 0xe3c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-deltacompressionengine_31bf3856ad364e35_10.0.26100.1_none_3d201078ee4bb447\mspatcha.dll Handle ID: 0xe68 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-msls31_31bf3856ad364e35_11.0.26100.1_none_fce4f6ef75da3647\msls31.dll Handle ID: 0xe60 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-deltacompressionengine_31bf3856ad364e35_10.0.26100.1_none_3d201078ee4bb447\mspatchc.dll Handle ID: 0xe5c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-lsa-msprivs_31bf3856ad364e35_10.0.26100.1_none_090c9972e3f2750c\msprivs.dll Handle ID: 0xe70 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-msports_31bf3856ad364e35_10.0.26100.1_none_8a10c2d957d1541b\msports.dll Handle ID: 0xe74 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-mssip32-dll_31bf3856ad364e35_10.0.26100.1_none_7354df01020b2aef\mssip32.dll Handle ID: 0x117c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-mssign32-dll_31bf3856ad364e35_10.0.26100.1_none_c72775df42fa2e3a\mssign32.dll Handle ID: 0xe7c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-kernelbase_31bf3856ad364e35_10.0.26100.1_none_23f620b41d20ab1f\KernelBase.dll Handle ID: 0xe80 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_networking-mpssvc-svc_31bf3856ad364e35_10.0.26100.1_none_9707e3d93069581e\MPSSVC.dll Handle ID: 0x1180 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-msvcirt_31bf3856ad364e35_10.0.26100.1_none_5db0cc430695a15b\msvcirt.dll Handle ID: 0xe78 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-t..icesframework-msctf_31bf3856ad364e35_10.0.26100.1_none_72b7587a5751b41e\msctf.dll Handle ID: 0xe6c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-security-ntlm_31bf3856ad364e35_10.0.26100.1_none_79a69533cb175d9d\msv1_0.dll Handle ID: 0x1184 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-msvcp110_31bf3856ad364e35_10.0.26100.1_none_eaa9f365d9a2a7e8\msvcp110_win.dll Handle ID: 0x1188 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-msvcp60_31bf3856ad364e35_10.0.26100.1_none_3f953cf119ec1d24\msvcp60.dll Handle ID: 0xdf4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-msxml30_31bf3856ad364e35_10.0.26100.1_none_8561e8faff62bcc1\msxml3r.dll Handle ID: 0xe94 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-ucrt_31bf3856ad364e35_10.0.26100.1_none_a8b4dda7820c840d\msvcp_win.dll Handle ID: 0xe98 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-msxml60_31bf3856ad364e35_10.0.26100.1_none_8561a4a2ff6309a4\msxml6r.dll Handle ID: 0xe9c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-c..mplus-runtime-mtxdm_31bf3856ad364e35_10.0.26100.1_none_14e3c0413bf926b2\mtxdm.dll Handle ID: 0x118c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-w..-infrastructure-bsp_31bf3856ad364e35_10.0.26100.1_none_b546ff6695d85913\mswsock.dll Handle ID: 0x1194 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-font-registrysettings_31bf3856ad364e35_10.0.26100.1_none_92a4fb9c19a94489\muifontsetup.dll Handle ID: 0x1198 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-nbtstat_31bf3856ad364e35_10.0.26100.1_none_9b042cd286eb8cdf\nbtstat.exe Handle ID: 0x119c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-international-unattend_31bf3856ad364e35_10.0.26100.1_none_bd0d6ab556264d17\MuiUnattend.exe Handle ID: 0x11a0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-netcoinstaller_31bf3856ad364e35_10.0.26100.1_none_f415f67665bf6ade\nci.dll Handle ID: 0xeac Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-msvcrt_31bf3856ad364e35_10.0.26100.1_none_ce48de810772b832\msvcrt.dll Handle ID: 0xeb0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-netshell_31bf3856ad364e35_10.0.26100.1_none_d2771333769763b2\ncpa.cpl Handle ID: 0x11a4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-ncrypt-dll_31bf3856ad364e35_10.0.26100.1_none_5ad1fdf25a28a928\ncrypt.dll Handle ID: 0xeb8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-ncryptsslp-dll_31bf3856ad364e35_10.0.26100.1_none_b96587190cfdad8a\ncryptsslp.dll Handle ID: 0xeb4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-newdev_31bf3856ad364e35_10.0.26100.1_none_0e69f3b4b935b238\ndadmin.exe Handle ID: 0xea8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-net-command-line-tool_31bf3856ad364e35_10.0.26100.1_none_4f25f9e0db03aa60\net.exe Handle ID: 0xec0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-ncryptprov-dll_31bf3856ad364e35_10.0.26100.1_none_1b697959fca10285\ncryptprov.dll Handle ID: 0xebc Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-net1-command-line-tool_31bf3856ad364e35_10.0.26100.1_none_83cf9bd1bd1fc4d3\net1.exe Handle ID: 0xec4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-netbios-netapi_31bf3856ad364e35_10.0.26100.1_none_d552b305b98b48a3\netbios.dll Handle ID: 0x11ac Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-netapi32_31bf3856ad364e35_10.0.26100.1_none_8a27c3736a1c78b7\netapi32.dll Handle ID: 0x11b0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-netbt_31bf3856ad364e35_10.0.26100.1_none_5d5870c25fd0c1ea\netbtugc.exe Handle ID: 0x11b4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-netcfg_31bf3856ad364e35_10.0.26100.1_none_0d228418ba06219a\netcfg.exe Handle ID: 0x11b8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-n..setup-compatibility_31bf3856ad364e35_10.0.26100.1_none_6d15e2c1e6f661cb\NetCfgNotifyObjectHost.exe Handle ID: 0x11bc Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-ndis-tdi-bindingengine_31bf3856ad364e35_10.0.26100.1_none_3b088fc48e146113\netcfgx.dll Handle ID: 0x11c0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-net-command-line-tool_31bf3856ad364e35_10.0.26100.1_none_4f25f9e0db03aa60\neth.dll Handle ID: 0x11c4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-n..ork-setup-servicing_31bf3856ad364e35_10.0.26100.1_none_833c353776b2547c\NetDriverInstall.dll Handle ID: 0x11a8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-networkprofile_31bf3856ad364e35_10.0.26100.1_none_758ef9badeb2625a\ncsi.dll Handle ID: 0xee4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-tcpip_31bf3856ad364e35_10.0.26100.1_none_5e793e3cf7e6453d\netiougc.exe Handle ID: 0xee8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-tcpip-utility_31bf3856ad364e35_10.0.26100.1_none_2fba9c0ab76abd38\netiohlp.dll Handle ID: 0x11c8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-basic-misc-tools_31bf3856ad364e35_10.0.26100.1_none_14505fd127f829fc\netmsg.dll Handle ID: 0xef0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-netjoin_31bf3856ad364e35_10.0.26100.1_none_544dc7b0d553b06e\netjoin.dll Handle ID: 0xef4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-c..provision-framework_31bf3856ad364e35_10.0.26100.1_none_57c63ee3383e81a3\netprovfw.dll Handle ID: 0xef8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-wsp-spaces_31bf3856ad364e35_10.0.26100.1_none_632caa9216178221\mispace.dll Handle ID: 0xefc Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-n..ork-setup-servicing_31bf3856ad364e35_10.0.26100.1_none_833c353776b2547c\NetSetupApi.dll Handle ID: 0x11d0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-msftedit_31bf3856ad364e35_10.0.26100.1_none_d2c4a1669fbe2779\msftedit.dll Handle ID: 0x11d4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-msxml30_31bf3856ad364e35_10.0.26100.1_none_8561e8faff62bcc1\msxml3.dll Handle ID: 0xf08 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-netsh_31bf3856ad364e35_10.0.26100.1_none_5c949e9e60656cd7\netsh.exe Handle ID: 0x964 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-network-setup_31bf3856ad364e35_10.0.26100.1_none_a4d5072c50ee7f91\NetSetupSvc.dll Handle ID: 0x11d8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-tcpip-utility_31bf3856ad364e35_10.0.26100.1_none_2fba9c0ab76abd38\NETSTAT.EXE Handle ID: 0xf20 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-netutils_31bf3856ad364e35_10.0.26100.1_none_2d0cb5ffb2a57e7f\netutils.dll Handle ID: 0xf1c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-n..setup-compatibility_31bf3856ad364e35_10.0.26100.1_none_6d15e2c1e6f661cb\NetSetupShim.dll Handle ID: 0xf04 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-security-netlogon_31bf3856ad364e35_10.0.26100.1_none_faab5fa3a08682dc\netlogon.dll Handle ID: 0xf2c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-newdev_31bf3856ad364e35_10.0.26100.1_none_0e69f3b4b935b238\newdev.exe Handle ID: 0xf28 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-security-ngc-local_31bf3856ad364e35_10.0.26100.1_none_0609ec8b33d941ba\ngclocal.dll Handle ID: 0xf30 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-networkprofile_31bf3856ad364e35_10.0.26100.1_none_758ef9badeb2625a\nlaapi.dll Handle ID: 0xf24 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-networkprofile_31bf3856ad364e35_10.0.26100.1_none_758ef9badeb2625a\nlmproxy.dll Handle ID: 0xf14 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-newdev_31bf3856ad364e35_10.0.26100.1_none_0e69f3b4b935b238\newdev.dll Handle ID: 0x738 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-networkprofile_31bf3856ad364e35_10.0.26100.1_none_758ef9badeb2625a\nlmsprep.dll Handle ID: 0xf00 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..ional-normalization_31bf3856ad364e35_10.0.26100.1_none_f2e0a915367d7fb7\normaliz.dll Handle ID: 0x968 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..ional-normalization_31bf3856ad364e35_10.0.26100.1_none_f2e0a915367d7fb7\normidna.nls Handle ID: 0xf0c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..ional-normalization_31bf3856ad364e35_10.0.26100.1_none_f2e0a915367d7fb7\normnfc.nls Handle ID: 0x980 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-netshell_31bf3856ad364e35_10.0.26100.1_none_d2771333769763b2\netshell.dll Handle ID: 0x984 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..ional-normalization_31bf3856ad364e35_10.0.26100.1_none_f2e0a915367d7fb7\normnfd.nls Handle ID: 0x840 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-lmhsvc_31bf3856ad364e35_10.0.26100.1_none_4fb490c758e2d568\nrpsrv.dll Handle ID: 0x858 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..ional-normalization_31bf3856ad364e35_10.0.26100.1_none_f2e0a915367d7fb7\normnfkc.nls Handle ID: 0x97c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-n..ork-setup-servicing_31bf3856ad364e35_10.0.26100.1_none_833c353776b2547c\NetSetupEngine.dll Handle ID: 0x11e0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-t..rm-libraries-minwin_31bf3856ad364e35_10.0.26100.1_none_9ca69317d98a1dee\nrtapi.dll Handle ID: 0xf3c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-msxml60_31bf3856ad364e35_10.0.26100.1_none_8561a4a2ff6309a4\msxml6.dll Handle ID: 0xf44 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..ional-normalization_31bf3856ad364e35_10.0.26100.1_none_f2e0a915367d7fb7\normnfkd.nls Handle ID: 0xf40 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-usermodensi_31bf3856ad364e35_10.0.26100.1_none_6f55cb4030007b27\nsi.dll Handle ID: 0x994 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-dnsclient-netsh-helper_31bf3856ad364e35_10.0.26100.1_none_026d1a01dd3d077f\nshdnsclient.dll Handle ID: 0xf50 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-t..atform-input-ninput_31bf3856ad364e35_10.0.26100.1_none_bbade61c1a560c12\ninput.dll Handle ID: 0xf34 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-usermodensi_31bf3856ad364e35_10.0.26100.1_none_6f55cb4030007b27\nsisvc.dll Handle ID: 0xf58 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-d..oryservices-ntdsapi_31bf3856ad364e35_10.0.26100.1_none_cbd0eec659c2eb5c\ntdsapi.dll Handle ID: 0x99c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-ntasn1-dll_31bf3856ad364e35_10.0.26100.1_none_b72798672d615547\ntasn1.dll Handle ID: 0x7f4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-ntlanman_31bf3856ad364e35_10.0.26100.1_none_2d04be254b2cbad4\ntlanman.dll Handle ID: 0x960 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-security-ntlmshared_31bf3856ad364e35_10.0.26100.1_none_ba4b9bd8da329bc0\NtlmShared.dll Handle ID: 0x978 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-security-ntmarta_31bf3856ad364e35_10.0.26100.1_none_787a2a07f82e38d7\ntmarta.dll Handle ID: 0x708 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-networkprofile_31bf3856ad364e35_10.0.26100.1_none_758ef9badeb2625a\netprofmsvc.dll Handle ID: 0x96c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-p..randprintui-ntprint_31bf3856ad364e35_10.0.26100.1_none_ecf7229ce5f8d129\ntprint.exe Handle ID: 0xf5c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-fsd_31bf3856ad364e35_10.0.26100.1_none_a48cc6f0c4824846\ntfsres.dll Handle ID: 0xf4c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-network-security-winpe_31bf3856ad364e35_10.0.26100.1_none_e2fcca147f6c32b0\nshwfp.dll Handle ID: 0x694 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-p..randprintui-ntprint_31bf3856ad364e35_10.0.26100.1_none_ecf7229ce5f8d129\ntprint.dll Handle ID: 0x870 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-m..-odbc-installer-dll_31bf3856ad364e35_10.0.26100.1_none_8a1eacd4bdc15b3a\odbccp32.dll Handle ID: 0x998 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-ntshrui_31bf3856ad364e35_10.0.26100.1_none_590356d164eb5f92\ntshrui.dll Handle ID: 0xf54 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-m..drivermanager-trace_31bf3856ad364e35_10.0.26100.1_none_7c6734d9aa06a04e\odbctrac.dll Handle ID: 0x11e4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-m..c-drivermanager-rll_31bf3856ad364e35_10.0.26100.1_none_0c8efbb252f74581\odbcint.dll Handle ID: 0x11e8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-lsa_31bf3856ad364e35_10.0.26100.1_none_a33e3322c557d2bb\offlinelsa.dll Handle ID: 0x11ec Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-directory-services-sam_31bf3856ad364e35_10.0.26100.1_none_aee201be098128e9\offlinesam.dll Handle ID: 0x11f0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-oleacc_31bf3856ad364e35_10.0.26100.1_none_6778662e8af05608\oleacchooks.dll Handle ID: 0x11f4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-m..c-drivermanager-dll_31bf3856ad364e35_10.0.26100.1_none_0d265a9a5285be53\odbc32.dll Handle ID: 0xf38 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-oleaccrc_31bf3856ad364e35_10.0.26100.1_none_761d97aeefefb84b\oleaccrc.dll Handle ID: 0x618 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-oleacc_31bf3856ad364e35_10.0.26100.1_none_6778662e8af05608\oleacc.dll Handle ID: 0x7e0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-onesettings-client_31bf3856ad364e35_10.0.26100.1_none_ee3f21043666614e\OneSettingsClient.dll Handle ID: 0xf10 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-openwith_31bf3856ad364e35_10.0.26100.1_none_6a14770cdb40801f\OpenWith.exe Handle ID: 0x6b8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-core_tools_31bf3856ad364e35_10.0.26100.1_none_08fdc884201dd6e2\osuninst.dll Handle ID: 0x7c0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft.windows.winhttp_31bf3856ad364e35_5.1.26100.1_none_8967b366ca40bd5e\pacjsworker.exe Handle ID: 0x720 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-ping-utilities_31bf3856ad364e35_10.0.26100.1_none_a6254d67f86762da\PATHPING.EXE Handle ID: 0x9a0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-pcwum_31bf3856ad364e35_10.0.26100.1_none_5eeae7bc91d27691\pcwum.dll Handle ID: 0xea0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-p..ormancebasecounters_31bf3856ad364e35_10.0.26100.1_none_2e66e623c5a66d1d\perfdisk.dll Handle ID: 0x864 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-ntdll_31bf3856ad364e35_10.0.26100.1_none_55ca86a264ba469b\ntdll.dll Handle ID: 0x878 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-p..ormancebasecounters_31bf3856ad364e35_10.0.26100.1_none_2e66e623c5a66d1d\perfnet.dll Handle ID: 0x7d0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-imageres-embedded_31bf3856ad364e35_10.0.26100.1_none_261c9f71092b9c63\imageres.dll Handle ID: 0x804 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-ole-automation_31bf3856ad364e35_10.0.26100.1_none_b9f3d2ee6406cdad\oleaut32.dll Handle ID: 0x768 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-p..ormancebasecounters_31bf3856ad364e35_10.0.26100.1_none_2e66e623c5a66d1d\perfos.dll Handle ID: 0x9a8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-ping-utilities_31bf3856ad364e35_10.0.26100.1_none_a6254d67f86762da\PING.EXE Handle ID: 0x9a4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-p..ormancebasecounters_31bf3856ad364e35_10.0.26100.1_none_2e66e623c5a66d1d\perfproc.dll Handle ID: 0x860 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-pnpclean_31bf3856ad364e35_10.0.26100.1_none_9e35f596e9a291b8\pnpclean.dll Handle ID: 0x85c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-onecorecommonproxystub_31bf3856ad364e35_10.0.26100.1_none_3396aa777a8cf4fb\OneCoreCommonProxyStub.dll Handle ID: 0x988 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-p..rmware-authenticamd_31bf3856ad364e35_10.0.26100.1_none_1e9e993614a28afd\plutonfw_AuthenticAMD.dll Handle ID: 0x6f8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-pnpui_31bf3856ad364e35_10.0.26100.1_none_5bcb39ba93d60b6f\pnpui.dll Handle ID: 0x6c4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-d..allationgrouppolicy_31bf3856ad364e35_10.0.26100.1_none_74931c09773c46bc\pnppolicy.dll Handle ID: 0x854 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-packagemanager_31bf3856ad364e35_10.0.26100.1_none_e9cb6c7c5bd0e02c\PkgMgr.exe Handle ID: 0xf48 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-p..tionsnonwinpeplugin_31bf3856ad364e35_10.0.26100.1_none_a385593075152a7a\PnPUnattend.exe Handle ID: 0x970 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-com-base-qfe-ole32_31bf3856ad364e35_10.0.26100.1_none_a9114fbc5addfb09\ole32.dll Handle ID: 0x974 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-p..nfiguration-cmdline_31bf3856ad364e35_10.0.26100.1_none_064f6097e94bbeed\powercfg.exe Handle ID: 0xf18 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-onecore-pnp-pnpdiag_31bf3856ad364e35_10.0.26100.1_none_dbadfffbed6d42bb\pnpdiag.dll Handle ID: 0xeec Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-m..ommandlineutilities_31bf3856ad364e35_10.0.26100.1_none_7a109607cfe12f00\print.exe Handle ID: 0xee0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-p..structure-minkernel_31bf3856ad364e35_10.0.26100.1_none_d5e8a9ea1f5640bc\prflbmsg.dll Handle ID: 0xedc Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-pnputil_31bf3856ad364e35_10.0.26100.1_none_fa576af2251420f3\pnputil.exe Handle ID: 0xed8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-n..-domain-clients-svc_31bf3856ad364e35_10.0.26100.1_none_410220325491d8f1\polstore.dll Handle ID: 0xed4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-profapi-onecore_31bf3856ad364e35_10.0.26100.1_none_03102b33df7b328e\profapi.dll Handle ID: 0xed0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-userpowermanagement_31bf3856ad364e35_10.0.26100.1_none_a00d46c16564f9f6\powrprof.dll Handle ID: 0xecc Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-userenvext_31bf3856ad364e35_10.0.26100.1_none_6631cb774cdba15a\profext.dll Handle ID: 0xec8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-onecore-ras-base-vpn_31bf3856ad364e35_10.0.26100.1_none_1950fce546b368de\prxyqry.dll Handle ID: 0xea4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-basedependencies_31bf3856ad364e35_10.0.26100.1_none_ff959a24915c02c5\psapi.dll Handle ID: 0x6f0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-rasautodial_31bf3856ad364e35_10.0.26100.1_none_0ccda716cddfb9e8\rasadhlp.dll Handle ID: 0x6e4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-pshed_31bf3856ad364e35_10.0.26100.1_none_58e68bb095a12999\PSHED.DLL Handle ID: 0x9b8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-rasautodial_31bf3856ad364e35_10.0.26100.1_none_0ccda716cddfb9e8\rasauto.dll Handle ID: 0x72c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-rasautodial_31bf3856ad364e35_10.0.26100.1_none_0ccda716cddfb9e8\rasautou.exe Handle ID: 0x6b0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.1_none_065309a92fd714e9\poqexec.exe Handle ID: 0x838 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-raschap_31bf3856ad364e35_10.0.26100.1_none_0fb2ab65dfd9116b\raschapext.dll Handle ID: 0x87c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-profsvc_31bf3856ad364e35_10.0.26100.1_none_f8a4ffcd9b39a62e\profsvc.dll Handle ID: 0x7fc Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-rasctrs_31bf3856ad364e35_10.0.26100.1_none_1111c11fdef502c5\rasctrs.dll Handle ID: 0x77c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-onecoreuap-raschap_31bf3856ad364e35_10.0.26100.1_none_b7e4795b8183fb51\raschap.dll Handle ID: 0x754 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-rasbase_31bf3856ad364e35_10.0.26100.1_none_0ad41041e2fbdf9e\rasdiag.dll Handle ID: 0x9bc Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-p..randprintui-printui_31bf3856ad364e35_10.0.26100.1_none_d928f8cadc871c41\printui.dll Handle ID: 0x11f8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-r..-rasmobilitymanager_31bf3856ad364e35_10.0.26100.1_none_291857ee4a66211f\rasmbmgr.dll Handle ID: 0x750 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-rasman_31bf3856ad364e35_10.0.26100.1_none_6999f27cb8812059\rasman.dll Handle ID: 0x9c8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-rasdlg_31bf3856ad364e35_10.0.26100.1_none_6a06e46eb82d8836\rasdlg.dll Handle ID: 0x86c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-propsys_31bf3856ad364e35_7.0.26100.1_none_79eb5ca32853cfdd\propsys.dll Handle ID: 0x9b4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-rasmontr_31bf3856ad364e35_10.0.26100.1_none_7f84160bcc261faf\rasmontr.dll Handle ID: 0x9b0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-rasppp-noneap_31bf3856ad364e35_10.0.26100.1_none_7b1a6128a9bc84b5\rasppp.dll Handle ID: 0x7bc Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-r..eak-diagnostic-core_31bf3856ad364e35_10.0.26100.1_none_58054b63e5eee315\rdrleakdiag.exe Handle ID: 0x7f0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-onecore-ras-base-vpn_31bf3856ad364e35_10.0.26100.1_none_1950fce546b368de\rasapi32.dll Handle ID: 0x74c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-recover_31bf3856ad364e35_10.0.26100.1_none_8306f62f1d2799f7\recover.exe Handle ID: 0x9cc Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-rastapi_31bf3856ad364e35_10.0.26100.1_none_0bd7d2b9e2699bc9\rastapi.dll Handle ID: 0x9c0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-p..-refsdedupsvc-proxy_31bf3856ad364e35_10.0.26100.1_none_fd821689c792c1a0\RefsDedupSvc.Proxy.dll Handle ID: 0x740 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-r..-commandline-editor_31bf3856ad364e35_10.0.26100.1_none_2e87dc5d933c136a\reg.exe Handle ID: 0xf60 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-rastls_31bf3856ad364e35_10.0.26100.1_none_6958d44eb8b07ad2\rastlsext.dll Handle ID: 0x7a0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-registry-editor_31bf3856ad364e35_10.0.26100.1_none_f1225dc54465411c\regedt32.exe Handle ID: 0x9c4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-regsvr32_31bf3856ad364e35_10.0.26100.1_none_754ac5b1981032b7\regsvr32.exe Handle ID: 0x990 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-m..ommandlineutilities_31bf3856ad364e35_10.0.26100.1_none_457f9751bea691f1\replace.exe Handle ID: 0x7e8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-t..rvices-registryapis_31bf3856ad364e35_10.0.26100.1_none_a145d0328a8847d8\regapi.dll Handle ID: 0x884 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-rasmanservice_31bf3856ad364e35_10.0.26100.1_none_9bb13ea209351dde\rasmans.dll Handle ID: 0xf68 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-riched32_31bf3856ad364e35_10.0.26100.1_none_99f45c36eb283f55\riched32.dll Handle ID: 0xf64 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-onecoreuap-rastls_31bf3856ad364e35_10.0.26100.1_none_2b23033e43740d4c\rastls.dll Handle ID: 0x790 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-tcpip-utility_31bf3856ad364e35_10.0.26100.1_none_2fba9c0ab76abd38\ROUTE.EXE Handle ID: 0x9e4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-robocopy_31bf3856ad364e35_10.0.26100.1_none_c3fad7e154f0d73e\Robocopy.exe Handle ID: 0x1200 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-rpc-endpointmapper_31bf3856ad364e35_10.0.26100.1_none_478626e64b23175b\RpcEpMap.dll Handle ID: 0x9d0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-rpc-remote-extension_31bf3856ad364e35_10.0.26100.1_none_c63e597ada984b21\RpcRtRemote.dll Handle ID: 0x7b8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-f..rcluster-clientcore_31bf3856ad364e35_10.0.26100.1_none_8e3b30cca0ec36b8\resutils.dll Handle ID: 0x62c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-rsaenh-dll_31bf3856ad364e35_10.0.26100.1_none_5cbab82819d11359\rsaenh.dll Handle ID: 0x78c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-rasrtutils_31bf3856ad364e35_10.0.26100.1_none_0a093c7153072a22\rtutils.dll Handle ID: 0xdf0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-rundll32_31bf3856ad364e35_10.0.26100.1_none_d4f8f9f013772d69\rundll32.exe Handle ID: 0xdec Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-riched32_31bf3856ad364e35_10.0.26100.1_none_99f45c36eb283f55\riched20.dll Handle ID: 0x9ac Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-e..ymanagementservices_31bf3856ad364e35_10.0.26100.1_none_f0686e235fa185fd\sacsess.exe Handle ID: 0x6cc Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-e..ymanagementservices_31bf3856ad364e35_10.0.26100.1_none_f0686e235fa185fd\sacsvr.dll Handle ID: 0x734 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-u..ed-telemetry-client_31bf3856ad364e35_10.0.26100.1_none_9ce698286f793873\runexehelper.exe Handle ID: 0x9e0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-d..services-sam-netapi_31bf3856ad364e35_10.0.26100.1_none_83b5e8ea2eb7af67\samcli.dll Handle ID: 0x794 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-d..ory-services-samlib_31bf3856ad364e35_10.0.26100.1_none_31656b1a044c4692\samlib.dll Handle ID: 0x7b0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-rpc-local_31bf3856ad364e35_10.0.26100.1_none_b0ee4777ada0e9e4\rpcrt4.dll Handle ID: 0x9e8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-s..urationengineclient_31bf3856ad364e35_10.0.26100.1_none_35018abc41a80997\scecli.dll Handle ID: 0x6b4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-refsutil_31bf3856ad364e35_10.0.26100.1_none_e7aabc0a97f1787d\refsutil.exe Handle ID: 0x1190 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-taskscheduler-netapi_31bf3856ad364e35_10.0.26100.1_none_06b465f8a094214b\schedcli.dll Handle ID: 0x9f0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-storage-refsdedupsvc_31bf3856ad364e35_10.0.26100.1_none_d4cf850c696ef2f9\ReFsDedupSvc.exe Handle ID: 0x89c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_winpe-smi-schema_31bf3856ad364e35_10.0.26100.1_none_7e169d6d1fdb0a7b\schema.dat Handle ID: 0x880 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft.windows.h...sdhost-driverclass_31bf3856ad364e35_10.0.26100.1_none_bfe520d930bc2074\sdhcinst.dll Handle ID: 0x9ec Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-lsa-secur32_31bf3856ad364e35_10.0.26100.1_none_e61345cbd4b47363\secur32.dll Handle ID: 0x7e4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-s..ider-interface-stub_31bf3856ad364e35_10.0.26100.1_none_991fb9bdb7402dca\security.dll Handle ID: 0x748 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-com-base-qfe-rpcss_31bf3856ad364e35_10.0.26100.1_none_66be845ca66c98c1\rpcss.dll Handle ID: 0x5d8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-sens-client_31bf3856ad364e35_10.0.26100.1_none_fe36572725add6aa\SensApi.dll Handle ID: 0x894 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-directory-services-sam_31bf3856ad364e35_10.0.26100.1_none_aee201be098128e9\samsrv.dll Handle ID: 0x9f4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-s..configurationengine_31bf3856ad364e35_10.0.26100.1_none_b6188c13f12744d6\scesrv.dll Handle ID: 0x7b4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-b..onment-windows-base_31bf3856ad364e35_10.0.26100.1_none_62096f96932e66b4\setbcdlocale.dll Handle ID: 0xde8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-setup-events_31bf3856ad364e35_10.0.26100.1_none_4e5a604c8060025a\setupetw.dll Handle ID: 0xde4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-sfc_31bf3856ad364e35_10.0.26100.1_none_a4296bacc4be3ffd\sfc.dll Handle ID: 0xde0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-security-schannel_31bf3856ad364e35_10.0.26100.1_none_1f09f36ebdcf7146\schannel.dll Handle ID: 0x9d8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-sfc_31bf3856ad364e35_10.0.26100.1_none_a4296bacc4be3ffd\sfc_os.dll Handle ID: 0x9d4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-wrp-integrity-client_31bf3856ad364e35_10.0.26100.1_none_2832759d53d2cc4a\sfc.exe Handle ID: 0x888 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-sechost_31bf3856ad364e35_10.0.26100.1_none_84b6853e3582d144\sechost.dll Handle ID: 0x710 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-s..cecontroller-minwin_31bf3856ad364e35_10.0.26100.1_none_3c0c6dcf652fd9fa\services.exe Handle ID: 0x784 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-servicingcommon_31bf3856ad364e35_10.0.26100.1_none_3850cb60846b3bc0\ServicingCommon.dll Handle ID: 0xf80 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-shutdownux_31bf3856ad364e35_10.0.26100.1_none_d9bc1cc209e8d224\shutdownux.dll Handle ID: 0xf7c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-shlwapi_31bf3856ad364e35_10.0.26100.1_none_f6cd5a650d3b85cf\shlwapi.dll Handle ID: 0xf78 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-security-spp-client_31bf3856ad364e35_10.0.26100.1_none_93909a1b142c4c6f\slc.dll Handle ID: 0x88c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-wsp-spaces_31bf3856ad364e35_10.0.26100.1_none_632caa9216178221\smphost.dll Handle ID: 0xa08 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-shcore_31bf3856ad364e35_10.0.26100.1_none_c367856489c23aab\SHCore.dll Handle ID: 0xf88 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-snmp-common-api_31bf3856ad364e35_10.0.26100.1_none_300f9d83d77f3666\snmpapi.dll Handle ID: 0xf8c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-softpub-dll_31bf3856ad364e35_10.0.26100.1_none_e087af9ee779df2d\softpub.dll Handle ID: 0x6fc Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-smss-minwin_31bf3856ad364e35_10.0.26100.1_none_7b547ea3515807e4\smss.exe Handle ID: 0x798 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-spfileq_31bf3856ad364e35_10.0.26100.1_none_71da7e8e284ae54d\spfileq.dll Handle ID: 0xf9c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-smbserver-apis_31bf3856ad364e35_10.0.26100.1_none_cd1b7ac9ec1d0904\smbwmiv2.dll Handle ID: 0xf98 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-spinf_31bf3856ad364e35_10.0.26100.1_none_5a943f1de0f9c49f\spinf.dll Handle ID: 0x704 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-security-spp-client_31bf3856ad364e35_10.0.26100.1_none_93909a1b142c4c6f\sppc.dll Handle ID: 0xfa0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-s..agespaces-spaceutil_31bf3856ad364e35_10.0.26100.1_none_d958162a37b877a8\spaceutil.exe Handle ID: 0xf84 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-refs-sysprep_31bf3856ad364e35_10.0.26100.1_none_2ac36eb656444c4a\sprefs.dll Handle ID: 0xa0c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-smbserver-netapi_31bf3856ad364e35_10.0.26100.1_none_3d9a1b9db9182640\srvcli.dll Handle ID: 0x6e0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-pnpsysprep_31bf3856ad364e35_10.0.26100.1_none_3eb123dd1f9ef9ad\sppnp.dll Handle ID: 0x770 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-smbserver_31bf3856ad364e35_10.0.26100.1_none_f5e8915953681816\sscore.dll Handle ID: 0x8a4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-smi-engine_31bf3856ad364e35_10.0.26100.1_none_9508d7f47b6f7c85\SmiEngine.dll Handle ID: 0x814 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-lsa-minwin_31bf3856ad364e35_10.0.26100.1_none_3a5f49fdfadb01a4\sspisrv.dll Handle ID: 0x11fc Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-sstpconfig_31bf3856ad364e35_10.0.26100.1_none_16ba83385b8fdfa5\sstpcfg.dll Handle ID: 0x1208 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-packagemanager_31bf3856ad364e35_10.0.26100.1_none_e9cb6c7c5bd0e02c\SSShim.dll Handle ID: 0xa14 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-ole-automation-stdole2_31bf3856ad364e35_10.0.26100.1_none_e5ca6ba48181e459\stdole2.tlb Handle ID: 0xa20 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-o..ion-legacy-stdole32_31bf3856ad364e35_10.0.26100.1_none_dec457a880857bde\stdole32.tlb Handle ID: 0x120c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-smbserver_31bf3856ad364e35_10.0.26100.1_none_f5e8915953681816\srvsvc.dll Handle ID: 0x76c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-swenumstreamci_31bf3856ad364e35_10.0.26100.1_none_bced274a7e73257c\streamci.dll Handle ID: 0xfb4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-lsa-minwin_31bf3856ad364e35_10.0.26100.1_none_3a5f49fdfadb01a4\sspicli.dll Handle ID: 0xa24 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-m..ommandlineutilities_31bf3856ad364e35_10.0.26100.1_none_7a109607cfe12f00\subst.exe Handle ID: 0xa1c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-storprop_31bf3856ad364e35_10.0.26100.1_none_23465cd799764fe2\Storprop.dll Handle ID: 0xfbc Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-svsvc_31bf3856ad364e35_10.0.26100.1_none_5ea97dfbde641f2e\svsvc.dll Handle ID: 0xfb8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-rasbase-rassstp_31bf3856ad364e35_10.0.26100.1_none_96c5585350791779\sstpsvc.dll Handle ID: 0x1210 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-sx-shared_31bf3856ad364e35_10.0.26100.1_none_3597693b8216f8ca\sxshared.dll Handle ID: 0x1214 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-services-svchost_31bf3856ad364e35_10.0.26100.1_none_b2af02016dda586a\svchost.exe Handle ID: 0x1218 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-sxssrv_31bf3856ad364e35_10.0.26100.1_none_5d7981ce1fc99080\sxssrv.dll Handle ID: 0x121c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-sxs_31bf3856ad364e35_10.0.26100.1_none_ab40447cc03055bf\sxstrace.exe Handle ID: 0x1220 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-cryptography-symcrypt_31bf3856ad364e35_10.0.26100.1_none_10c2fe5444e1ee31\symcryptk.dll Handle ID: 0x1224 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-winlogon-sysntfy_31bf3856ad364e35_10.0.26100.1_none_52669b82783fdfd3\sysntfy.dll Handle ID: 0x8b0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-sysclass_31bf3856ad364e35_10.0.26100.1_none_961c19aa21e77622\sysclass.dll Handle ID: 0xa30 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-syssetup_31bf3856ad364e35_10.0.26100.1_none_6dc4342e004365df\syssetup.dll Handle ID: 0xa38 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-takeown_31bf3856ad364e35_10.0.26100.1_none_f6df0e2a7e2ab480\takeown.exe Handle ID: 0x8ac Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-systemeventsbroker_31bf3856ad364e35_10.0.26100.1_none_c594ec35a6085cf8\SystemEventsBrokerServer.dll Handle ID: 0x1228 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-vsssystemprovider_31bf3856ad364e35_10.0.26100.1_none_4826a232dcab4563\swprv.dll Handle ID: 0x122c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-tapi2xclient_31bf3856ad364e35_10.0.26100.1_none_c56a1398a823375e\tapi32.dll Handle ID: 0x8c0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-tcpip-utility_31bf3856ad364e35_10.0.26100.1_none_2fba9c0ab76abd38\TCPSVCS.EXE Handle ID: 0x7a4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-sxs_31bf3856ad364e35_10.0.26100.1_none_ab40447cc03055bf\sxs.dll Handle ID: 0xa28 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-tcpip_31bf3856ad364e35_10.0.26100.1_none_5e793e3cf7e6453d\tcpipcfg.dll Handle ID: 0x8b4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-legacytaskmanager_31bf3856ad364e35_10.0.26100.1_none_00a7151acbcb1ed2\taskmgr.exe Handle ID: 0xa34 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-c..tem-tracedatahelper_31bf3856ad364e35_10.0.26100.1_none_f1feee4173ff2403\tdh.dll Handle ID: 0xa18 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-timebroker_31bf3856ad364e35_10.0.26100.1_none_cab18e9bdaedc67d\TimeBrokerClient.dll Handle ID: 0x890 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-directwrite_31bf3856ad364e35_10.0.26100.1_none_cf91178267fbaa39\TextShaping.dll Handle ID: 0xa10 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-timebroker_31bf3856ad364e35_10.0.26100.1_none_cab18e9bdaedc67d\TimeBrokerServer.dll Handle ID: 0x8cc Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-ping-utilities_31bf3856ad364e35_10.0.26100.1_none_a6254d67f86762da\TRACERT.EXE Handle ID: 0x8a0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-m..ommandlineutilities_31bf3856ad364e35_10.0.26100.1_none_457f9751bea691f1\tree.com Handle ID: 0x780 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-security-tokenbinding_31bf3856ad364e35_10.0.26100.1_none_7a137862d2a4be12\tokenbinding.dll Handle ID: 0xa44 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-t..r-decodingresources_31bf3856ad364e35_10.0.26100.1_none_67c91942b19c559b\tdhres.dll Handle ID: 0xa3c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-tssessionux-library_31bf3856ad364e35_10.0.26100.1_none_779d0483272085d5\TSSessionUX.dll Handle ID: 0x8b8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-s..stedsignal-credprov_31bf3856ad364e35_10.0.26100.1_none_cb56df9e4349ff45\TrustedSignalCredProv.dll Handle ID: 0x8c8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..rnational-timezones_31bf3856ad364e35_10.0.26100.1_none_123afed6721eab68\tzres.dll Handle ID: 0x75c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-eapttls_31bf3856ad364e35_10.0.26100.1_none_2009c256c141db00\TtlsCfg.dll Handle ID: 0x724 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-setupapi_31bf3856ad364e35_10.0.26100.1_none_31e902112eca74da\setupapi.dll Handle ID: 0x8bc Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-m..odeupdate-servicing_31bf3856ad364e35_10.0.26100.1_none_a07bad500e90d9fe\ucsvc.exe Handle ID: 0x1230 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-f..utilityexfatlibrary_31bf3856ad364e35_10.0.26100.1_none_26f30d3da6cd062f\uexfat.dll Handle ID: 0x714 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-eapttls_31bf3856ad364e35_10.0.26100.1_none_2009c256c141db00\TtlsAuth.dll Handle ID: 0x1234 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-f..emutilityfatlibrary_31bf3856ad364e35_10.0.26100.1_none_4b5595f5c25140f0\ufat.dll Handle ID: 0x8d4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-uio_31bf3856ad364e35_10.0.26100.1_none_a97d7e10c150f5e2\uiomapapi.dll Handle ID: 0x1238 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-pdc-dll_31bf3856ad364e35_10.0.26100.1_none_98d03814d0f36e83\umpdc.dll Handle ID: 0x123c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-f..temutilitylibraries_31bf3856ad364e35_10.0.26100.1_none_e68a00385839f41d\ulib.dll Handle ID: 0x8dc Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-os-kernel-la57_31bf3856ad364e35_10.0.26100.1_none_496a8b64dc619527\ntkrla57.exe Handle ID: 0x1244 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-onecore-pnp-umpnpmgr_31bf3856ad364e35_10.0.26100.1_none_19e478d6b5ce0836\umpnpmgr.dll Handle ID: 0x1240 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-textinputframework_31bf3856ad364e35_10.0.26100.1_none_7422c347ce5f57f8\TextInputFramework.dll Handle ID: 0x1248 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-p..structureexecutable_31bf3856ad364e35_10.0.26100.1_none_f4fc28dfbe94dd08\unlodctr.exe Handle ID: 0x1250 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-usermodepowerservice_31bf3856ad364e35_10.0.26100.1_none_5afe2f6ab4ffed71\umpo.dll Handle ID: 0xa50 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-setup-unattend_31bf3856ad364e35_10.0.26100.1_none_92a8926ede439d60\unattend.dll Handle ID: 0x7cc Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-unionfs-driver_31bf3856ad364e35_10.0.26100.1_none_a8be3a51cfb11770\UnionFSApi.dll Handle ID: 0x1254 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-deltapackageexpander_31bf3856ad364e35_10.0.26100.1_none_66d23e8f9d9475d0\UpdateCompression.dll Handle ID: 0x124c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-ucrt_31bf3856ad364e35_10.0.26100.1_none_a8b4dda7820c840d\ucrtbase.dll Handle ID: 0x73c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.26100.1_none_c4588310e9a6e860\ucrtbase.dll Handle ID: 0xa4c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-m..ommandlineutilities_31bf3856ad364e35_10.0.26100.1_none_7a109607cfe12f00\ureg.dll Handle ID: 0x744 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-f..mutilityntfslibrary_31bf3856ad364e35_10.0.26100.1_none_fbb7602d5c79c566\untfs.dll Handle ID: 0xfe4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-f..tilityrefsv1library_31bf3856ad364e35_10.0.26100.1_none_0d0514e180964d60\uReFSv1.dll Handle ID: 0x6c0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-userenv_31bf3856ad364e35_10.0.26100.1_none_8d3412d3b3cf7427\userenv.dll Handle ID: 0xff8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-userinitext_31bf3856ad364e35_10.0.26100.1_none_b7cb9d746c153e03\userinitext.dll Handle ID: 0xff4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-userinit_31bf3856ad364e35_10.0.26100.1_none_d91c62763a3c9290\userinit.exe Handle ID: 0xff0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-system-user-ext_31bf3856ad364e35_10.0.26100.1_none_78549f22879e3f66\usermgrcli.dll Handle ID: 0xfec Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-os-kernel_31bf3856ad364e35_10.0.26100.1_none_69240a011cafaced\ntoskrnl.exe Handle ID: 0xfe8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-usp_31bf3856ad364e35_10.0.26100.1_none_a9ee216ec108fab3\usp10.dll Handle ID: 0xa48 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-u..ed-telemetry-client_31bf3856ad364e35_10.0.26100.1_none_9ce698286f793873\utcapi.dll Handle ID: 0xfdc Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-u..ed-telemetry-client_31bf3856ad364e35_10.0.26100.1_none_9ce698286f793873\utcutil.dll Handle ID: 0xfd8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-t..nalservices-utildll_31bf3856ad364e35_10.0.26100.1_none_0e719245f9cb61cc\utildll.dll Handle ID: 0xa58 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-system-user-component_31bf3856ad364e35_10.0.26100.1_none_622d676ea334de9a\UserMgrProxy.dll Handle ID: 0x8e0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-f..mutilityudfslibrary_31bf3856ad364e35_10.0.26100.1_none_e8b43930c51624dd\uudf.dll Handle ID: 0x7d4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-uxinit_31bf3856ad364e35_10.0.26100.1_none_5a4998fe54bf3906\UXInit.dll Handle ID: 0x8f8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-f..mutilityrefslibrary_31bf3856ad364e35_10.0.26100.1_none_f8ec7da0b7a34a81\uReFS.dll Handle ID: 0x7c8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-v..rvice-basicprovider_31bf3856ad364e35_10.0.26100.1_none_1a3961acdc7a6394\vdsbas.dll Handle ID: 0x70c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-uxtheme_31bf3856ad364e35_10.0.26100.1_none_a2d843346f1c3597\uxtheme.dll Handle ID: 0xa5c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-user32_31bf3856ad364e35_10.0.26100.1_none_ca2c14a1d5e919b7\user32.dll Handle ID: 0x788 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-virtualdiskservice_31bf3856ad364e35_10.0.26100.1_none_67de7b00633b36be\vdsldr.exe Handle ID: 0x7ec Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-system-user-service_31bf3856ad364e35_10.0.26100.1_none_884bf1f2db894964\usermgr.dll Handle ID: 0x71c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-virtualdiskservice_31bf3856ad364e35_10.0.26100.1_none_67de7b00633b36be\vds.exe Handle ID: 0xa54 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-v..virtualdiskprovider_31bf3856ad364e35_10.0.26100.1_none_fa61cdf04ef9d62c\vdsvd.dll Handle ID: 0x5d4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-virtualdiskservice_31bf3856ad364e35_10.0.26100.1_none_67de7b00633b36be\vdsutil.dll Handle ID: 0x764 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..ersandsecurityzones_31bf3856ad364e35_11.0.26100.1_none_e5c83b14aa3063af\urlmon.dll Handle ID: 0x8d8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-version_31bf3856ad364e35_10.0.26100.1_none_11f1f78fb9725679\version.dll Handle ID: 0x908 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-virtualdiskservice_31bf3856ad364e35_10.0.26100.1_none_67de7b00633b36be\vds_ps.dll Handle ID: 0xa74 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-vhfapi_31bf3856ad364e35_10.0.26100.1_none_c6ec54c1d3d2aa23\VhfUm.dll Handle ID: 0x8fc Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-onecore-driververifier-tools_31bf3856ad364e35_10.0.26100.1_none_bdf048c924d16bbd\verifier.exe Handle ID: 0xa70 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-virtualdiskapilibrary_31bf3856ad364e35_10.0.26100.1_none_ea5648aa70fe7df0\virtdisk.dll Handle ID: 0x8f0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-driververifier_31bf3856ad364e35_10.0.26100.1_none_b75f8378054800cf\verifiergui.exe Handle ID: 0x7c4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-v..ice-dynamicprovider_31bf3856ad364e35_10.0.26100.1_none_5aecd49b19251fbf\vdsdyn.dll Handle ID: 0xa6c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-rasbase-vpnikeapi_31bf3856ad364e35_10.0.26100.1_none_42df59c05288b0a2\vpnikeapi.dll Handle ID: 0x758 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-vssapi-core_31bf3856ad364e35_10.0.26100.1_none_d72d637884556e1b\vsstrace.dll Handle ID: 0xa78 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-vssproxystub_31bf3856ad364e35_10.0.26100.1_none_2dafc8ba927df977\vss_ps.dll Handle ID: 0x808 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-d..oryservices-ntdsapi_31bf3856ad364e35_10.0.26100.1_none_cbd0eec659c2eb5c\w32topl.dll Handle ID: 0x80c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-wallpaperhost_31bf3856ad364e35_10.0.26100.1_none_5af79fff0de92429\WallpaperHost.exe Handle ID: 0xaa4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-verifier_31bf3856ad364e35_10.0.26100.1_none_c6f8ddc3313a053d\verifier.dll Handle ID: 0xaa0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-pantherengine_31bf3856ad364e35_10.0.26100.1_none_ab0517f10e635259\wdscore.dll Handle ID: 0xa98 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-security-digest_31bf3856ad364e35_10.0.26100.1_none_37c0f377e541ae4e\wdigest.dll Handle ID: 0xa94 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-w..-protocol-component_31bf3856ad364e35_10.0.26100.1_none_de6cb380d34455ab\Websocket.dll Handle ID: 0x8ec Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-time-service_31bf3856ad364e35_10.0.26100.1_none_859b0c0fd5d73fb4\w32time.dll Handle ID: 0xaac Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-rasbase-agilevpn_31bf3856ad364e35_10.0.26100.1_none_ac66038500ae25ed\vpnike.dll Handle ID: 0xab0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-errorreportingcore_31bf3856ad364e35_10.0.26100.1_none_1d6a5a766e70d66e\werdiagcontroller.dll Handle ID: 0xab4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-errorreportingfaults_31bf3856ad364e35_10.0.26100.1_none_6cfac502a555ebbe\WerEnc.dll Handle ID: 0xfd4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-webio_31bf3856ad364e35_10.0.26100.1_none_59dde27e473fd501\webio.dll Handle ID: 0xfd0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-errorreportingcore_31bf3856ad364e35_10.0.26100.1_none_1d6a5a766e70d66e\weretw.dll Handle ID: 0xac0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-shell32_31bf3856ad364e35_10.0.26100.1_none_691cd33e7a888844\shell32.dll Handle ID: 0xabc Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-errorreportingfaults_31bf3856ad364e35_10.0.26100.1_none_6cfac502a555ebbe\WerFaultSecure.exe Handle ID: 0xacc Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-errorreportingcore_31bf3856ad364e35_10.0.26100.1_none_1d6a5a766e70d66e\wermgr.exe Handle ID: 0xa80 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-errorreportingfaults_31bf3856ad364e35_10.0.26100.1_none_6cfac502a555ebbe\WerFault.exe Handle ID: 0xab8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-feedback-service_31bf3856ad364e35_10.0.26100.1_none_76bf9bc1f9723a2e\wersvc.dll Handle ID: 0xac4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-errorreportingcore_31bf3856ad364e35_10.0.26100.1_none_1d6a5a766e70d66e\wer.dll Handle ID: 0xaec Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-wimgapi_31bf3856ad364e35_10.0.26100.1_none_85ef4aca7d6b243b\WimBootCompress.ini Handle ID: 0xad0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-eventlog-api_31bf3856ad364e35_10.0.26100.1_none_a924aa7ccdd6ccec\wevtapi.dll Handle ID: 0xaf0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_networking-mpssvc-svc_31bf3856ad364e35_10.0.26100.1_none_9707e3d93069581e\wfapigp.dll Handle ID: 0x1004 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-eventlog-commandline_31bf3856ad364e35_10.0.26100.1_none_bdc7ddffe55ca20d\wevtutil.exe Handle ID: 0xaf8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-uiautomationcore_31bf3856ad364e35_10.0.26100.1_none_ad0c3bffaaa87f15\UIAutomationCore.dll Handle ID: 0xae8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-vssapi-core_31bf3856ad364e35_10.0.26100.1_none_d72d637884556e1b\vssapi.dll Handle ID: 0xae4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-win32kbasers_31bf3856ad364e35_10.0.26100.1_none_ed479cca903492e7\win32kbase_rs.sys Handle ID: 0xae0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-webservices_31bf3856ad364e35_10.0.26100.1_none_0b700099973eda57\webservices.dll Handle ID: 0xad4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-wimgapi_31bf3856ad364e35_10.0.26100.1_none_85ef4aca7d6b243b\wimserv.exe Handle ID: 0xa2c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-win32k_31bf3856ad364e35_10.0.26100.1_none_b5e7221b03136445\win32u.dll Handle ID: 0x8c4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-s..y-biometrics-client_31bf3856ad364e35_10.0.26100.1_none_af0c68ffed54f603\winbio.dll Handle ID: 0xa40 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-branding-engine_31bf3856ad364e35_10.0.26100.1_none_e65d80fdcdf0a76f\winbrand.dll Handle ID: 0x8d0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-win32k_31bf3856ad364e35_10.0.26100.1_none_b5e7221b03136445\win32k.sys Handle ID: 0x774 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-wimgapi_31bf3856ad364e35_10.0.26100.1_none_85ef4aca7d6b243b\wimgapi.dll Handle ID: 0xafc Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-wincredui_31bf3856ad364e35_10.0.26100.1_none_ede85d086434fc5d\wincredui.dll Handle ID: 0x1010 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-eventlog_31bf3856ad364e35_10.0.26100.1_none_d9b8047a7b65ca09\wevtsvc.dll Handle ID: 0xfcc Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-com-base_31bf3856ad364e35_10.0.26100.1_none_0ae1ded78f1218c8\wincorlib.dll Handle ID: 0xfc8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-d..umaninterfacedevice_31bf3856ad364e35_10.0.26100.1_none_1d6483690e50d8c7\Windows.Devices.HumanInterfaceDevice.dll Handle ID: 0x1018 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-system-remote_31bf3856ad364e35_10.0.26100.1_none_48fe8a2545a7064d\Windows.System.RemoteDesktop.dll Handle ID: 0x1008 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..-ui-logon-proxystub_31bf3856ad364e35_10.0.26100.1_none_f91d81ab2b13cd46\Windows.Internal.UI.Logon.ProxyStub.dll Handle ID: 0xaf4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-windowsstorage-onecore_31bf3856ad364e35_10.0.26100.1_none_849274f227d02a55\Windows.Storage.OneCore.dll Handle ID: 0xffc Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-creddialogcontroller_31bf3856ad364e35_10.0.26100.1_none_29f871efcbd58dd1\Windows.UI.CredDialogController.dll Handle ID: 0xfe0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft.windows.winhttpcom_31bf3856ad364e35_5.1.26100.1_none_3a90c2492816ca9b\winhttpcom.dll Handle ID: 0x1258 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-fileexplorer-common_31bf3856ad364e35_10.0.26100.1_none_6a45411dd46ca7ee\Windows.FileExplorer.Common.dll Handle ID: 0x125c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-wininit_31bf3856ad364e35_10.0.26100.1_none_2de6612f6cdd4127\wininit.exe Handle ID: 0x1260 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-wininitext_31bf3856ad364e35_10.0.26100.1_none_958241cecaa69380\wininitext.dll Handle ID: 0x1264 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-n..-domain-clients-svc_31bf3856ad364e35_10.0.26100.1_none_410220325491d8f1\winipsec.dll Handle ID: 0x1268 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft.windows.winhttp_31bf3856ad364e35_5.1.26100.1_none_8967b366ca40bd5e\winhttp.dll Handle ID: 0x126c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-coresystem-wpr_31bf3856ad364e35_10.0.26100.1_none_5f231689007e0de9\windowsperformancerecordercontrol.dll Handle ID: 0x1034 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-windowscodec_31bf3856ad364e35_10.0.26100.1_none_93755fdb09aab880\WindowsCodecs.dll Handle ID: 0x1030 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-winlogon-ext_31bf3856ad364e35_10.0.26100.1_none_80938a26dc545ad2\winlogonext.dll Handle ID: 0x614 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-winlogon_31bf3856ad364e35_10.0.26100.1_none_6cb6a9773d7e167a\winlogon.exe Handle ID: 0x102c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-a..o-mmecore-winmmbase_31bf3856ad364e35_10.0.26100.1_none_193fd3fcc7f0d308\winmm.dll Handle ID: 0xb00 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..nal-core-locale-nls_31bf3856ad364e35_10.0.26100.1_none_67abd93a11d25c56\winnlsres.dll Handle ID: 0xb04 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-usermodensi_31bf3856ad364e35_10.0.26100.1_none_6f55cb4030007b27\winnsi.dll Handle ID: 0x1024 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-winpe-background_31bf3856ad364e35_10.0.26100.1_none_79b2b50620c1f45f\winpe.jpg Handle ID: 0x1020 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-win32kbase_31bf3856ad364e35_10.0.26100.1_none_ab69ee28cf49f714\win32kbase.sys Handle ID: 0x101c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-winpe_tools_31bf3856ad364e35_10.0.26100.1_none_f7f34b419f6c6524\winpeshl.exe Handle ID: 0xb08 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-audio-mmecore-base_31bf3856ad364e35_10.0.26100.1_none_b2d3649aba3cb60c\winmmbase.dll Handle ID: 0xb14 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-s..cardsubsystemclient_31bf3856ad364e35_10.0.26100.1_none_15d822a3e225d304\WinSCard.dll Handle ID: 0x100c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-branding-engine_31bf3856ad364e35_10.0.26100.1_none_e65d80fdcdf0a76f\winsku.dll Handle ID: 0xa84 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-winsrv_31bf3856ad364e35_10.0.26100.1_none_b3723f0304e1d030\winsrv.dll Handle ID: 0x7f8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-b..vironment-os-loader_31bf3856ad364e35_10.0.26100.1_none_581a6292d5337acd\winload.exe Handle ID: 0xb0c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_11.0.26100.1_none_32ce16b675398a42\wininet.dll Handle ID: 0x1038 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-winsrvext_31bf3856ad364e35_10.0.26100.1_none_c4f0439a42fa2415\winsrvext.dll Handle ID: 0xb24 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-p..ting-spooler-client_31bf3856ad364e35_10.0.26100.1_none_90219e7f813a6b0b\winspool.drv Handle ID: 0x1028 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-win32k_31bf3856ad364e35_10.0.26100.1_none_b5e7221b03136445\win32kfull.sys Handle ID: 0x1014 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-w..ationservice-netapi_31bf3856ad364e35_10.0.26100.1_none_726eff1b1dbdda61\wkscli.dll Handle ID: 0xadc Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-t..nalservices-runtime_31bf3856ad364e35_10.0.26100.1_none_d9d397c5348d8080\winsta.dll Handle ID: 0x910 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-wlanutil_31bf3856ad364e35_10.0.26100.1_none_380b5b9b7696d93b\wlanutil.dll Handle ID: 0x1044 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-wintrust-dll_31bf3856ad364e35_10.0.26100.1_none_eca1e226029d7f88\wintrust.dll Handle ID: 0x924 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-wmistub_31bf3856ad364e35_10.0.26100.1_none_9ab5f00b1c137b08\wmi.dll Handle ID: 0x810 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-wmi-wmiclnt_31bf3856ad364e35_10.0.26100.1_none_f2e95d55f88906f1\wmiclnt.dll Handle ID: 0x81c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-w..ropertypageprovider_31bf3856ad364e35_10.0.26100.1_none_8004a310e58d6ef0\wmiprop.dll Handle ID: 0x904 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-wininit_31bf3856ad364e35_10.0.26100.1_none_2de6612f6cdd4127\wmsgapi.dll Handle ID: 0x830 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-wofutil_31bf3856ad364e35_10.0.26100.1_none_881aa6d474e3f237\WofUtil.dll Handle ID: 0x1048 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-workstationservice_31bf3856ad364e35_10.0.26100.1_none_c92dc04e3f5e5bf9\wkssvc.dll Handle ID: 0x82c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-winsqlite3_31bf3856ad364e35_10.0.26100.1_none_1350bdcb91fd05aa\winsqlite3.dll Handle ID: 0xb10 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-ci-wldp-dll_31bf3856ad364e35_10.0.26100.1_none_91f815f4f3001040\wldp.dll Handle ID: 0x90c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-setupapi_31bf3856ad364e35_10.0.26100.1_none_31e902112eca74da\wowreg32.exe Handle ID: 0xb18 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-winpe_tools_31bf3856ad364e35_10.0.26100.1_none_f7f34b419f6c6524\wpeutil.exe Handle ID: 0x914 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-coresystem-wpr_31bf3856ad364e35_10.0.26100.1_none_5f231689007e0de9\wpr.config.xml Handle ID: 0x6bc Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-winpe_tools_31bf3856ad364e35_10.0.26100.1_none_f7f34b419f6c6524\wpeinit.exe Handle ID: 0xb1c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-ldap-client_31bf3856ad364e35_10.0.26100.1_none_f02feff7bef84e60\Wldap32.dll Handle ID: 0x928 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-w..nfrastructure-other_31bf3856ad364e35_10.0.26100.1_none_0178aace5fe795ee\ws2help.dll Handle ID: 0x824 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-winpe_tools_31bf3856ad364e35_10.0.26100.1_none_f7f34b419f6c6524\wpeutil.dll Handle ID: 0x918 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-w..nfrastructure-other_31bf3856ad364e35_10.0.26100.1_none_0178aace5fe795ee\wshelper.dll Handle ID: 0xad8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-hyper-v-winsock-provider_31bf3856ad364e35_10.0.26100.1_none_d48ec96282bcf373\wshhyperv.dll Handle ID: 0x6f4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-winsock-helper-tcpip_31bf3856ad364e35_10.0.26100.1_none_c8a6ae229a141fdf\wship6.dll Handle ID: 0xac8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-winsock-helper-tcpip_31bf3856ad364e35_10.0.26100.1_none_c8a6ae229a141fdf\WSHTCPIP.DLL Handle ID: 0x103c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-winsock-legacy_31bf3856ad364e35_10.0.26100.1_none_e058df097a135955\wsock32.dll Handle ID: 0xa68 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-t..services-publicapis_31bf3856ad364e35_10.0.26100.1_none_c42493be2ee1d6a0\wtsapi32.dll Handle ID: 0x1270 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-f..g-onesettingsclient_31bf3856ad364e35_10.0.26100.1_none_871eaf612d59ebbc\wosc.dll Handle ID: 0xb50 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-b..vironment-os-loader_31bf3856ad364e35_10.0.26100.1_none_581a6292d5337acd\winload.efi Handle ID: 0xb4c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-xcopy_31bf3856ad364e35_10.0.26100.1_none_5fe953095cd8da00\xcopy.exe Handle ID: 0x1060 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-coresystem-wpr_31bf3856ad364e35_10.0.26100.1_none_5f231689007e0de9\wpr.exe Handle ID: 0x105c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-comctl32-v5.resources_31bf3856ad364e35_10.0.26100.1_af-za_cb9ee844390c79e6\comctl32.dll.mui Handle ID: 0xb2c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-font-fms.resources_31bf3856ad364e35_10.0.26100.1_af-za_6b59c293a9d4cb25\fms.dll.mui Handle ID: 0xb3c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-mlang.resources_31bf3856ad364e35_10.0.26100.1_af-za_ef17c74cb5f8249e\mlang.dll.mui Handle ID: 0xb40 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-comctl32-v5.resources_31bf3856ad364e35_10.0.26100.1_am-et_d3c21fa233d8794d\comctl32.dll.mui Handle ID: 0xb34 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-w..nfrastructure-ws232_31bf3856ad364e35_10.0.26100.1_none_efab592336e2a049\ws2_32.dll Handle ID: 0xb38 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-comdlg32.resources_31bf3856ad364e35_10.0.26100.1_af-za_53cb52b413175d9c\comdlg32.dll.mui Handle ID: 0xb30 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-font-fms.resources_31bf3856ad364e35_10.0.26100.1_am-et_737cf9f1a4a0ca8c\fms.dll.mui Handle ID: 0x1054 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-mlang.resources_31bf3856ad364e35_10.0.26100.1_am-et_f73afeaab0c42405\mlang.dll.mui Handle ID: 0x106c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-comdlg32.resources_31bf3856ad364e35_10.0.26100.1_am-et_5bee8a120de35d03\comdlg32.dll.mui Handle ID: 0xb64 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-comctl32-v5.resources_31bf3856ad364e35_10.0.26100.1_ar-sa_cb1dc8ac396d15cb\comctl32.dll.mui Handle ID: 0xb60 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-xmllite_31bf3856ad364e35_10.0.26100.1_none_862f26f30bdb28bc\xmllite.dll Handle ID: 0xb6c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-cdosys.resources_31bf3856ad364e35_10.0.26100.1_ar-sa_c89ecfcc657a19a9\cdosys.dll.mui Handle ID: 0x107c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-font-fms.resources_31bf3856ad364e35_10.0.26100.1_ar-sa_6ad8a2fbaa35670a\fms.dll.mui Handle ID: 0xb5c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-comctl32-v5.resources_31bf3856ad364e35_10.0.26100.1_as-in_d0d7b9e635bf6c4d\comctl32.dll.mui Handle ID: 0x1078 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-mlang.resources_31bf3856ad364e35_10.0.26100.1_ar-sa_ee96a7b4b658c083\mlang.dll.mui Handle ID: 0x1074 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-font-fms.resources_31bf3856ad364e35_10.0.26100.1_as-in_70929435a687bd8c\fms.dll.mui Handle ID: 0x1070 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-comdlg32.resources_31bf3856ad364e35_10.0.26100.1_ar-sa_534a331c1377f981\comdlg32.dll.mui Handle ID: 0x1050 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..er-engine.resources_31bf3856ad364e35_10.0.26100.1_ar-sa_af75f4ef024a79a1\msimsg.dll.mui Handle ID: 0x104c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-comctl32-v5.resources_31bf3856ad364e35_10.0.26100.1_az-..-az_99459d412533e73a\comctl32.dll.mui Handle ID: 0x828 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-mlang.resources_31bf3856ad364e35_10.0.26100.1_as-in_f45098eeb2ab1705\mlang.dll.mui Handle ID: 0xba0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-font-fms.resources_31bf3856ad364e35_10.0.26100.1_az-..-az_3900779095fc3879\fms.dll.mui Handle ID: 0xb70 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-comctl32-v5.resources_31bf3856ad364e35_10.0.26100.1_be-by_796ecb4924bb80be\comctl32.dll.mui Handle ID: 0xba4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-mlang.resources_31bf3856ad364e35_10.0.26100.1_az-..-az_bcbe7c49a21f91f2\mlang.dll.mui Handle ID: 0xba8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-comdlg32.resources_31bf3856ad364e35_10.0.26100.1_as-in_590424560fca5003\comdlg32.dll.mui Handle ID: 0xb9c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-font-fms.resources_31bf3856ad364e35_10.0.26100.1_be-by_1929a5989583d1fd\fms.dll.mui Handle ID: 0x1068 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-mlang.resources_31bf3856ad364e35_10.0.26100.1_be-by_9ce7aa51a1a72b76\mlang.dll.mui Handle ID: 0xb28 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-comctl32-v5.resources_31bf3856ad364e35_10.0.26100.1_bg-bg_715daa3529ed6722\comctl32.dll.mui Handle ID: 0x91c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-comdlg32.resources_31bf3856ad364e35_10.0.26100.1_az-..-az_217207b0ff3ecaf0\comdlg32.dll.mui Handle ID: 0x1040 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-font-fms.resources_31bf3856ad364e35_10.0.26100.1_bg-bg_111884849ab5b861\fms.dll.mui Handle ID: 0xbb8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-mlang.resources_31bf3856ad364e35_10.0.26100.1_bg-bg_94d6893da6d911da\mlang.dll.mui Handle ID: 0x6ac Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-comdlg32.resources_31bf3856ad364e35_10.0.26100.1_be-by_019b35b8fec66474\comdlg32.dll.mui Handle ID: 0xb20 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-comctl32-v5.resources_31bf3856ad364e35_10.0.26100.1_bn-in_742c0d8b2827fdd1\comctl32.dll.mui Handle ID: 0xfc4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-font-fms.resources_31bf3856ad364e35_10.0.26100.1_bn-in_13e6e7da98f04f10\fms.dll.mui Handle ID: 0xb98 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-comdlg32.resources_31bf3856ad364e35_10.0.26100.1_bg-bg_f98a14a503f84ad8\comdlg32.dll.mui Handle ID: 0x8e4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-mlang.resources_31bf3856ad364e35_10.0.26100.1_bn-in_97a4ec93a513a889\mlang.dll.mui Handle ID: 0x690 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-comctl32-v5.resources_31bf3856ad364e35_10.0.26100.1_bs-..-ba_f40d38393eacfa28\comctl32.dll.mui Handle ID: 0x92c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-comdlg32.resources_31bf3856ad364e35_10.0.26100.1_bn-in_fc5877fb0232e187\comdlg32.dll.mui Handle ID: 0x84c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-font-fms.resources_31bf3856ad364e35_10.0.26100.1_bs-..-ba_93c81288af754b67\fms.dll.mui Handle ID: 0xbd4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..er-engine.resources_31bf3856ad364e35_10.0.26100.1_bg-bg_55b5d677f2cacaf8\msimsg.dll.mui Handle ID: 0xbc0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-comctl32-v5.resources_31bf3856ad364e35_10.0.26100.1_ca-es_1a0edf9618e25fec\comctl32.dll.mui Handle ID: 0xfc0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-mlang.resources_31bf3856ad364e35_10.0.26100.1_bs-..-ba_17861741bb98a4e0\mlang.dll.mui Handle ID: 0xa04 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-font-fms.resources_31bf3856ad364e35_10.0.26100.1_ca-es_b9c9b9e589aab12b\fms.dll.mui Handle ID: 0x8a8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-comctl32-v5.resources_31bf3856ad364e35_10.0.26100.1_ca-..cia_6b27b89648793f18\comctl32.dll.mui Handle ID: 0x1094 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-comdlg32.resources_31bf3856ad364e35_10.0.26100.1_bs-..-ba_7c39a2a918b7ddde\comdlg32.dll.mui Handle ID: 0x109c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-mlang.resources_31bf3856ad364e35_10.0.26100.1_ca-es_3d87be9e95ce0aa4\mlang.dll.mui Handle ID: 0x1098 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-com-base_31bf3856ad364e35_10.0.26100.1_none_0ae1ded78f1218c8\WinTypes.dll Handle ID: 0xfa4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-font-fms.resources_31bf3856ad364e35_10.0.26100.1_ca-..cia_0ae292e5b9419057\fms.dll.mui Handle ID: 0xf94 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-mlang.resources_31bf3856ad364e35_10.0.26100.1_ca-..cia_8ea0979ec564e9d0\mlang.dll.mui Handle ID: 0xf90 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-comdlg32.resources_31bf3856ad364e35_10.0.26100.1_ca-es_a23b4a05f2ed43a2\comdlg32.dll.mui Handle ID: 0x10ac Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-comdlg32.resources_31bf3856ad364e35_10.0.26100.1_ca-..cia_f3542306228422ce\comdlg32.dll.mui Handle ID: 0x10a8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-comctl32-v5.resources_31bf3856ad364e35_10.0.26100.1_chr..-us_2d7967a1b0f6f9a0\comctl32.dll.mui Handle ID: 0x10b4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-codeintegrity_31bf3856ad364e35_10.0.26100.1_none_9d6b999e6d4c7ecb\previous.driver.stl Handle ID: 0x700 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-codeintegrity_31bf3856ad364e35_10.0.26100.1_none_9d6b999e6d4c7ecb\driver.stl Handle ID: 0x7ac Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-font-fms.resources_31bf3856ad364e35_10.0.26100.1_chr..-us_cd3441f121bf4adf\fms.dll.mui Handle ID: 0x9fc Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-mlang.resources_31bf3856ad364e35_10.0.26100.1_chr..-us_50f246aa2de2a458\mlang.dll.mui Handle ID: 0x898 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-comdlg32.resources_31bf3856ad364e35_10.0.26100.1_chr..-us_b5a5d2118b01dd56\comdlg32.dll.mui Handle ID: 0xa00 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-c..egrity-driverpolicy_31bf3856ad364e35_10.0.26100.1_none_b129a5c54c9dc8d4\driversipolicy.p7b Handle ID: 0x10dc Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-provisioningxml_31bf3856ad364e35_10.0.26100.1_none_049e331f9bc76cf3\wpx.dll Handle ID: 0x10e0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-cdosys.resources_31bf3856ad364e35_10.0.26100.1_cs-cz_19e827f04382472b\cdosys.dll.mui Handle ID: 0xf74 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-comctl32-v5.resources_31bf3856ad364e35_10.0.26100.1_cs-cz_1c6720d01775434d\comctl32.dll.mui Handle ID: 0xf6c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-comdlg32.resources_31bf3856ad364e35_10.0.26100.1_cs-cz_a4938b3ff1802703\comdlg32.dll.mui Handle ID: 0x9f8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-font-fms.resources_31bf3856ad364e35_10.0.26100.1_cs-cz_bc21fb1f883d948c\fms.dll.mui Handle ID: 0x9dc Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-mlang.resources_31bf3856ad364e35_10.0.26100.1_cs-cz_3fdfffd89460ee05\mlang.dll.mui Handle ID: 0x778 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..er-engine.resources_31bf3856ad364e35_10.0.26100.1_cs-cz_00bf4d12e052a723\msimsg.dll.mui Handle ID: 0xc04 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-lsa-msprivs.resources_31bf3856ad364e35_10.0.26100.1_cs-cz_20fb8b817a832277\msprivs.dll.mui Handle ID: 0x718 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-comctl32-v5.resources_31bf3856ad364e35_10.0.26100.1_cy-gb_118139d81e7de4cf\comctl32.dll.mui Handle ID: 0xc08 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-comdlg32.resources_31bf3856ad364e35_10.0.26100.1_cy-gb_99ada447f888c885\comdlg32.dll.mui Handle ID: 0x10d8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-font-fms.resources_31bf3856ad364e35_10.0.26100.1_cy-gb_b13c14278f46360e\fms.dll.mui Handle ID: 0x10d4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-mlang.resources_31bf3856ad364e35_10.0.26100.1_cy-gb_34fa18e09b698f87\mlang.dll.mui Handle ID: 0x728 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-cdosys.resources_31bf3856ad364e35_10.0.26100.1_da-dk_b722081739c8432a\cdosys.dll.mui Handle ID: 0x10d0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-comctl32-v5.resources_31bf3856ad364e35_10.0.26100.1_da-dk_b9a100f70dbb3f4c\comctl32.dll.mui Handle ID: 0x10cc Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-comdlg32.resources_31bf3856ad364e35_10.0.26100.1_da-dk_41cd6b66e7c62302\comdlg32.dll.mui Handle ID: 0x10b0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-font-fms.resources_31bf3856ad364e35_10.0.26100.1_da-dk_595bdb467e83908b\fms.dll.mui Handle ID: 0x10a4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-mlang.resources_31bf3856ad364e35_10.0.26100.1_da-dk_dd19dfff8aa6ea04\mlang.dll.mui Handle ID: 0xbf4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-lsa-msprivs.resources_31bf3856ad364e35_10.0.26100.1_da-dk_be356ba870c91e76\msprivs.dll.mui Handle ID: 0xbf8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..er-engine.resources_31bf3856ad364e35_10.0.26100.1_da-dk_9df92d39d698a322\msimsg.dll.mui Handle ID: 0xbf0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-comctl32-v5.resources_31bf3856ad364e35_10.0.26100.1_de-de_b6cc96330f9193e6\comctl32.dll.mui Handle ID: 0xbd0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-cdosys.resources_31bf3856ad364e35_10.0.26100.1_de-de_b44d9d533b9e97c4\cdosys.dll.mui Handle ID: 0xbcc Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-font-fms.resources_31bf3856ad364e35_10.0.26100.1_de-de_568770828059e525\fms.dll.mui Handle ID: 0xc44 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-comdlg32.resources_31bf3856ad364e35_10.0.26100.1_de-de_3ef900a2e99c779c\comdlg32.dll.mui Handle ID: 0xbe4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-mlang.resources_31bf3856ad364e35_10.0.26100.1_de-de_da45753b8c7d3e9e\mlang.dll.mui Handle ID: 0xbe8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-lsa-msprivs.resources_31bf3856ad364e35_10.0.26100.1_de-de_bb6100e4729f7310\msprivs.dll.mui Handle ID: 0x10c8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..er-engine.resources_31bf3856ad364e35_10.0.26100.1_de-de_9b24c275d86ef7bc\msimsg.dll.mui Handle ID: 0x900 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-cmi_31bf3856ad364e35_10.0.26100.1_none_a6c1f2a8c317791e\cmiv2.dll Handle ID: 0x10c4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-d..ing-management-core_31bf3856ad364e35_10.0.26100.1_none_2827ce65934bb5b9\DismCore.dll Handle ID: 0x5f8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-d..ing-management-host_31bf3856ad364e35_10.0.26100.1_none_2a5f1cdd91df6622\DismHost.exe Handle ID: 0x6e8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-d..ing-management-core_31bf3856ad364e35_10.0.26100.1_none_2827ce65934bb5b9\DismCorePS.dll Handle ID: 0xc40 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-d..ing-management-core_31bf3856ad364e35_10.0.26100.1_none_2827ce65934bb5b9\DismProv.dll Handle ID: 0x834 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-d..ing-management-core_31bf3856ad364e35_10.0.26100.1_none_2827ce65934bb5b9\FolderProvider.dll Handle ID: 0x10c0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-d..-winproviders-image_31bf3856ad364e35_10.0.26100.1_none_9bd31d92924ee2ec\DmiProvider.dll Handle ID: 0xc48 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-d..-winproviders-image_31bf3856ad364e35_10.0.26100.1_none_9bd31d92924ee2ec\GenericProvider.dll Handle ID: 0x10bc Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-d..-winproviders-local_31bf3856ad364e35_10.0.26100.1_none_212094eaee0b9236\FfuProvider.dll Handle ID: 0xc68 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-d..-winproviders-local_31bf3856ad364e35_10.0.26100.1_none_212094eaee0b9236\ImagingProvider.dll Handle ID: 0xbb4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-d..-winproviders-image_31bf3856ad364e35_10.0.26100.1_none_9bd31d92924ee2ec\CbsProvider.dll Handle ID: 0xc10 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-d..ing-management-core_31bf3856ad364e35_10.0.26100.1_none_2827ce65934bb5b9\LogProvider.dll Handle ID: 0xc14 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-d..-winproviders-image_31bf3856ad364e35_10.0.26100.1_none_9bd31d92924ee2ec\IntlProvider.dll Handle ID: 0x844 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-d..-winproviders-image_31bf3856ad364e35_10.0.26100.1_none_9bd31d92924ee2ec\OSProvider.dll Handle ID: 0xc18 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-d..-winproviders-image_31bf3856ad364e35_10.0.26100.1_none_9bd31d92924ee2ec\OfflineSetupProvider.dll Handle ID: 0xc3c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-onecore-winrt-storage_31bf3856ad364e35_10.0.26100.1_none_e1237a8785d49f1b\windows.storage.dll Handle ID: 0x10e4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-d..-winproviders-winpe_31bf3856ad364e35_10.0.26100.1_none_1ba35a3a32e137ce\PEProvider.dll Handle ID: 0xc98 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-d..-winproviders-image_31bf3856ad364e35_10.0.26100.1_none_9bd31d92924ee2ec\SmiProvider.dll Handle ID: 0xc84 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-d..-winproviders-image_31bf3856ad364e35_10.0.26100.1_none_9bd31d92924ee2ec\UnattendProvider.dll Handle ID: 0xc88 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.26100.1_none_3886c015fe3eadee\api-ms-win-base-util-l1-1-0.dll Handle ID: 0x10e8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.26100.1_none_c4588310e9a6e860\api-ms-win-core-comm-l1-1-0.dll Handle ID: 0xbc8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-c..namespace-downlevel_31bf3856ad364e35_10.0.26100.1_none_d4ed521cfa7079b8\api-ms-win-core-com-l1-1-0.dll Handle ID: 0x1100 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.26100.1_none_c4588310e9a6e860\api-ms-win-core-console-l1-1-0.dll Handle ID: 0x10fc Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.26100.1_none_c4588310e9a6e860\api-ms-win-core-datetime-l1-1-0.dll Handle ID: 0x1090 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.26100.1_none_c4588310e9a6e860\api-ms-win-core-datetime-l1-1-1.dll Handle ID: 0xcb0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.26100.1_none_c4588310e9a6e860\api-ms-win-core-debug-l1-1-0.dll Handle ID: 0xbc4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.26100.1_none_c4588310e9a6e860\api-ms-win-core-debug-l1-1-1.dll Handle ID: 0x110c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.26100.1_none_c4588310e9a6e860\api-ms-win-core-delayload-l1-1-0.dll Handle ID: 0xcac Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.26100.1_none_c4588310e9a6e860\api-ms-win-core-errorhandling-l1-1-0.dll Handle ID: 0x10f8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.26100.1_none_c4588310e9a6e860\api-ms-win-core-errorhandling-l1-1-1.dll Handle ID: 0x1108 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.26100.1_none_c4588310e9a6e860\api-ms-win-core-fibers-l1-1-0.dll Handle ID: 0x83c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.26100.1_none_c4588310e9a6e860\api-ms-win-core-fibers-l1-1-1.dll Handle ID: 0x1114 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.26100.1_none_c4588310e9a6e860\api-ms-win-core-file-l1-1-0.dll Handle ID: 0x10f4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.26100.1_none_c4588310e9a6e860\api-ms-win-core-file-l1-2-0.dll Handle ID: 0xcc4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.26100.1_none_c4588310e9a6e860\api-ms-win-core-file-l1-2-1.dll Handle ID: 0xcbc Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.26100.1_none_3886c015fe3eadee\API-MS-Win-core-file-l2-1-0.dll Handle ID: 0x10ec Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.26100.1_none_3886c015fe3eadee\API-MS-Win-core-file-l2-1-1.dll Handle ID: 0xc80 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.26100.1_none_c4588310e9a6e860\api-ms-win-core-handle-l1-1-0.dll Handle ID: 0xca4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.26100.1_none_c4588310e9a6e860\api-ms-win-core-heap-l1-1-0.dll Handle ID: 0x10f0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.26100.1_none_3886c015fe3eadee\API-MS-Win-Core-Heap-Obsolete-L1-1-0.dll Handle ID: 0xca0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.26100.1_none_c4588310e9a6e860\api-ms-win-core-interlocked-l1-1-0.dll Handle ID: 0xca8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.26100.1_none_c4588310e9a6e860\api-ms-win-core-io-l1-1-0.dll Handle ID: 0xce4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.26100.1_none_c4588310e9a6e860\api-ms-win-core-io-l1-1-1.dll Handle ID: 0x1118 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.26100.1_none_3886c015fe3eadee\api-ms-win-core-kernel32-legacy-l1-1-1.dll Handle ID: 0x7dc Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.26100.1_none_3886c015fe3eadee\api-ms-win-core-kernel32-legacy-l1-1-0.dll Handle ID: 0xc34 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.26100.1_none_3886c015fe3eadee\API-MS-Win-Core-Kernel32-Private-L1-1-0.dll Handle ID: 0xc5c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.26100.1_none_3886c015fe3eadee\API-MS-Win-Core-Kernel32-Private-L1-1-1.dll Handle ID: 0xc60 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.26100.1_none_c4588310e9a6e860\api-ms-win-core-libraryloader-l1-1-0.dll Handle ID: 0xc64 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.26100.1_none_c4588310e9a6e860\api-ms-win-core-libraryloader-l1-1-1.dll Handle ID: 0xc4c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.26100.1_none_c4588310e9a6e860\api-ms-win-core-localization-l1-2-0.dll Handle ID: 0xc1c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.26100.1_none_c4588310e9a6e860\api-ms-win-core-localization-l1-2-1.dll Handle ID: 0xc50 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.26100.1_none_c4588310e9a6e860\API-MS-Win-core-localization-obsolete-l1-2-0.dll Handle ID: 0xc54 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.26100.1_none_c4588310e9a6e860\api-ms-win-core-memory-l1-1-0.dll Handle ID: 0xc58 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.26100.1_none_c4588310e9a6e860\api-ms-win-core-memory-l1-1-1.dll Handle ID: 0xc20 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.26100.1_none_c4588310e9a6e860\api-ms-win-core-memory-l1-1-2.dll Handle ID: 0xbec Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.26100.1_none_c4588310e9a6e860\api-ms-win-core-namedpipe-l1-1-0.dll Handle ID: 0xd08 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.26100.1_none_3886c015fe3eadee\api-ms-win-core-privateprofile-l1-1-0.dll Handle ID: 0xc7c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.26100.1_none_3886c015fe3eadee\api-ms-win-core-privateprofile-l1-1-1.dll Handle ID: 0xd14 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.26100.1_none_c4588310e9a6e860\api-ms-win-core-processenvironment-l1-1-0.dll Handle ID: 0xd0c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.26100.1_none_c4588310e9a6e860\api-ms-win-core-processenvironment-l1-2-0.dll Handle ID: 0xd1c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.26100.1_none_c4588310e9a6e860\api-ms-win-core-processthreads-l1-1-0.dll Handle ID: 0x1120 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.26100.1_none_c4588310e9a6e860\api-ms-win-core-processthreads-l1-1-1.dll Handle ID: 0xd10 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.26100.1_none_c4588310e9a6e860\api-ms-win-core-processthreads-l1-1-2.dll Handle ID: 0x1124 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.26100.1_none_c4588310e9a6e860\api-ms-win-core-profile-l1-1-0.dll Handle ID: 0xcf8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.26100.1_none_c4588310e9a6e860\api-ms-win-core-realtime-l1-1-0.dll Handle ID: 0xd30 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.26100.1_none_3886c015fe3eadee\api-ms-win-core-processtopology-obsolete-l1-1-0.dll Handle ID: 0xcfc Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-d..-winproviders-local_31bf3856ad364e35_10.0.26100.1_none_212094eaee0b9236\VhdProvider.dll Handle ID: 0xcf0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.26100.1_none_c4588310e9a6e860\api-ms-win-core-registry-l1-1-0.dll Handle ID: 0xd34 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.26100.1_none_3886c015fe3eadee\api-ms-win-core-registry-l2-1-0.dll Handle ID: 0xcf4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.26100.1_none_c4588310e9a6e860\api-ms-win-core-rtlsupport-l1-1-0.dll Handle ID: 0xd3c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.26100.1_none_3886c015fe3eadee\api-ms-win-core-shutdown-l1-1-0.dll Handle ID: 0x112c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.26100.1_none_3886c015fe3eadee\api-ms-win-core-shlwapi-obsolete-l1-1-0.dll Handle ID: 0x1128 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.26100.1_none_3886c015fe3eadee\api-ms-win-core-shlwapi-legacy-l1-1-0.dll Handle ID: 0xcd4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.26100.1_none_c4588310e9a6e860\api-ms-win-core-string-l1-1-0.dll Handle ID: 0xd18 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.26100.1_none_3886c015fe3eadee\API-MS-Win-core-string-l2-1-0.dll Handle ID: 0xd24 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.26100.1_none_3886c015fe3eadee\API-MS-Win-core-string-obsolete-l1-1-0.dll Handle ID: 0xd4c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.26100.1_none_3886c015fe3eadee\api-ms-win-core-stringansi-l1-1-0.dll Handle ID: 0xd48 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.26100.1_none_c4588310e9a6e860\api-ms-win-core-stringloader-l1-1-1.dll Handle ID: 0xcc0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-d..-winproviders-image_31bf3856ad364e35_10.0.26100.1_none_9bd31d92924ee2ec\ProvProvider.dll Handle ID: 0xd58 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.26100.1_none_c4588310e9a6e860\api-ms-win-core-synch-l1-1-0.dll Handle ID: 0x850 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.26100.1_none_c4588310e9a6e860\api-ms-win-core-synch-l1-2-0.dll Handle ID: 0xd28 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.26100.1_none_c4588310e9a6e860\api-ms-win-core-sysinfo-l1-1-0.dll Handle ID: 0xce0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.26100.1_none_c4588310e9a6e860\api-ms-win-core-sysinfo-l1-2-0.dll Handle ID: 0xcec Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.26100.1_none_c4588310e9a6e860\api-ms-win-core-sysinfo-l1-2-1.dll Handle ID: 0xd74 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.26100.1_none_c4588310e9a6e860\api-ms-win-core-threadpool-legacy-l1-1-0.dll Handle ID: 0xc78 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.26100.1_none_c4588310e9a6e860\api-ms-win-core-threadpool-l1-2-0.dll Handle ID: 0xd20 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.26100.1_none_c4588310e9a6e860\api-ms-win-core-threadpool-private-l1-1-0.dll Handle ID: 0xd7c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.26100.1_none_c4588310e9a6e860\api-ms-win-core-timezone-l1-1-0.dll Handle ID: 0xd80 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.26100.1_none_3886c015fe3eadee\api-ms-win-core-url-l1-1-0.dll Handle ID: 0xd68 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.26100.1_none_c4588310e9a6e860\api-ms-win-core-util-l1-1-0.dll Handle ID: 0xd64 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.26100.1_none_3886c015fe3eadee\api-ms-win-core-version-l1-1-0.dll Handle ID: 0xbfc Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.26100.1_none_c4588310e9a6e860\api-ms-win-core-wow64-l1-1-0.dll Handle ID: 0x934 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.26100.1_none_c4588310e9a6e860\api-ms-win-core-xstate-l1-1-0.dll Handle ID: 0xd8c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.26100.1_none_3886c015fe3eadee\API-MS-Win-core-xstate-l2-1-0.dll Handle ID: 0x1130 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.26100.1_none_c4588310e9a6e860\api-ms-win-crt-conio-l1-1-0.dll Handle ID: 0xcdc Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.26100.1_none_c4588310e9a6e860\api-ms-win-crt-environment-l1-1-0.dll Handle ID: 0xd88 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.26100.1_none_c4588310e9a6e860\api-ms-win-crt-convert-l1-1-0.dll Handle ID: 0x930 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.26100.1_none_c4588310e9a6e860\api-ms-win-crt-filesystem-l1-1-0.dll Handle ID: 0x5c8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.26100.1_none_c4588310e9a6e860\api-ms-win-crt-heap-l1-1-0.dll Handle ID: 0xc38 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.26100.1_none_c4588310e9a6e860\api-ms-win-crt-locale-l1-1-0.dll Handle ID: 0xcc8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.26100.1_none_c4588310e9a6e860\api-ms-win-crt-process-l1-1-0.dll Handle ID: 0x948 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.26100.1_none_c4588310e9a6e860\api-ms-win-crt-math-l1-1-0.dll Handle ID: 0xd5c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-d..-winproviders-local_31bf3856ad364e35_10.0.26100.1_none_212094eaee0b9236\WimProvider.dll Handle ID: 0xd60 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.26100.1_none_c4588310e9a6e860\api-ms-win-crt-runtime-l1-1-0.dll Handle ID: 0xd6c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.26100.1_none_c4588310e9a6e860\api-ms-win-crt-multibyte-l1-1-0.dll Handle ID: 0xd70 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.26100.1_none_c4588310e9a6e860\api-ms-win-crt-stdio-l1-1-0.dll Handle ID: 0x944 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.26100.1_none_c4588310e9a6e860\api-ms-win-crt-utility-l1-1-0.dll Handle ID: 0xd40 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.26100.1_none_c4588310e9a6e860\api-ms-win-crt-time-l1-1-0.dll Handle ID: 0xbdc Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.26100.1_none_c4588310e9a6e860\api-ms-win-crt-string-l1-1-0.dll Handle ID: 0xbe0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.26100.1_none_3886c015fe3eadee\API-MS-Win-devices-config-L1-1-0.dll Handle ID: 0x940 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.26100.1_none_c4588310e9a6e860\api-ms-win-crt-private-l1-1-0.dll Handle ID: 0xc6c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.26100.1_none_3886c015fe3eadee\API-MS-Win-Eventing-ClassicProvider-L1-1-0.dll Handle ID: 0x6ec Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.26100.1_none_6e3617b64262c41b\api-ms-win-eventing-consumer-l1-1-0.dll Handle ID: 0xd38 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.26100.1_none_3886c015fe3eadee\API-MS-Win-devices-config-L1-1-1.dll Handle ID: 0xd44 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.26100.1_none_3886c015fe3eadee\API-MS-Win-Eventing-Legacy-L1-1-0.dll Handle ID: 0xd50 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.26100.1_none_6e3617b64262c41b\API-MS-Win-Eventing-Controller-L1-1-0.dll Handle ID: 0xda4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.26100.1_none_3886c015fe3eadee\API-MS-Win-Eventing-Provider-L1-1-0.dll Handle ID: 0xda0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.26100.1_none_3886c015fe3eadee\API-MS-Win-EventLog-Legacy-L1-1-0.dll Handle ID: 0xd54 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.26100.1_none_3886c015fe3eadee\API-MS-Win-Security-Lsalookup-L2-1-0.dll Handle ID: 0xbac Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.26100.1_none_6e3617b64262c41b\api-ms-win-security-cryptoapi-l1-1-0.dll Handle ID: 0xbb0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.26100.1_none_3886c015fe3eadee\API-MS-Win-Security-Lsalookup-L2-1-1.dll Handle ID: 0xdbc Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.26100.1_none_6e3617b64262c41b\API-MS-Win-security-lsapolicy-l1-1-0.dll Handle ID: 0xb74 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.26100.1_none_c4588310e9a6e860\api-ms-win-security-base-l1-1-0.dll Handle ID: 0xb84 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.26100.1_none_3886c015fe3eadee\API-MS-Win-security-provider-L1-1-0.dll Handle ID: 0xdc8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.26100.1_none_6e3617b64262c41b\api-ms-win-security-sddl-l1-1-0.dll Handle ID: 0xd78 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.26100.1_none_c4588310e9a6e860\api-ms-win-service-core-l1-1-0.dll Handle ID: 0x1134 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.26100.1_none_c4588310e9a6e860\api-ms-win-service-core-l1-1-1.dll Handle ID: 0xd9c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.26100.1_none_c4588310e9a6e860\api-ms-win-service-management-l1-1-0.dll Handle ID: 0x113c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.26100.1_none_c4588310e9a6e860\api-ms-win-service-management-l2-1-0.dll Handle ID: 0xd84 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.26100.1_none_c4588310e9a6e860\api-ms-win-service-private-l1-1-0.dll Handle ID: 0xc70 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.26100.1_none_c4588310e9a6e860\api-ms-win-service-private-l1-1-1.dll Handle ID: 0x1140 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.26100.1_none_c4588310e9a6e860\api-ms-win-service-winsvc-l1-1-0.dll Handle ID: 0xdc0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-o..namespace-downlevel_31bf3856ad364e35_10.0.26100.1_none_3e10cb28eab8aa26\api-ms-win-shcore-stream-l1-1-0.dll Handle ID: 0x1138 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-acpiex_31bf3856ad364e35_10.0.26100.1_none_31be4e044185a2eb\acpiex.sys Handle ID: 0xcd0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-rasbase-agilevpn_31bf3856ad364e35_10.0.26100.1_none_ac66038500ae25ed\agilevpn.sys Handle ID: 0xdc4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-winsock-core_31bf3856ad364e35_10.0.26100.1_none_d4dbeaf2c6f9b9d5\afd.sys Handle ID: 0x115c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-rasbase-asyncmac_31bf3856ad364e35_10.0.26100.1_none_214b77439d65d8f4\asyncmac.sys Handle ID: 0xe00 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-acx-classextension_31bf3856ad364e35_10.0.26100.1_none_a73d8b241fc31a7f\Acx01000.sys Handle ID: 0xe04 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-bowser_31bf3856ad364e35_10.0.26100.1_none_235335548ccd2c1d\bowser.sys Handle ID: 0x1154 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-cdfs_31bf3856ad364e35_10.0.26100.1_none_a35b3b6f8580834b\cdfs.sys Handle ID: 0xe0c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-eventaggregation_31bf3856ad364e35_10.0.26100.1_none_aaaa33b385affacd\CEA.sys Handle ID: 0xe24 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-cimfs_31bf3856ad364e35_10.0.26100.1_none_542d5b1e4da4c6a7\cimfs.sys Handle ID: 0xe34 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-classpnp-minwin_31bf3856ad364e35_10.0.26100.1_none_0ba55ef755d3a9e8\Classpnp.sys Handle ID: 0xe38 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-c..m-initmachineconfig_31bf3856ad364e35_10.0.26100.1_none_d37ff44164bf24c3\cmimcext.sys Handle ID: 0x116c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-commonlog_31bf3856ad364e35_10.0.26100.1_none_7b76430d9018a07a\clfs.sys Handle ID: 0x111c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-console-driver_31bf3856ad364e35_10.0.26100.1_none_04a973bb36617693\condrv.sys Handle ID: 0x1178 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-crashdump_31bf3856ad364e35_10.0.26100.1_none_a281061f7f629d48\crashdmp.sys Handle ID: 0x1174 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-dfsclient_31bf3856ad364e35_10.0.26100.1_none_848dd63e4ea87f63\dfsc.sys Handle ID: 0x1160 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-diskdump_31bf3856ad364e35_10.0.26100.1_none_63b1de6cffd2cb62\Diskdump.sys Handle ID: 0xdb8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-dumpusbstor_31bf3856ad364e35_10.0.26100.1_none_de3c50b9d900fe81\Dmpusbstor.sys Handle ID: 0xe74 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-l..-security-processor_31bf3856ad364e35_10.0.26100.1_none_bc380eac1845d3c2\ClipSp.sys Handle ID: 0x95c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-dumpata_31bf3856ad364e35_10.0.26100.1_none_6631c65ed69595a9\Dumpata.sys Handle ID: 0xdac Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-cng_31bf3856ad364e35_10.0.26100.1_none_a5decd84c3a989b1\cng.sys Handle ID: 0x7d8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-dumpstorport_31bf3856ad364e35_10.0.26100.1_none_34e5c6a1b550a5fe\Dumpstorport.sys Handle ID: 0x954 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_product-onecore__mi..tartup-filterdriver_31bf3856ad364e35_10.0.26100.1_none_61d500e1a2553cdb\dumpfve.sys Handle ID: 0x958 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-lddmcore_31bf3856ad364e35_10.0.26100.1_none_a8bc40ff4c196001\dxgmms1.sys Handle ID: 0xc2c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-n..rk-executioncontext_31bf3856ad364e35_10.0.26100.1_none_7f5eb8e5a75f39eb\ExecutionContext.sys Handle ID: 0x1180 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-filebasedwritefilter_31bf3856ad364e35_10.0.26100.1_none_bb53fbe75901079b\fbwf.sys Handle ID: 0x1168 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-lddmcore_31bf3856ad364e35_10.0.26100.1_none_a8bc40ff4c196001\dxgmms2.sys Handle ID: 0xeac Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-fileinfominifilter_31bf3856ad364e35_10.0.26100.1_none_d3a8a38599da6d98\fileinfo.sys Handle ID: 0xd90 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-exfat_31bf3856ad364e35_10.0.26100.1_none_525a877481b82dd9\exfat.sys Handle ID: 0xe10 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-f..ependencyminifilter_31bf3856ad364e35_10.0.26100.1_none_2746a24bf0079a8c\fsdepends.sys Handle ID: 0x1088 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-coreos-minwin_31bf3856ad364e35_10.0.26100.1_none_5377772496efd893\fs_rec.sys Handle ID: 0xe80 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-fat_31bf3856ad364e35_10.0.26100.1_none_aba6d3e0bff0c364\fastfat.sys Handle ID: 0xe7c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-s..-onecore-globmerger_31bf3856ad364e35_10.0.26100.1_none_2f986056fffd9aa4\globmerger.sys Handle ID: 0x11ac Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-filtermanager-core_31bf3856ad364e35_10.0.26100.1_none_0dfd1b529358ac0a\fltMgr.sys Handle ID: 0xe28 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-tcpip-driver_31bf3856ad364e35_10.0.26100.1_none_d4ec2e121fbb349c\FWPKCLNT.SYS Handle ID: 0x11c4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-h..dspi-classextension_31bf3856ad364e35_10.0.26100.1_none_f5800bbb2dcd1ed2\HidSpiCx.sys Handle ID: 0x11b4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_product-onecore__mi..tartup-filterdriver_31bf3856ad364e35_10.0.26100.1_none_61d500e1a2553cdb\fvevol.sys Handle ID: 0x11cc Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-hardware-policy_31bf3856ad364e35_10.0.26100.1_none_ff13f69912616b84\hwpolicy.sys Handle ID: 0x11d0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_product-onecore__mi..r-v-socket-provider_31bf3856ad364e35_10.0.26100.1_none_7e50f0bbcb297455\hvsocket.sys Handle ID: 0xea8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-pdc-mw_31bf3856ad364e35_10.0.26100.1_none_1fc5bafad5b96571\kmpdc.sys Handle ID: 0x97c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-lsa_31bf3856ad364e35_10.0.26100.1_none_a33e3322c557d2bb\Kerb3961Kernel.sys Handle ID: 0x858 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-kernelstreamingthunk_31bf3856ad364e35_10.0.26100.1_none_2f6ccf798013857a\ksthunk.sys Handle ID: 0xeb8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-lsa-minwin-kernel_31bf3856ad364e35_10.0.26100.1_none_da6a8154d13df8ac\ksecdd.sys Handle ID: 0x96c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-lsa_31bf3856ad364e35_10.0.26100.1_none_a33e3322c557d2bb\ksecpkg.sys Handle ID: 0x694 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft.windows.h..changer-driverclass_31bf3856ad364e35_10.0.26100.1_none_c599137b2f46d61e\mcd.sys Handle ID: 0x118c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-kernelstreaming_31bf3856ad364e35_10.0.26100.1_none_54746ab7fe70b5d2\ks.sys Handle ID: 0xe90 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-http_31bf3856ad364e35_10.0.26100.1_none_a9b4a4a98167879d\http.sys Handle ID: 0xe94 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-m..pointmanager-minwin_31bf3856ad364e35_10.0.26100.1_none_cd4f391b35ceb21c\mountmgr.sys Handle ID: 0x998 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_networking-mpssvc-drv_31bf3856ad364e35_10.0.26100.1_none_9f66430d2b0bcb86\mpsdrv.sys Handle ID: 0xf5c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-msfs_31bf3856ad364e35_10.0.26100.1_none_a363e89b85790120\msfs.sys Handle ID: 0x7c0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-mshidkmdf_31bf3856ad364e35_10.0.26100.1_none_3d6fecbcd9b54472\mshidkmdf.sys Handle ID: 0xea0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-kernelstreaming_31bf3856ad364e35_10.0.26100.1_none_54746ab7fe70b5d2\mskssrv.sys Handle ID: 0x878 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-gpio-class-extension_31bf3856ad364e35_10.0.26100.1_none_e8ce9424bcd37a91\msgpioclx.sys Handle ID: 0x804 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-kernelstreamingsupport_31bf3856ad364e35_10.0.26100.1_none_5ee8638243484ab9\mspclock.sys Handle ID: 0x864 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-kernelstreamingsupport_31bf3856ad364e35_10.0.26100.1_none_5ee8638243484ab9\mspqm.sys Handle ID: 0x98c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-smb20-minirdr_31bf3856ad364e35_10.0.26100.1_none_87ce9dfbf2527b7b\mrxsmb20.sys Handle ID: 0xf10 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-kernelstreamingsupport_31bf3856ad364e35_10.0.26100.1_none_5ee8638243484ab9\mstee.sys Handle ID: 0x1184 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-mup_31bf3856ad364e35_10.0.26100.1_none_a9e5f18ec110633d\mup.sys Handle ID: 0x85c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-rasbase-core_31bf3856ad364e35_10.0.26100.1_none_2eda21f72ca61318\ndistapi.sys Handle ID: 0x9a4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-rpc-kernel_31bf3856ad364e35_10.0.26100.1_none_bc002c35ea732e74\msrpc.sys Handle ID: 0xf18 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-ndis-virtualbus_31bf3856ad364e35_10.0.26100.1_none_585689c984a7c1ab\NdisVirtualBus.sys Handle ID: 0x974 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-ndisuio_31bf3856ad364e35_10.0.26100.1_none_68e4b0244f6ab866\ndisuio.sys Handle ID: 0xeec Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-winquic_31bf3856ad364e35_10.0.26100.1_none_260ce9c771f08519\msquic.sys Handle ID: 0x6c4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-smbminirdr_31bf3856ad364e35_10.0.26100.1_none_7c851595b9aa09a8\mrxsmb.sys Handle ID: 0xe6c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-rasbase-core_31bf3856ad364e35_10.0.26100.1_none_2eda21f72ca61318\ndproxy.sys Handle ID: 0xe78 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-netbios_31bf3856ad364e35_10.0.26100.1_none_56d5608ad3abe945\netbios.sys Handle ID: 0xec8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-rasbase-ndiswan_31bf3856ad364e35_10.0.26100.1_none_f02c3921bfd762d3\ndiswan.sys Handle ID: 0xea4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-npfs_31bf3856ad364e35_10.0.26100.1_none_a3652d3d8577cd94\npfs.sys Handle ID: 0x6f0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-usermodensi_31bf3856ad364e35_10.0.26100.1_none_6f55cb4030007b27\nsiproxy.sys Handle ID: 0x838 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-lddmcore_31bf3856ad364e35_10.0.26100.1_none_a8bc40ff4c196001\dxgkrnl.sys Handle ID: 0x87c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-ntosext_31bf3856ad364e35_10.0.26100.1_none_d0e6de6997e9534e\ntosext.sys Handle ID: 0x9b8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-null_31bf3856ad364e35_10.0.26100.1_none_a65995dd8389a54c\null.sys Handle ID: 0x77c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-netadaptercx-kmdf_31bf3856ad364e35_10.0.26100.1_none_e7ed0daf42e08739\netadaptercx.sys Handle ID: 0x7fc Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-netbt-minwin_31bf3856ad364e35_10.0.26100.1_none_e8a029a2406c6063\netbt.sys Handle ID: 0xedc Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-pcw_31bf3856ad364e35_10.0.26100.1_none_ad053ebebf0d01a1\pcw.sys Handle ID: 0x11f8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-partitionmanager_31bf3856ad364e35_10.0.26100.1_none_de8fbbec22fc2b18\partmgr.sys Handle ID: 0x9bc Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-portcfg_31bf3856ad364e35_10.0.26100.1_none_2788c34025517bc6\portcfg.sys Handle ID: 0x7f0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-pdc-mw_31bf3856ad364e35_10.0.26100.1_none_1fc5bafad5b96571\pdc.sys Handle ID: 0x9b4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-netio-infrastructure_31bf3856ad364e35_10.0.26100.1_none_538f15361dda21e4\netio.sys Handle ID: 0x884 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-rasautodial_31bf3856ad364e35_10.0.26100.1_none_0ccda716cddfb9e8\rasacd.sys Handle ID: 0x7e8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-ndis-minwin_31bf3856ad364e35_10.0.26100.1_none_564926959098a642\ndis.sys Handle ID: 0x734 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-rasbase-rasl2tp_31bf3856ad364e35_10.0.26100.1_none_96cff4fd507ae4cb\rasl2tp.sys Handle ID: 0x6cc Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-rasbase-raspppoe_31bf3856ad364e35_10.0.26100.1_none_53272c8103247399\raspppoe.sys Handle ID: 0x9ac Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-rasbase-raspptp_31bf3856ad364e35_10.0.26100.1_none_96e2c739506377a1\raspptp.sys Handle ID: 0xdec Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-r..ase-rassstp-coresys_31bf3856ad364e35_10.0.26100.1_none_786295384b25bdb2\rassstp.sys Handle ID: 0xdf0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-e..ymanagementservices_31bf3856ad364e35_10.0.26100.1_none_f0686e235fa185fd\sacdrv.sys Handle ID: 0x78c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-rdbss_31bf3856ad364e35_10.0.26100.1_none_56c8802cc9f60a19\rdbss.sys Handle ID: 0x7b8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft.windows.s..se.scsi_port_driver_31bf3856ad364e35_10.0.26100.1_none_e273d64392ab67cf\scsiport.sys Handle ID: 0x9cc Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-sdport_31bf3856ad364e35_10.0.26100.1_none_246079e21f71bb79\sdport.sys Handle ID: 0xed4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-serial-classextension_31bf3856ad364e35_10.0.26100.1_none_33085a90c1c02771\SerCx.sys Handle ID: 0x1190 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-refs-v1_31bf3856ad364e35_10.0.26100.1_none_4f18978a07c6b501\refsv1.sys Handle ID: 0x9e8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-s..l-classextension-v2_31bf3856ad364e35_10.0.26100.1_none_3ad52a4dd26020e2\SerCx2.sys Handle ID: 0x9d4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft.windows.s...smart_card_library_31bf3856ad364e35_10.0.26100.1_none_f6f755585044219e\smclib.sys Handle ID: 0x9f4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-spb-classextension_31bf3856ad364e35_10.0.26100.1_none_b6e2e41e472594e4\SpbCx.sys Handle ID: 0xed0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-smbserver-common_31bf3856ad364e35_10.0.26100.1_none_00c9d69478b3b13c\srvnet.sys Handle ID: 0xf8c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-storage-qos-filter_31bf3856ad364e35_10.0.26100.1_none_46999ba619dd500d\storqosflt.sys Handle ID: 0xa08 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft.windows.h..pedrive-driverclass_31bf3856ad364e35_10.0.26100.1_none_8f1d78d825db14e5\tape.sys Handle ID: 0x88c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-streamclass_31bf3856ad364e35_10.0.26100.1_none_5b583e11a02f4a01\stream.sys Handle ID: 0xf7c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-tdi-driver_31bf3856ad364e35_10.0.26100.1_none_63e1f0ec9e8313af\tdi.sys Handle ID: 0xf80 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-tcpip-driver_31bf3856ad364e35_10.0.26100.1_none_d4ec2e121fbb349c\tcpipreg.sys Handle ID: 0x784 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-tdi-over-tcpip_31bf3856ad364e35_10.0.26100.1_none_e73170ac44a2433c\tdx.sys Handle ID: 0x710 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-tm_31bf3856ad364e35_10.0.26100.1_none_4a08f1bfec5f4e48\tm.sys Handle ID: 0xde8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-smbserver-v2_31bf3856ad364e35_10.0.26100.1_none_d6e041cf5f084e4b\srv2.sys Handle ID: 0x11fc Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-usb-ude-classextension_31bf3856ad364e35_10.0.26100.1_none_db5dcf20cf647a48\Udecx.sys Handle ID: 0x1208 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-ucx-classextension_31bf3856ad364e35_10.0.26100.1_none_c1d6823907d2c94b\Ucx01000.sys Handle ID: 0x988 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-ntfs_31bf3856ad364e35_10.0.26100.1_none_a364d21d85783418\ntfs.sys Handle ID: 0xfb4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-udfs_31bf3856ad364e35_10.0.26100.1_none_a36d40a385704b69\udfs.sys Handle ID: 0x120c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-unionfs-driver_31bf3856ad364e35_10.0.26100.1_none_a8be3a51cfb11770\UnionFS.sys Handle ID: 0xa24 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-videoport_31bf3856ad364e35_10.0.26100.1_none_b90df4736cf11451\videoprt.sys Handle ID: 0xa38 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-driververifier-xdv_31bf3856ad364e35_10.0.26100.1_none_539e3a4b06ac4756\VerifierExt.sys Handle ID: 0x8ac Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-hyper-v-kmcl_31bf3856ad364e35_10.0.26100.1_none_7044b60cc4f4de66\vmbkmcl.sys Handle ID: 0x1228 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-refs_31bf3856ad364e35_10.0.26100.1_none_a36a28fd85731905\refs.sys Handle ID: 0x11f4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-storport_31bf3856ad364e35_10.0.26100.1_none_246ff70998bb8058\storport.sys Handle ID: 0xa20 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-rasbase-core_31bf3856ad364e35_10.0.26100.1_none_2eda21f72ca61318\wanarp.sys Handle ID: 0x780 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-watchdog_31bf3856ad364e35_10.0.26100.1_none_5d5c909d1208ac36\watchdog.sys Handle ID: 0xa3c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-wdf-kernellibrary_31bf3856ad364e35_10.0.26100.1_none_7346c09a8678b36f\WdfLdr.sys Handle ID: 0xa44 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-dynamicvolumemanager_31bf3856ad364e35_10.0.26100.1_none_d9f66a62eeb57171\volmgrx.sys Handle ID: 0x6e0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-errorreportingkernel_31bf3856ad364e35_10.0.26100.1_none_4bdf0253ddfbded4\werkernel.sys Handle ID: 0xa0c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-wimgapi_31bf3856ad364e35_10.0.26100.1_none_85ef4aca7d6b243b\wimmount.sys Handle ID: 0x8a0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-wimfsf_31bf3856ad364e35_10.0.26100.1_none_b38fb39b04bedfb3\wimfsf.sys Handle ID: 0x1230 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-hyper-v-winhv_31bf3856ad364e35_10.0.26100.1_none_daced2d14cc07f6b\winhv.sys Handle ID: 0x724 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-volsnap_31bf3856ad364e35_10.0.26100.1_none_5c1d9de909fcda4c\volsnap.sys Handle ID: 0x75c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-h..reaccelerators-core_31bf3856ad364e35_10.0.26100.1_none_f44352b7bf2527b7\WinAccel.sys Handle ID: 0x8c8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-wmilib_31bf3856ad364e35_10.0.26100.1_none_5648a2b76cb94bcf\wmilib.sys Handle ID: 0x8b4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-h..tors-classextension_31bf3856ad364e35_10.0.26100.1_none_407cce81bd17dfa1\WinAccelCx.sys Handle ID: 0xf9c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-w..rastructure-ws2ifsl_31bf3856ad364e35_10.0.26100.1_none_4c7a4935305a40c6\ws2ifsl.sys Handle ID: 0x744 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-wpprecorder_31bf3856ad364e35_10.0.26100.1_none_122fced17aec253e\WppRecorder.sys Handle ID: 0xa4c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-overlayfilter_31bf3856ad364e35_10.0.26100.1_none_f0aa3d81ac29a599\wof.sys Handle ID: 0x7cc Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-netadaptercx-umdf_31bf3856ad364e35_10.0.26100.1_none_e7ec29df42e18783\netadaptercxum.dll Handle ID: 0x1250 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-wdf-kernellibrary_31bf3856ad364e35_10.0.26100.1_none_7346c09a8678b36f\Wdf01000.sys Handle ID: 0x7c4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-tcpip-driver_31bf3856ad364e35_10.0.26100.1_none_d4ec2e121fbb349c\tcpip.sys Handle ID: 0x70c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-cdosys.resources_31bf3856ad364e35_10.0.26100.1_el-gr_5ce3cae62ab40052\cdosys.dll.mui Handle ID: 0x904 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-comctl32-v5.resources_31bf3856ad364e35_10.0.26100.1_el-gr_5f62c3c5fea6fc74\comctl32.dll.mui Handle ID: 0x1044 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-font-fms.resources_31bf3856ad364e35_10.0.26100.1_el-gr_ff1d9e156f6f4db3\fms.dll.mui Handle ID: 0x90c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-mlang.resources_31bf3856ad364e35_10.0.26100.1_el-gr_82dba2ce7b92a72c\mlang.dll.mui Handle ID: 0xb10 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-comdlg32.resources_31bf3856ad364e35_10.0.26100.1_el-gr_e78f2e35d8b1e02a\comdlg32.dll.mui Handle ID: 0x82c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-lsa-msprivs.resources_31bf3856ad364e35_10.0.26100.1_el-gr_63f72e7761b4db9e\msprivs.dll.mui Handle ID: 0x914 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-comctl32-v5.resources_31bf3856ad364e35_10.0.26100.1_en-gb_5834b10e0346ebe6\comctl32.dll.mui Handle ID: 0x918 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-font-fms.resources_31bf3856ad364e35_10.0.26100.1_en-gb_f7ef8b5d740f3d25\fms.dll.mui Handle ID: 0x928 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-mlang.resources_31bf3856ad364e35_10.0.26100.1_en-gb_7bad90168032969e\mlang.dll.mui Handle ID: 0x1048 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..er-engine.resources_31bf3856ad364e35_10.0.26100.1_el-gr_43baf008c784604a\msimsg.dll.mui Handle ID: 0xaf8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-comctl32-v5.resources_31bf3856ad364e35_10.0.26100.1_en-us_5fbd6c2bfe6f9fab\comctl32.dll.mui Handle ID: 0xb18 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-comdlg32.resources_31bf3856ad364e35_10.0.26100.1_en-gb_e0611b7ddd51cf9c\comdlg32.dll.mui Handle ID: 0x105c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-cdosys.resources_31bf3856ad364e35_10.0.26100.1_en-us_5d3e734c2a7ca389\cdosys.dll.mui Handle ID: 0xb48 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-font-fms.resources_31bf3856ad364e35_10.0.26100.1_en-us_ff78467b6f37f0ea\fms.dll.mui Handle ID: 0xb3c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..er-engine.resources_31bf3856ad364e35_10.0.26100.1_en-gb_3c8cdd50cc244fbc\msimsg.dll.mui Handle ID: 0xb24 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-mlang.resources_31bf3856ad364e35_10.0.26100.1_en-us_83364b347b5b4a63\mlang.dll.mui Handle ID: 0xb2c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-comdlg32.resources_31bf3856ad364e35_10.0.26100.1_en-us_e7e9d69bd87a8361\comdlg32.dll.mui Handle ID: 0xac4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-lsa-msprivs.resources_31bf3856ad364e35_10.0.26100.1_en-us_6451d6dd617d7ed5\msprivs.dll.mui Handle ID: 0xb30 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-comctl32-v5.resources_31bf3856ad364e35_10.0.26100.1_es-es_5f88c90ffe969150\comctl32.dll.mui Handle ID: 0x1058 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-font-fms.resources_31bf3856ad364e35_10.0.26100.1_es-es_ff43a35f6f5ee28f\fms.dll.mui Handle ID: 0x984 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-cdosys.resources_31bf3856ad364e35_10.0.26100.1_es-es_5d09d0302aa3952e\cdosys.dll.mui Handle ID: 0xb64 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-mlang.resources_31bf3856ad364e35_10.0.26100.1_es-es_8301a8187b823c08\mlang.dll.mui Handle ID: 0xb34 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-lsa-msprivs.resources_31bf3856ad364e35_10.0.26100.1_es-es_641d33c161a4707a\msprivs.dll.mui Handle ID: 0x106c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..er-engine.resources_31bf3856ad364e35_10.0.26100.1_en-us_4415986ec74d0381\msimsg.dll.mui Handle ID: 0xb5c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-comctl32-v5.resources_31bf3856ad364e35_10.0.26100.1_es-mx_61bfb6b5fd2a74fb\comctl32.dll.mui Handle ID: 0x1030 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-comdlg32.resources_31bf3856ad364e35_10.0.26100.1_es-es_e7b5337fd8a17506\comdlg32.dll.mui Handle ID: 0x1070 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-font-fms.resources_31bf3856ad364e35_10.0.26100.1_es-mx_017a91056df2c63a\fms.dll.mui Handle ID: 0x1074 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-mlang.resources_31bf3856ad364e35_10.0.26100.1_es-mx_853895be7a161fb3\mlang.dll.mui Handle ID: 0xb80 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-comctl32-v5.resources_31bf3856ad364e35_10.0.26100.1_et-ee_594894a0029c6ddf\comctl32.dll.mui Handle ID: 0xab8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-font-fms.resources_31bf3856ad364e35_10.0.26100.1_et-ee_f9036eef7364bf1e\fms.dll.mui Handle ID: 0xa80 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-comdlg32.resources_31bf3856ad364e35_10.0.26100.1_es-mx_e9ec2125d73558b1\comdlg32.dll.mui Handle ID: 0xacc Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..er-engine.resources_31bf3856ad364e35_10.0.26100.1_es-es_43e0f552c773f526\msimsg.dll.mui Handle ID: 0xba8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-comctl32-v5.resources_31bf3856ad364e35_10.0.26100.1_eu-es_5f732937fea6c932\comctl32.dll.mui Handle ID: 0x1068 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-mlang.resources_31bf3856ad364e35_10.0.26100.1_et-ee_7cc173a87f881897\mlang.dll.mui Handle ID: 0xb9c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-comdlg32.resources_31bf3856ad364e35_10.0.26100.1_et-ee_e174ff0fdca75195\comdlg32.dll.mui Handle ID: 0xa98 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-font-fms.resources_31bf3856ad364e35_10.0.26100.1_eu-es_ff2e03876f6f1a71\fms.dll.mui Handle ID: 0xaa4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..er-engine.resources_31bf3856ad364e35_10.0.26100.1_es-mx_4617e2f8c607d8d1\msimsg.dll.mui Handle ID: 0x80c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-comctl32-v5.resources_31bf3856ad364e35_10.0.26100.1_fa-ir_02f7c962f0df1994\comctl32.dll.mui Handle ID: 0xf28 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-mlang.resources_31bf3856ad364e35_10.0.26100.1_eu-es_82ec08407b9273ea\mlang.dll.mui Handle ID: 0x1040 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-font-fms.resources_31bf3856ad364e35_10.0.26100.1_fa-ir_a2b2a3b261a76ad3\fms.dll.mui Handle ID: 0x818 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..er-engine.resources_31bf3856ad364e35_10.0.26100.1_et-ee_3da0c0e2cb79d1b5\msimsg.dll.mui Handle ID: 0x6ac Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-mlang.resources_31bf3856ad364e35_10.0.26100.1_fa-ir_2670a86b6dcac44c\mlang.dll.mui Handle ID: 0x820 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-comctl32-v5.resources_31bf3856ad364e35_10.0.26100.1_fi-fi_fea3cdbcf3b0837a\comctl32.dll.mui Handle ID: 0xb8c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-comdlg32.resources_31bf3856ad364e35_10.0.26100.1_eu-es_e79f93a7d8b1ace8\comdlg32.dll.mui Handle ID: 0xfc0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-lsa-msprivs.resources_31bf3856ad364e35_10.0.26100.1_fi-fi_0338386e56be62a4\msprivs.dll.mui Handle ID: 0x8e4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-comctl32-v5.resources_31bf3856ad364e35_10.0.26100.1_fil-ph_a2deccc938ce0f31\comctl32.dll.mui Handle ID: 0x8a8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-font-fms.resources_31bf3856ad364e35_10.0.26100.1_fi-fi_9e5ea80c6478d4b9\fms.dll.mui Handle ID: 0x109c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-mlang.resources_31bf3856ad364e35_10.0.26100.1_fi-fi_221cacc5709c2e32\mlang.dll.mui Handle ID: 0x1098 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-cdosys.resources_31bf3856ad364e35_10.0.26100.1_fi-fi_fc24d4dd1fbd8758\cdosys.dll.mui Handle ID: 0xb98 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-comdlg32.resources_31bf3856ad364e35_10.0.26100.1_fa-ir_8b2433d2cae9fd4a\comdlg32.dll.mui Handle ID: 0xfc4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-comctl32-v5.resources_31bf3856ad364e35_10.0.26100.1_fr-ca_fab68958f6410dd8\comctl32.dll.mui Handle ID: 0xf94 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-font-fms.resources_31bf3856ad364e35_10.0.26100.1_fil-ph_4299a718a9966070\fms.dll.mui Handle ID: 0xfa4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-mlang.resources_31bf3856ad364e35_10.0.26100.1_fil-ph_c657abd1b5b9b9e9\mlang.dll.mui Handle ID: 0xa04 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-font-fms.resources_31bf3856ad364e35_10.0.26100.1_fr-ca_9a7163a867095f17\fms.dll.mui Handle ID: 0x1094 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-comdlg32.resources_31bf3856ad364e35_10.0.26100.1_fi-fi_86d0382ccdbb6730\comdlg32.dll.mui Handle ID: 0xbd4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-mlang.resources_31bf3856ad364e35_10.0.26100.1_fr-ca_1e2f6861732cb890\mlang.dll.mui Handle ID: 0x84c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-comctl32-v5.resources_31bf3856ad364e35_10.0.26100.1_fr-fr_02403f0ef168a7b2\comctl32.dll.mui Handle ID: 0xba0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..er-engine.resources_31bf3856ad364e35_10.0.26100.1_fi-fi_e2fbf9ffbc8de750\msimsg.dll.mui Handle ID: 0x938 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-font-fms.resources_31bf3856ad364e35_10.0.26100.1_fr-fr_a1fb195e6230f8f1\fms.dll.mui Handle ID: 0x828 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-comdlg32.resources_31bf3856ad364e35_10.0.26100.1_fil-ph_2b0b373912d8f2e7\comdlg32.dll.mui Handle ID: 0xf6c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-lsa-msprivs.resources_31bf3856ad364e35_10.0.26100.1_fr-fr_06d4a9c0547686dc\msprivs.dll.mui Handle ID: 0xf70 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-mlang.resources_31bf3856ad364e35_10.0.26100.1_fr-fr_25b91e176e54526a\mlang.dll.mui Handle ID: 0xf74 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-cdosys.resources_31bf3856ad364e35_10.0.26100.1_fr-fr_ffc1462f1d75ab90\cdosys.dll.mui Handle ID: 0x10dc Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-comctl32-v5.resources_31bf3856ad364e35_10.0.26100.1_ga-ie_a0523015e724fbf2\comctl32.dll.mui Handle ID: 0x778 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-comdlg32.resources_31bf3856ad364e35_10.0.26100.1_fr-ca_82e2f3c8d04bf18e\comdlg32.dll.mui Handle ID: 0x10e0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-comctl32-v5.resources_31bf3856ad364e35_10.0.26100.1_gd-gb_9edd5857e8180eee\comctl32.dll.mui Handle ID: 0xc08 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-font-fms.resources_31bf3856ad364e35_10.0.26100.1_ga-ie_400d0a6557ed4d31\fms.dll.mui Handle ID: 0x728 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-mlang.resources_31bf3856ad364e35_10.0.26100.1_ga-ie_c3cb0f1e6410a6aa\mlang.dll.mui Handle ID: 0xbc0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-comdlg32.resources_31bf3856ad364e35_10.0.26100.1_fr-fr_8a6ca97ecb738b68\comdlg32.dll.mui Handle ID: 0x10d4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-comctl32-v5.resources_31bf3856ad364e35_10.0.26100.1_gl-es_a6110095e380082b\comctl32.dll.mui Handle ID: 0x79c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-font-fms.resources_31bf3856ad364e35_10.0.26100.1_gd-gb_3e9832a758e0602d\fms.dll.mui Handle ID: 0x898 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..er-engine.resources_31bf3856ad364e35_10.0.26100.1_fr-ca_df0eb59bbf1e71ae\msimsg.dll.mui Handle ID: 0x9fc Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-mlang.resources_31bf3856ad364e35_10.0.26100.1_gd-gb_c25637606503b9a6\mlang.dll.mui Handle ID: 0x7ac Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-comctl32-v5.resources_31bf3856ad364e35_10.0.26100.1_gu-in_a377b243e5365385\comctl32.dll.mui Handle ID: 0xbb8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-font-fms.resources_31bf3856ad364e35_10.0.26100.1_gl-es_45cbdae55448596a\fms.dll.mui Handle ID: 0xbf0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-comdlg32.resources_31bf3856ad364e35_10.0.26100.1_ga-ie_287e9a85c12fdfa8\comdlg32.dll.mui Handle ID: 0xbe4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-mlang.resources_31bf3856ad364e35_10.0.26100.1_gl-es_c989df9e606bb2e3\mlang.dll.mui Handle ID: 0x920 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-font-fms.resources_31bf3856ad364e35_10.0.26100.1_gu-in_43328c9355fea4c4\fms.dll.mui Handle ID: 0xbf8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-comctl32-v5.resources_31bf3856ad364e35_10.0.26100.1_he-il_465fe6b0d7d7a8a0\comctl32.dll.mui Handle ID: 0x10a4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-mlang.resources_31bf3856ad364e35_10.0.26100.1_gu-in_c6f0914c6221fe3d\mlang.dll.mui Handle ID: 0x10c4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..er-engine.resources_31bf3856ad364e35_10.0.26100.1_fr-fr_e6986b51ba460b88\msimsg.dll.mui Handle ID: 0x900 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-comdlg32.resources_31bf3856ad364e35_10.0.26100.1_gd-gb_2709c2c7c222f2a4\comdlg32.dll.mui Handle ID: 0xc40 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-cdosys.resources_31bf3856ad364e35_10.0.26100.1_he-il_43e0edd103e4ac7e\cdosys.dll.mui Handle ID: 0x5f8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-font-fms.resources_31bf3856ad364e35_10.0.26100.1_he-il_e61ac100489ff9df\fms.dll.mui Handle ID: 0x10bc Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-comctl32-v5.resources_31bf3856ad364e35_10.0.26100.1_hi-in_4717b55cd7662172\comctl32.dll.mui Handle ID: 0x10c0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-comdlg32.resources_31bf3856ad364e35_10.0.26100.1_gl-es_2e3d6b05bd8aebe1\comdlg32.dll.mui Handle ID: 0x10b0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-mlang.resources_31bf3856ad364e35_10.0.26100.1_he-il_69d8c5b954c35358\mlang.dll.mui Handle ID: 0xc14 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-comdlg32.resources_31bf3856ad364e35_10.0.26100.1_gu-in_2ba41cb3bf41373b\comdlg32.dll.mui Handle ID: 0x10cc Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-font-fms.resources_31bf3856ad364e35_10.0.26100.1_hi-in_e6d28fac482e72b1\fms.dll.mui Handle ID: 0xc0c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-comctl32-v5.resources_31bf3856ad364e35_10.0.26100.1_hr-hr_487c9990d68b1566\comctl32.dll.mui Handle ID: 0xc98 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-mlang.resources_31bf3856ad364e35_10.0.26100.1_hi-in_6a9094655451cc2a\mlang.dll.mui Handle ID: 0x10e4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-comdlg32.resources_31bf3856ad364e35_10.0.26100.1_he-il_ce8c5120b1e28c56\comdlg32.dll.mui Handle ID: 0x10e8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-font-fms.resources_31bf3856ad364e35_10.0.26100.1_hr-hr_e83773e0475366a5\fms.dll.mui Handle ID: 0xc84 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..er-engine.resources_31bf3856ad364e35_10.0.26100.1_he-il_2ab812f3a0b50c76\msimsg.dll.mui Handle ID: 0xcb0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-comctl32-v5.resources_31bf3856ad364e35_10.0.26100.1_hu-hu_49b0bf56d5c876ce\comctl32.dll.mui Handle ID: 0xcc4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-mlang.resources_31bf3856ad364e35_10.0.26100.1_hr-hr_6bf578995376c01e\mlang.dll.mui Handle ID: 0xbb4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-comdlg32.resources_31bf3856ad364e35_10.0.26100.1_hi-in_cf441fccb1710528\comdlg32.dll.mui Handle ID: 0xc68 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-font-fms.resources_31bf3856ad364e35_10.0.26100.1_hu-hu_e96b99a64690c80d\fms.dll.mui Handle ID: 0xb28 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-lsa-msprivs.resources_31bf3856ad364e35_10.0.26100.1_hu-hu_4e452a0838d655f8\msprivs.dll.mui Handle ID: 0xfcc Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-comctl32-v5.resources_31bf3856ad364e35_10.0.26100.1_hy-am_45f9e5aed8300ef3\comctl32.dll.mui Handle ID: 0x1114 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-mlang.resources_31bf3856ad364e35_10.0.26100.1_hu-hu_6d299e5f52b42186\mlang.dll.mui Handle ID: 0x7dc Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-cdosys.resources_31bf3856ad364e35_10.0.26100.1_hu-hu_4731c67701d57aac\cdosys.dll.mui Handle ID: 0x1118 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-comdlg32.resources_31bf3856ad364e35_10.0.26100.1_hr-hr_d0a90400b095f91c\comdlg32.dll.mui Handle ID: 0xce4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-comctl32-v5.resources_31bf3856ad364e35_10.0.26100.1_id-id_e5fcc135cca885b0\comctl32.dll.mui Handle ID: 0xc64 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-font-fms.resources_31bf3856ad364e35_10.0.26100.1_hy-am_e5b4bffe48f86032\fms.dll.mui Handle ID: 0xc60 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-mlang.resources_31bf3856ad364e35_10.0.26100.1_hy-am_6972c4b7551bb9ab\mlang.dll.mui Handle ID: 0xbec Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-comctl32-v5.resources_31bf3856ad364e35_10.0.26100.1_is-is_ec017e13c8db6cb8\comctl32.dll.mui Handle ID: 0xc7c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-font-fms.resources_31bf3856ad364e35_10.0.26100.1_id-id_85b79b853d70d6ef\fms.dll.mui Handle ID: 0xd10 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-comdlg32.resources_31bf3856ad364e35_10.0.26100.1_hu-hu_d1dd29c6afd35a84\comdlg32.dll.mui Handle ID: 0x1124 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-mlang.resources_31bf3856ad364e35_10.0.26100.1_id-id_0975a03e49943068\mlang.dll.mui Handle ID: 0xc50 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..er-engine.resources_31bf3856ad364e35_10.0.26100.1_hr-hr_2cd4c5d39f68793c\msimsg.dll.mui Handle ID: 0xcf0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-font-fms.resources_31bf3856ad364e35_10.0.26100.1_is-is_8bbc586339a3bdf7\fms.dll.mui Handle ID: 0xcfc Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..er-engine.resources_31bf3856ad364e35_10.0.26100.1_hu-hu_2e08eb999ea5daa4\msimsg.dll.mui Handle ID: 0xd30 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-comctl32-v5.resources_31bf3856ad364e35_10.0.26100.1_it-it_ec683555c89a8d30\comctl32.dll.mui Handle ID: 0xcf8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-mlang.resources_31bf3856ad364e35_10.0.26100.1_is-is_0f7a5d1c45c71770\mlang.dll.mui Handle ID: 0x1120 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-comdlg32.resources_31bf3856ad364e35_10.0.26100.1_hy-am_ce26501eb23af2a9\comdlg32.dll.mui Handle ID: 0xd1c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-lsa-msprivs.resources_31bf3856ad364e35_10.0.26100.1_it-it_f0fca0072ba86c5a\msprivs.dll.mui Handle ID: 0xd4c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-comdlg32.resources_31bf3856ad364e35_10.0.26100.1_id-id_6e292ba5a6b36966\comdlg32.dll.mui Handle ID: 0xd24 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-font-fms.resources_31bf3856ad364e35_10.0.26100.1_it-it_8c230fa53962de6f\fms.dll.mui Handle ID: 0xcc0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-comctl32-v5.resources_31bf3856ad364e35_10.0.26100.1_ja-jp_8e8db462bbb59f0b\comctl32.dll.mui Handle ID: 0xd08 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-mlang.resources_31bf3856ad364e35_10.0.26100.1_it-it_0fe1145e458637e8\mlang.dll.mui Handle ID: 0xd74 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-font-fms.resources_31bf3856ad364e35_10.0.26100.1_ja-jp_2e488eb22c7df04a\fms.dll.mui Handle ID: 0xd7c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-comdlg32.resources_31bf3856ad364e35_10.0.26100.1_is-is_742de883a2e6506e\comdlg32.dll.mui Handle ID: 0xfd0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-cdosys.resources_31bf3856ad364e35_10.0.26100.1_ja-jp_8c0ebb82e7c2a2e9\cdosys.dll.mui Handle ID: 0xd64 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-lsa-msprivs.resources_31bf3856ad364e35_10.0.26100.1_ja-jp_93221f141ec37e35\msprivs.dll.mui Handle ID: 0xfd4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-mlang.resources_31bf3856ad364e35_10.0.26100.1_ja-jp_b206936b38a149c3\mlang.dll.mui Handle ID: 0xd8c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-comctl32-v5.resources_31bf3856ad364e35_10.0.26100.1_ka-ge_2ccb6dc9b1693d94\comctl32.dll.mui Handle ID: 0x5c8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-cdosys.resources_31bf3856ad364e35_10.0.26100.1_it-it_e9e93c75f4a7910e\cdosys.dll.mui Handle ID: 0xd5c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-comctl32-v5.resources_31bf3856ad364e35_10.0.26100.1_kk-kz_35af0a37abbe1a95\comctl32.dll.mui Handle ID: 0x948 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-font-fms.resources_31bf3856ad364e35_10.0.26100.1_ka-ge_cc86481922318ed3\fms.dll.mui Handle ID: 0xd40 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-comdlg32.resources_31bf3856ad364e35_10.0.26100.1_it-it_74949fc5a2a570e6\comdlg32.dll.mui Handle ID: 0x944 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-comdlg32.resources_31bf3856ad364e35_10.0.26100.1_ja-jp_16ba1ed295c082c1\comdlg32.dll.mui Handle ID: 0xd6c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-mlang.resources_31bf3856ad364e35_10.0.26100.1_ka-ge_50444cd22e54e84c\mlang.dll.mui Handle ID: 0xd60 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-comctl32-v5.resources_31bf3856ad364e35_10.0.26100.1_km-kh_2d9de923b0f000f9\comctl32.dll.mui Handle ID: 0x940 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-font-fms.resources_31bf3856ad364e35_10.0.26100.1_kk-kz_d569e4871c866bd4\fms.dll.mui Handle ID: 0xbe0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..er-engine.resources_31bf3856ad364e35_10.0.26100.1_ja-jp_72e5e0a5849302e1\msimsg.dll.mui Handle ID: 0xd38 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-mlang.resources_31bf3856ad364e35_10.0.26100.1_kk-kz_5927e94028a9c54d\mlang.dll.mui Handle ID: 0xd50 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-font-fms.resources_31bf3856ad364e35_10.0.26100.1_km-kh_cd58c37321b85238\fms.dll.mui Handle ID: 0xd44 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-comctl32-v5.resources_31bf3856ad364e35_10.0.26100.1_kn-in_303c71dbaf4204d2\comctl32.dll.mui Handle ID: 0xbdc Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..er-engine.resources_31bf3856ad364e35_10.0.26100.1_it-it_d0c061989177f106\msimsg.dll.mui Handle ID: 0xcc8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-mlang.resources_31bf3856ad364e35_10.0.26100.1_km-kh_5116c82c2ddbabb1\mlang.dll.mui Handle ID: 0xc38 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-comdlg32.resources_31bf3856ad364e35_10.0.26100.1_ka-ge_b4f7d8398b74214a\comdlg32.dll.mui Handle ID: 0xd88 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-font-fms.resources_31bf3856ad364e35_10.0.26100.1_kn-in_cff74c2b200a5611\fms.dll.mui Handle ID: 0xcdc Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-comctl32-v5.resources_31bf3856ad364e35_10.0.26100.1_ko-kr_31f79117ae266621\comctl32.dll.mui Handle ID: 0xd78 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-mlang.resources_31bf3856ad364e35_10.0.26100.1_kn-in_53b550e42c2daf8a\mlang.dll.mui Handle ID: 0xc70 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-font-fms.resources_31bf3856ad364e35_10.0.26100.1_ko-kr_d1b26b671eeeb760\fms.dll.mui Handle ID: 0xd84 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-mlang.resources_31bf3856ad364e35_10.0.26100.1_ko-kr_557070202b1210d9\mlang.dll.mui Handle ID: 0xdc8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-lsa-msprivs.resources_31bf3856ad364e35_10.0.26100.1_ko-kr_368bfbc91134454b\msprivs.dll.mui Handle ID: 0xb84 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-cdosys.resources_31bf3856ad364e35_10.0.26100.1_ko-kr_2f789837da3369ff\cdosys.dll.mui Handle ID: 0xb74 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-comctl32-v5.resources_31bf3856ad364e35_10.0.26100.1_kok-in_df9a8c9aab7351c6\comctl32.dll.mui Handle ID: 0xbb0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-comdlg32.resources_31bf3856ad364e35_10.0.26100.1_km-kh_b5ca53938afae4af\comdlg32.dll.mui Handle ID: 0xc6c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-comdlg32.resources_31bf3856ad364e35_10.0.26100.1_kk-kz_bddb74a785c8fe4b\comdlg32.dll.mui Handle ID: 0xcd0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-comctl32-v5.resources_31bf3856ad364e35_10.0.26100.1_lb-lu_d6f6e2de9f733f53\comctl32.dll.mui Handle ID: 0xbac Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-font-fms.resources_31bf3856ad364e35_10.0.26100.1_kok-in_7f5566ea1c3ba305\fms.dll.mui Handle ID: 0xbfc Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-comdlg32.resources_31bf3856ad364e35_10.0.26100.1_ko-kr_ba23fb87883149d7\comdlg32.dll.mui Handle ID: 0xd20 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-mlang.resources_31bf3856ad364e35_10.0.26100.1_kok-in_03136ba3285efc7e\mlang.dll.mui Handle ID: 0xdcc Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-comdlg32.resources_31bf3856ad364e35_10.0.26100.1_kn-in_b868dc4b894ce888\comdlg32.dll.mui Handle ID: 0x1148 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-comctl32-v5.resources_31bf3856ad364e35_10.0.26100.1_lo-la_cd8bc44aa5905004\comctl32.dll.mui Handle ID: 0x114c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-font-fms.resources_31bf3856ad364e35_10.0.26100.1_lb-lu_76b1bd2e103b9092\fms.dll.mui Handle ID: 0xdd0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..er-engine.resources_31bf3856ad364e35_10.0.26100.1_ko-kr_164fbd5a7703c9f7\msimsg.dll.mui Handle ID: 0xc78 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-comctl32-v5.resources_31bf3856ad364e35_10.0.26100.1_lt-lt_d5c2bd18a04e31be\comctl32.dll.mui Handle ID: 0xd14 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-mlang.resources_31bf3856ad364e35_10.0.26100.1_lb-lu_fa6fc1e71c5eea0b\mlang.dll.mui Handle ID: 0x108c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-font-fms.resources_31bf3856ad364e35_10.0.26100.1_lo-la_6d469e9a1658a143\fms.dll.mui Handle ID: 0x1144 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-mlang.resources_31bf3856ad364e35_10.0.26100.1_lo-la_f104a353227bfabc\mlang.dll.mui Handle ID: 0xcd8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-comdlg32.resources_31bf3856ad364e35_10.0.26100.1_kok-in_67c6f70a857e357c\comdlg32.dll.mui Handle ID: 0x1158 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-font-fms.resources_31bf3856ad364e35_10.0.26100.1_lt-lt_757d9768111682fd\fms.dll.mui Handle ID: 0xe00 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-comctl32-v5.resources_31bf3856ad364e35_10.0.26100.1_lv-lv_d6902b9c9fcc72ae\comctl32.dll.mui Handle ID: 0xdfc Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-mlang.resources_31bf3856ad364e35_10.0.26100.1_lt-lt_f93b9c211d39dc76\mlang.dll.mui Handle ID: 0xb88 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-comdlg32.resources_31bf3856ad364e35_10.0.26100.1_lo-la_55b82eba7f9b33ba\comdlg32.dll.mui Handle ID: 0xc58 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-font-fms.resources_31bf3856ad364e35_10.0.26100.1_lv-lv_764b05ec1094c3ed\fms.dll.mui Handle ID: 0xd54 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-mlang.resources_31bf3856ad364e35_10.0.26100.1_lv-lv_fa090aa51cb81d66\mlang.dll.mui Handle ID: 0xc54 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-comctl32-v5.resources_31bf3856ad364e35_10.0.26100.1_mi-nz_7c00edc990d06a08\comctl32.dll.mui Handle ID: 0xdf8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-comdlg32.resources_31bf3856ad364e35_10.0.26100.1_lb-lu_5f234d4e797e2309\comdlg32.dll.mui Handle ID: 0xe14 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-comdlg32.resources_31bf3856ad364e35_10.0.26100.1_lt-lt_5def27887a591574\comdlg32.dll.mui Handle ID: 0xe18 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-font-fms.resources_31bf3856ad364e35_10.0.26100.1_mi-nz_1bbbc8190198bb47\fms.dll.mui Handle ID: 0xc74 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-mlang.resources_31bf3856ad364e35_10.0.26100.1_mi-nz_9f79ccd20dbc14c0\mlang.dll.mui Handle ID: 0xdd4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..er-engine.resources_31bf3856ad364e35_10.0.26100.1_lt-lt_ba1ae95b692b9594\msimsg.dll.mui Handle ID: 0xd70 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-comdlg32.resources_31bf3856ad364e35_10.0.26100.1_lv-lv_5ebc960c79d75664\comdlg32.dll.mui Handle ID: 0xb14 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-comctl32-v5.resources_31bf3856ad364e35_10.0.26100.1_mk-mk_7544790795274460\comctl32.dll.mui Handle ID: 0x101c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-p..unterinfrastructure_31bf3856ad364e35_10.0.26100.1_none_6e79a5b8677363f6\CntrtextMig.dll Handle ID: 0x1138 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-pnpmigration_31bf3856ad364e35_10.0.26100.1_none_65e459e7a47dc387\pnpmig.inf Handle ID: 0xe24 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-comdlg32.resources_31bf3856ad364e35_10.0.26100.1_mi-nz_042d58396adb4dbe\comdlg32.dll.mui Handle ID: 0xe08 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-comctl32-v5.resources_31bf3856ad364e35_10.0.26100.1_ml-in_768e99c594540762\comctl32.dll.mui Handle ID: 0xd2c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-font-fms.resources_31bf3856ad364e35_10.0.26100.1_mk-mk_14ff535705ef959f\fms.dll.mui Handle ID: 0xe20 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-mlang.resources_31bf3856ad364e35_10.0.26100.1_mk-mk_98bd58101212ef18\mlang.dll.mui Handle ID: 0xe0c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..er-engine.resources_31bf3856ad364e35_10.0.26100.1_lv-lv_bae857df68a9d684\msimsg.dll.mui Handle ID: 0xe2c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-comctl32-v5.resources_31bf3856ad364e35_10.0.26100.1_mr-in_764dba3d9484af08\comctl32.dll.mui Handle ID: 0xc90 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-font-fms.resources_31bf3856ad364e35_10.0.26100.1_ml-in_16497415051c58a1\fms.dll.mui Handle ID: 0x1150 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-mup_31bf3856ad364e35_10.0.26100.1_none_a9e5f18ec110633d\MupMigPlugin.dll Handle ID: 0xe34 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-mlang.resources_31bf3856ad364e35_10.0.26100.1_ml-in_9a0778ce113fb21a\mlang.dll.mui Handle ID: 0xd00 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-font-fms.resources_31bf3856ad364e35_10.0.26100.1_mr-in_1608948d054d0047\fms.dll.mui Handle ID: 0xe38 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-sxs_31bf3856ad364e35_10.0.26100.1_none_ab40447cc03055bf\SxsMigPlugin.dll Handle ID: 0xd04 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-comdlg32.resources_31bf3856ad364e35_10.0.26100.1_mk-mk_fd70e3776f322816\comdlg32.dll.mui Handle ID: 0x1080 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-comctl32-v5.resources_31bf3856ad364e35_10.0.26100.1_ms-my_7b235e2b916a634a\comctl32.dll.mui Handle ID: 0x111c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-mlang.resources_31bf3856ad364e35_10.0.26100.1_mr-in_99c69946117059c0\mlang.dll.mui Handle ID: 0x116c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-comctl32-v5.resources_31bf3856ad364e35_10.0.26100.1_mt-mt_78e0ea5992df6898\comctl32.dll.mui Handle ID: 0xe40 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-font-fms.resources_31bf3856ad364e35_10.0.26100.1_ms-my_1ade387b0232b489\fms.dll.mui Handle ID: 0xdd8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-mlang.resources_31bf3856ad364e35_10.0.26100.1_ms-my_9e9c3d340e560e02\mlang.dll.mui Handle ID: 0x1160 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-font-fms.resources_31bf3856ad364e35_10.0.26100.1_mt-mt_189bc4a903a7b9d7\fms.dll.mui Handle ID: 0xe74 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-comdlg32.resources_31bf3856ad364e35_10.0.26100.1_ml-in_febb04356e5eeb18\comdlg32.dll.mui Handle ID: 0xa58 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-comctl32-v5.resources_31bf3856ad364e35_10.0.26100.1_nb-no_1a8a124c864b91dd\comctl32.dll.mui Handle ID: 0xdb8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-comdlg32.resources_31bf3856ad364e35_10.0.26100.1_mr-in_fe7a24ad6e8f92be\comdlg32.dll.mui Handle ID: 0xc94 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-mlang.resources_31bf3856ad364e35_10.0.26100.1_mt-mt_9c59c9620fcb1350\mlang.dll.mui Handle ID: 0xc1c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-font-fms.resources_31bf3856ad364e35_10.0.26100.1_nb-no_ba44ec9bf713e31c\fms.dll.mui Handle ID: 0xc4c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-lsa-msprivs.resources_31bf3856ad364e35_10.0.26100.1_nb-no_1f1e7cfde9597107\msprivs.dll.mui Handle ID: 0xca8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-comdlg32.resources_31bf3856ad364e35_10.0.26100.1_ms-my_034fc89b6b754700\comdlg32.dll.mui Handle ID: 0xca0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-cdosys.resources_31bf3856ad364e35_10.0.26100.1_nb-no_180b196cb25895bb\cdosys.dll.mui Handle ID: 0x958 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-mlang.resources_31bf3856ad364e35_10.0.26100.1_nb-no_3e02f15503373c95\mlang.dll.mui Handle ID: 0x954 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-comctl32-v5.resources_31bf3856ad364e35_10.0.26100.1_ne-np_1adb29b6861aea37\comctl32.dll.mui Handle ID: 0x10f0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-netshell_31bf3856ad364e35_10.0.26100.1_none_d2771333769763b2\bench_16.bin Handle ID: 0xca4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-comdlg32.resources_31bf3856ad364e35_10.0.26100.1_mt-mt_010d54c96cea4c4e\comdlg32.dll.mui Handle ID: 0xc80 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-netshell_31bf3856ad364e35_10.0.26100.1_none_d2771333769763b2\bench_24.bin Handle ID: 0x10ec Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-netshell_31bf3856ad364e35_10.0.26100.1_none_d2771333769763b2\bench_32.bin Handle ID: 0xcbc Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-netshell_31bf3856ad364e35_10.0.26100.1_none_d2771333769763b2\house_16.bin Handle ID: 0x10f8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-font-fms.resources_31bf3856ad364e35_10.0.26100.1_ne-np_ba960405f6e33b76\fms.dll.mui Handle ID: 0xcac Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-netshell_31bf3856ad364e35_10.0.26100.1_none_d2771333769763b2\house_24.bin Handle ID: 0x1194 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-netshell_31bf3856ad364e35_10.0.26100.1_none_d2771333769763b2\bench_48.bin Handle ID: 0xeac Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-netshell_31bf3856ad364e35_10.0.26100.1_none_d2771333769763b2\house_32.bin Handle ID: 0xeb0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-netshell_31bf3856ad364e35_10.0.26100.1_none_d2771333769763b2\office_16.bin Handle ID: 0x110c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-mlang.resources_31bf3856ad364e35_10.0.26100.1_ne-np_3e5408bf030694ef\mlang.dll.mui Handle ID: 0xbc4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-netshell_31bf3856ad364e35_10.0.26100.1_none_d2771333769763b2\office_24.bin Handle ID: 0xc3c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-netshell_31bf3856ad364e35_10.0.26100.1_none_d2771333769763b2\office_32.bin Handle ID: 0xc18 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-netshell_31bf3856ad364e35_10.0.26100.1_none_d2771333769763b2\house_48.bin Handle ID: 0x844 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-netshell_31bf3856ad364e35_10.0.26100.1_none_d2771333769763b2\office_48.bin Handle ID: 0x1168 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-comctl32-v5.resources_31bf3856ad364e35_10.0.26100.1_nl-nl_18c95d8a87779bb2\comctl32.dll.mui Handle ID: 0xe7c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-comdlg32.resources_31bf3856ad364e35_10.0.26100.1_nb-no_a2b67cbc60567593\comdlg32.dll.mui Handle ID: 0x11ac Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-font-fms.resources_31bf3856ad364e35_10.0.26100.1_nl-nl_b88437d9f83fecf1\fms.dll.mui Handle ID: 0xe80 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..er-engine.resources_31bf3856ad364e35_10.0.26100.1_nb-no_fee23e8f4f28f5b3\msimsg.dll.mui Handle ID: 0xe50 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-lsa-msprivs.resources_31bf3856ad364e35_10.0.26100.1_nl-nl_1d5dc83bea857adc\msprivs.dll.mui Handle ID: 0xec4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-mlang.resources_31bf3856ad364e35_10.0.26100.1_nl-nl_3c423c930463466a\mlang.dll.mui Handle ID: 0x834 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-comctl32-v5.resources_31bf3856ad364e35_10.0.26100.1_nn-no_1a08533c86ace129\comctl32.dll.mui Handle ID: 0x1198 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-cdosys.resources_31bf3856ad364e35_10.0.26100.1_nl-nl_164a64aab3849f90\cdosys.dll.mui Handle ID: 0xdac Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-comctl32-v5.resources_31bf3856ad364e35_10.0.26100.1_or-in_bc8a424f79a6e97a\comctl32.dll.mui Handle ID: 0x11c0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-font-fms.resources_31bf3856ad364e35_10.0.26100.1_nn-no_b9c32d8bf7753268\fms.dll.mui Handle ID: 0xe48 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-mlang.resources_31bf3856ad364e35_10.0.26100.1_nn-no_3d81324503988be1\mlang.dll.mui Handle ID: 0xfdc Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-comdlg32.resources_31bf3856ad364e35_10.0.26100.1_ne-np_a30794266025cded\comdlg32.dll.mui Handle ID: 0xa48 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-font-fms.resources_31bf3856ad364e35_10.0.26100.1_or-in_5c451c9eea6f3ab9\fms.dll.mui Handle ID: 0xe28 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-comdlg32.resources_31bf3856ad364e35_10.0.26100.1_nl-nl_a0f5c7fa61827f68\comdlg32.dll.mui Handle ID: 0x1088 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-comctl32-v5.resources_31bf3856ad364e35_10.0.26100.1_pa-in_606055046bae2bb2\comctl32.dll.mui Handle ID: 0xfe8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-font-fms.resources_31bf3856ad364e35_10.0.26100.1_pa-in_001b2f53dc767cf1\fms.dll.mui Handle ID: 0x124c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-mlang.resources_31bf3856ad364e35_10.0.26100.1_or-in_e0032157f6929432\mlang.dll.mui Handle ID: 0x8d4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-comdlg32.resources_31bf3856ad364e35_10.0.26100.1_nn-no_a234bdac60b7c4df\comdlg32.dll.mui Handle ID: 0x1234 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-mlang.resources_31bf3856ad364e35_10.0.26100.1_pa-in_83d9340ce899d66a\mlang.dll.mui Handle ID: 0x714 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-comctl32-v5.resources_31bf3856ad364e35_10.0.26100.1_pl-pl_5f05b80c6c9a0966\comctl32.dll.mui Handle ID: 0x11a0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..er-engine.resources_31bf3856ad364e35_10.0.26100.1_nl-nl_fd2189cd5054ff88\msimsg.dll.mui Handle ID: 0xc2c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-pnpmigration_31bf3856ad364e35_10.0.26100.1_none_65e459e7a47dc387\pnpmig.dll Handle ID: 0x848 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-lsa-msprivs.resources_31bf3856ad364e35_10.0.26100.1_pl-pl_639a22bdcfa7e890\msprivs.dll.mui Handle ID: 0xf84 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-comdlg32.resources_31bf3856ad364e35_10.0.26100.1_or-in_44b6acbf53b1cd30\comdlg32.dll.mui Handle ID: 0xb90 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-font-fms.resources_31bf3856ad364e35_10.0.26100.1_pl-pl_fec0925bdd625aa5\fms.dll.mui Handle ID: 0x7d8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-mlang.resources_31bf3856ad364e35_10.0.26100.1_pl-pl_827e9714e985b41e\mlang.dll.mui Handle ID: 0xda8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-comctl32-v5.resources_31bf3856ad364e35_10.0.26100.1_pt-br_6159a2b06b239d4a\comctl32.dll.mui Handle ID: 0xf08 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-cdosys.resources_31bf3856ad364e35_10.0.26100.1_pl-pl_5c86bf2c98a70d44\cdosys.dll.mui Handle ID: 0x964 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-comdlg32.resources_31bf3856ad364e35_10.0.26100.1_pa-in_e88cbf7445b90f68\comdlg32.dll.mui Handle ID: 0xf20 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-lsa-msprivs.resources_31bf3856ad364e35_10.0.26100.1_pt-br_65ee0d61ce317c74\msprivs.dll.mui Handle ID: 0x94c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-font-fms.resources_31bf3856ad364e35_10.0.26100.1_pt-br_01147cffdbebee89\fms.dll.mui Handle ID: 0xea8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-comctl32-v5.resources_31bf3856ad364e35_10.0.26100.1_pt-pt_623b721c6a930d26\comctl32.dll.mui Handle ID: 0xebc Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-mlang.resources_31bf3856ad364e35_10.0.26100.1_pt-br_84d281b8e80f4802\mlang.dll.mui Handle ID: 0x11d0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-cdosys.resources_31bf3856ad364e35_10.0.26100.1_pt-br_5edaa9d09730a128\cdosys.dll.mui Handle ID: 0x11cc Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-comdlg32.resources_31bf3856ad364e35_10.0.26100.1_pl-pl_e732227c46a4ed1c\comdlg32.dll.mui Handle ID: 0xef4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-font-fms.resources_31bf3856ad364e35_10.0.26100.1_pt-pt_01f64c6bdb5b5e65\fms.dll.mui Handle ID: 0xee8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..er-engine.resources_31bf3856ad364e35_10.0.26100.1_pl-pl_435de44f35776d3c\msimsg.dll.mui Handle ID: 0xeb4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-cdosys.resources_31bf3856ad364e35_10.0.26100.1_pt-pt_5fbc793c96a01104\cdosys.dll.mui Handle ID: 0x11b4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-mlang.resources_31bf3856ad364e35_10.0.26100.1_pt-pt_85b45124e77eb7de\mlang.dll.mui Handle ID: 0x11b8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-lsa-msprivs.resources_31bf3856ad364e35_10.0.26100.1_pt-pt_66cfdccdcda0ec50\msprivs.dll.mui Handle ID: 0x11bc Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-comdlg32.resources_31bf3856ad364e35_10.0.26100.1_pt-br_e9860d20452e8100\comdlg32.dll.mui Handle ID: 0x11b0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-comctl32-v5.resources_31bf3856ad364e35_10.0.26100.1_qps-ploc_1e5963dd41ba8baa\comctl32.dll.mui Handle ID: 0xc44 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..er-engine.resources_31bf3856ad364e35_10.0.26100.1_pt-br_45b1cef334010120\msimsg.dll.mui Handle ID: 0xe44 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-font-fms.resources_31bf3856ad364e35_10.0.26100.1_qps-ploc_be143e2cb282dce9\fms.dll.mui Handle ID: 0xe4c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-lsa-msprivs.resources_31bf3856ad364e35_10.0.26100.1_qps-ploc_22edce8ea4c86ad4\msprivs.dll.mui Handle ID: 0x11c8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-mlang.resources_31bf3856ad364e35_10.0.26100.1_qps-ploc_41d242e5bea63662\mlang.dll.mui Handle ID: 0x6b4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-comdlg32.resources_31bf3856ad364e35_10.0.26100.1_pt-pt_ea67dc8c449df0dc\comdlg32.dll.mui Handle ID: 0x7b0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-comctl32-v5.resources_31bf3856ad364e35_10.0.26100.1_qps..ocm_b8b69192a79904f3\comctl32.dll.mui Handle ID: 0x11e0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-cdosys.resources_31bf3856ad364e35_10.0.26100.1_qps-ploc_1bda6afd6dc78f88\cdosys.dll.mui Handle ID: 0x794 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-comdlg32.resources_31bf3856ad364e35_10.0.26100.1_qps-ploc_a685ce4d1bc56f60\comdlg32.dll.mui Handle ID: 0x11dc Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..er-engine.resources_31bf3856ad364e35_10.0.26100.1_pt-pt_46939e5f337070fc\msimsg.dll.mui Handle ID: 0xf44 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-font-fms.resources_31bf3856ad364e35_10.0.26100.1_qps..ocm_58716be218615632\fms.dll.mui Handle ID: 0xef0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-lsa-msprivs.resources_31bf3856ad364e35_10.0.26100.1_qps..ocm_bd4afc440aa6e41d\msprivs.dll.mui Handle ID: 0xf40 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-comctl32-v5.resources_31bf3856ad364e35_10.0.26100.1_quz-pe_c65c286d0c23e347\comctl32.dll.mui Handle ID: 0xf0c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-cdosys.resources_31bf3856ad364e35_10.0.26100.1_qps..ocm_b63798b2d3a608d1\cdosys.dll.mui Handle ID: 0xee4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-rasbase_31bf3856ad364e35_10.0.26100.1_none_0ad41041e2fbdf9e\cis.scp Handle ID: 0xef8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-mlang.resources_31bf3856ad364e35_10.0.26100.1_qps..ocm_dc2f709b2484afab\mlang.dll.mui Handle ID: 0x11d8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-rasbase_31bf3856ad364e35_10.0.26100.1_none_0ad41041e2fbdf9e\pppmenu.scp Handle ID: 0xf24 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-comdlg32.resources_31bf3856ad364e35_10.0.26100.1_qps..ocm_40e2fc0281a3e8a9\comdlg32.dll.mui Handle ID: 0xefc Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-rasbase_31bf3856ad364e35_10.0.26100.1_none_0ad41041e2fbdf9e\pad.inf Handle ID: 0x11d4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-font-fms.resources_31bf3856ad364e35_10.0.26100.1_quz-pe_661702bc7cec3486\fms.dll.mui Handle ID: 0x870 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-mlang.resources_31bf3856ad364e35_10.0.26100.1_quz-pe_e9d50775890f8dff\mlang.dll.mui Handle ID: 0xf4c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-comctl32-v5.resources_31bf3856ad364e35_10.0.26100.1_ro-ro_a676385450f9d882\comctl32.dll.mui Handle ID: 0x11a4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..er-engine.resources_31bf3856ad364e35_10.0.26100.1_qps-ploc_02b190200a97ef80\msimsg.dll.mui Handle ID: 0x96c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-rasbase_31bf3856ad364e35_10.0.26100.1_none_0ad41041e2fbdf9e\switch.inf Handle ID: 0xeb8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-comctl32-v5.resources_31bf3856ad364e35_10.0.26100.1_ru-ru_a8de83e04f749b52\comctl32.dll.mui Handle ID: 0xbd0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-font-fms.resources_31bf3856ad364e35_10.0.26100.1_ro-ro_463112a3c1c229c1\fms.dll.mui Handle ID: 0x10a0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-mlang.resources_31bf3856ad364e35_10.0.26100.1_ro-ro_c9ef175ccde5833a\mlang.dll.mui Handle ID: 0x700 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..er-engine.resources_31bf3856ad364e35_10.0.26100.1_qps..ocm_9d0ebdd5707668c9\msimsg.dll.mui Handle ID: 0xe94 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-font-fms.resources_31bf3856ad364e35_10.0.26100.1_ru-ru_48995e2fc03cec91\fms.dll.mui Handle ID: 0xdf4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-comdlg32.resources_31bf3856ad364e35_10.0.26100.1_quz-pe_4e8892dce62ec6fd\comdlg32.dll.mui Handle ID: 0x11f0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-cdosys.resources_31bf3856ad364e35_10.0.26100.1_ru-ru_a65f8b007b819f30\cdosys.dll.mui Handle ID: 0x10b4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-lsa-msprivs.resources_31bf3856ad364e35_10.0.26100.1_ru-ru_ad72ee91b2827a7c\msprivs.dll.mui Handle ID: 0x10b8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-comctl32-v5.resources_31bf3856ad364e35_10.0.26100.1_sk-sk_47f9888d448e8d7c\comctl32.dll.mui Handle ID: 0x10ac Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-mlang.resources_31bf3856ad364e35_10.0.26100.1_ru-ru_cc5762e8cc60460a\mlang.dll.mui Handle ID: 0xf2c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-comdlg32.resources_31bf3856ad364e35_10.0.26100.1_ro-ro_2ea2a2c42b04bc38\comdlg32.dll.mui Handle ID: 0xf04 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-font-fms.resources_31bf3856ad364e35_10.0.26100.1_sk-sk_e7b462dcb556debb\fms.dll.mui Handle ID: 0xf5c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-comdlg32.resources_31bf3856ad364e35_10.0.26100.1_ru-ru_310aee50297f7f08\comdlg32.dll.mui Handle ID: 0x998 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..er-engine.resources_31bf3856ad364e35_10.0.26100.1_ro-ro_8ace649719d73c58\msimsg.dll.mui Handle ID: 0x1188 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-t..nalservices-sysprep_31bf3856ad364e35_10.0.26100.1_none_2e8d3eb1b0ce35fe\tssysprep.dll Handle ID: 0xe98 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-comctl32-v5.resources_31bf3856ad364e35_10.0.26100.1_sl-si_470baa454528a05f\comctl32.dll.mui Handle ID: 0x7c0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-mlang.resources_31bf3856ad364e35_10.0.26100.1_sk-sk_6b726795c17a3834\mlang.dll.mui Handle ID: 0x720 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-rasapi_31bf3856ad364e35_10.0.26100.1_none_6a2b27cab811cd01\pbkmigr.dll Handle ID: 0xe90 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-smi-engine_31bf3856ad364e35_10.0.26100.1_none_9508d7f47b6f7c85\WcmTypes.xsd Handle ID: 0x840 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-font-fms.resources_31bf3856ad364e35_10.0.26100.1_sl-si_e6c68494b5f0f19e\fms.dll.mui Handle ID: 0x97c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..er-engine.resources_31bf3856ad364e35_10.0.26100.1_ru-ru_8d36b0231851ff28\msimsg.dll.mui Handle ID: 0x86c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-mlang.resources_31bf3856ad364e35_10.0.26100.1_sl-si_6a84894dc2144b17\mlang.dll.mui Handle ID: 0x6f8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-comdlg32.resources_31bf3856ad364e35_10.0.26100.1_sk-sk_d025f2fd1e997132\comdlg32.dll.mui Handle ID: 0x1184 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-comdlg32.resources_31bf3856ad364e35_10.0.26100.1_sl-si_cf3814b51f338415\comdlg32.dll.mui Handle ID: 0x874 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-comctl32-v5.resources_31bf3856ad364e35_10.0.26100.1_sq-al_482bca4344746c57\comctl32.dll.mui Handle ID: 0x119c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-comctl32-v5.resources_31bf3856ad364e35_10.0.26100.1_sr-..-ba_a41f699359130ea3\comctl32.dll.mui Handle ID: 0x117c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..er-engine.resources_31bf3856ad364e35_10.0.26100.1_sk-sk_2c51b4d00d6bf152\msimsg.dll.mui Handle ID: 0x9a4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-font-fms.resources_31bf3856ad364e35_10.0.26100.1_sq-al_e7e6a492b53cbd96\fms.dll.mui Handle ID: 0x860 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-mlang.resources_31bf3856ad364e35_10.0.26100.1_sq-al_6ba4a94bc160170f\mlang.dll.mui Handle ID: 0x85c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..er-engine.resources_31bf3856ad364e35_10.0.26100.1_sl-si_2b63d6880e060435\msimsg.dll.mui Handle ID: 0x854 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-comctl32-v5.resources_31bf3856ad364e35_10.0.26100.1_sr-..-rs_aa753ddb55154e05\comctl32.dll.mui Handle ID: 0x6c4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-font-fms.resources_31bf3856ad364e35_10.0.26100.1_sr-..-ba_43da43e2c9db5fe2\fms.dll.mui Handle ID: 0xeec Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-mlang.resources_31bf3856ad364e35_10.0.26100.1_sr-..-ba_c798489bd5feb95b\mlang.dll.mui Handle ID: 0x970 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-comctl32-v5.resources_31bf3856ad364e35_10.0.26100.1_sr-..-rs_ed3c1289ba3a4790\comctl32.dll.mui Handle ID: 0x974 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-font-fms.resources_31bf3856ad364e35_10.0.26100.1_sr-..-rs_4a30182ac5dd9f44\fms.dll.mui Handle ID: 0xf18 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-mlang.resources_31bf3856ad364e35_10.0.26100.1_sr-..-rs_cdee1ce3d200f8bd\mlang.dll.mui Handle ID: 0xee0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-font-fms.resources_31bf3856ad364e35_10.0.26100.1_sr-..-rs_8cf6ecd92b0298cf\fms.dll.mui Handle ID: 0x708 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-comdlg32.resources_31bf3856ad364e35_10.0.26100.1_sq-al_d05834b31e7f500d\comdlg32.dll.mui Handle ID: 0x978 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-comdlg32.resources_31bf3856ad364e35_10.0.26100.1_sr-..-ba_2c4bd403331df259\comdlg32.dll.mui Handle ID: 0x838 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-mlang.resources_31bf3856ad364e35_10.0.26100.1_sr-..-rs_10b4f1923725f248\mlang.dll.mui Handle ID: 0x72c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-comctl32-v5.resources_31bf3856ad364e35_10.0.26100.1_sv-se_44d96e55469da5ad\comctl32.dll.mui Handle ID: 0x7fc Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-comdlg32.resources_31bf3856ad364e35_10.0.26100.1_sr-..-rs_32a1a84b2f2031bb\comdlg32.dll.mui Handle ID: 0x77c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-font-fms.resources_31bf3856ad364e35_10.0.26100.1_sv-se_e49448a4b765f6ec\fms.dll.mui Handle ID: 0x9b8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-lsa-msprivs.resources_31bf3856ad364e35_10.0.26100.1_sv-se_496dd906a9ab84d7\msprivs.dll.mui Handle ID: 0x87c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-cdosys.resources_31bf3856ad364e35_10.0.26100.1_sv-se_425a757572aaa98b\cdosys.dll.mui Handle ID: 0x6f0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-mlang.resources_31bf3856ad364e35_10.0.26100.1_sv-se_68524d5dc3895065\mlang.dll.mui Handle ID: 0x6b0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-comdlg32.resources_31bf3856ad364e35_10.0.26100.1_sr-..-rs_75687cf994452b46\comdlg32.dll.mui Handle ID: 0xed8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-comctl32-v5.resources_31bf3856ad364e35_10.0.26100.1_ta-in_ecd9652835f2a096\comctl32.dll.mui Handle ID: 0x7f4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-comctl32-v5.resources_31bf3856ad364e35_10.0.26100.1_te-in_ecae25783613105a\comctl32.dll.mui Handle ID: 0x9c8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-font-fms.resources_31bf3856ad364e35_10.0.26100.1_ta-in_8c943f77a6baf1d5\fms.dll.mui Handle ID: 0xe70 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-mlang.resources_31bf3856ad364e35_10.0.26100.1_ta-in_10524430b2de4b4e\mlang.dll.mui Handle ID: 0xec8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..er-engine.resources_31bf3856ad364e35_10.0.26100.1_sr-..-rs_d1943ecc8317ab66\msimsg.dll.mui Handle ID: 0xe6c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-comdlg32.resources_31bf3856ad364e35_10.0.26100.1_sv-se_cd05d8c520a88963\comdlg32.dll.mui Handle ID: 0xf10 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-comctl32-v5.resources_31bf3856ad364e35_10.0.26100.1_th-th_e9e3900837e262ee\comctl32.dll.mui Handle ID: 0x754 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-font-fms.resources_31bf3856ad364e35_10.0.26100.1_te-in_8c68ffc7a6db6199\fms.dll.mui Handle ID: 0x9bc Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-mlang.resources_31bf3856ad364e35_10.0.26100.1_te-in_10270480b2febb12\mlang.dll.mui Handle ID: 0x98c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-font-fms.resources_31bf3856ad364e35_10.0.26100.1_th-th_899e6a57a8aab42d\fms.dll.mui Handle ID: 0x864 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-mlang.resources_31bf3856ad364e35_10.0.26100.1_th-th_0d5c6f10b4ce0da6\mlang.dll.mui Handle ID: 0x804 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..er-engine.resources_31bf3856ad364e35_10.0.26100.1_sv-se_29319a980f7b0983\msimsg.dll.mui Handle ID: 0x7f0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-comctl32-v5.resources_31bf3856ad364e35_10.0.26100.1_tr-tr_ede6b89c3559a79e\comctl32.dll.mui Handle ID: 0x990 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-comdlg32.resources_31bf3856ad364e35_10.0.26100.1_ta-in_7505cf980ffd844c\comdlg32.dll.mui Handle ID: 0x884 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-comdlg32.resources_31bf3856ad364e35_10.0.26100.1_te-in_74da8fe8101df410\comdlg32.dll.mui Handle ID: 0x878 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-font-fms.resources_31bf3856ad364e35_10.0.26100.1_tr-tr_8da192eba621f8dd\fms.dll.mui Handle ID: 0x7d0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-cdosys.resources_31bf3856ad364e35_10.0.26100.1_tr-tr_eb67bfbc6166ab7c\cdosys.dll.mui Handle ID: 0xea0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-comdlg32.resources_31bf3856ad364e35_10.0.26100.1_th-th_720ffa7811ed46a4\comdlg32.dll.mui Handle ID: 0x7a0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-lsa-msprivs.resources_31bf3856ad364e35_10.0.26100.1_tr-tr_f27b234d986786c8\msprivs.dll.mui Handle ID: 0x9c4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-comctl32-v5.resources_31bf3856ad364e35_10.0.26100.1_tt-ru_ef25dbde348eb9d3\comctl32.dll.mui Handle ID: 0xf60 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-mlang.resources_31bf3856ad364e35_10.0.26100.1_tr-tr_115f97a4b2455256\mlang.dll.mui Handle ID: 0x6b8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-comctl32-v5.resources_31bf3856ad364e35_10.0.26100.1_ug-cn_8fb7525928b3cbaf\comctl32.dll.mui Handle ID: 0xc24 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..er-engine.resources_31bf3856ad364e35_10.0.26100.1_th-th_ce3bbc4b00bfc6c4\msimsg.dll.mui Handle ID: 0xc30 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-font-fms.resources_31bf3856ad364e35_10.0.26100.1_tt-ru_8ee0b62da5570b12\fms.dll.mui Handle ID: 0x9b4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-mlang.resources_31bf3856ad364e35_10.0.26100.1_tt-ru_129ebae6b17a648b\mlang.dll.mui Handle ID: 0x7bc Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-comdlg32.resources_31bf3856ad364e35_10.0.26100.1_tr-tr_7613230c0f648b54\comdlg32.dll.mui Handle ID: 0xecc Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-comctl32-v5.resources_31bf3856ad364e35_10.0.26100.1_uk-ua_89c69b432c8acdea\comctl32.dll.mui Handle ID: 0xdc0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-font-fms.resources_31bf3856ad364e35_10.0.26100.1_ug-cn_2f722ca8997c1cee\fms.dll.mui Handle ID: 0x1140 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-mlang.resources_31bf3856ad364e35_10.0.26100.1_ug-cn_b3303161a59f7667\mlang.dll.mui Handle ID: 0x113c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-font-fms.resources_31bf3856ad364e35_10.0.26100.1_uk-ua_298175929d531f29\fms.dll.mui Handle ID: 0x1200 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..er-engine.resources_31bf3856ad364e35_10.0.26100.1_tr-tr_d23ee4defe370b74\msimsg.dll.mui Handle ID: 0xd9c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-comdlg32.resources_31bf3856ad364e35_10.0.26100.1_tt-ru_7752464e0e999d89\comdlg32.dll.mui Handle ID: 0x1134 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-mlang.resources_31bf3856ad364e35_10.0.26100.1_uk-ua_ad3f7a4ba97678a2\mlang.dll.mui Handle ID: 0x9d0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-font-fms.resources_31bf3856ad364e35_10.0.26100.1_ur-pk_2da57fd29ab18fe1\fms.dll.mui Handle ID: 0x1130 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-comctl32-v5.resources_31bf3856ad364e35_10.0.26100.1_ur-pk_8deaa58329e93ea2\comctl32.dll.mui Handle ID: 0xd80 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-comdlg32.resources_31bf3856ad364e35_10.0.26100.1_ug-cn_17e3bcc902beaf65\comdlg32.dll.mui Handle ID: 0xce0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-mlang.resources_31bf3856ad364e35_10.0.26100.1_ur-pk_b163848ba6d4e95a\mlang.dll.mui Handle ID: 0x78c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-comctl32-v5.resources_31bf3856ad364e35_10.0.26100.1_uz-..-uz_d181a1ad4a301652\comctl32.dll.mui Handle ID: 0x9cc Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-comctl32-v5.resources_31bf3856ad364e35_10.0.26100.1_vi-vn_32be45b21b5707bd\comctl32.dll.mui Handle ID: 0x9ec Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-font-fms.resources_31bf3856ad364e35_10.0.26100.1_uz-..-uz_713c7bfcbaf86791\fms.dll.mui Handle ID: 0x7b8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-comdlg32.resources_31bf3856ad364e35_10.0.26100.1_uk-ua_11f305b30695b1a0\comdlg32.dll.mui Handle ID: 0x9f0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-mlang.resources_31bf3856ad364e35_10.0.26100.1_uz-..-uz_f4fa80b5c71bc10a\mlang.dll.mui Handle ID: 0x894 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..er-engine.resources_31bf3856ad364e35_10.0.26100.1_uk-ua_6e1ec785f56831c0\msimsg.dll.mui Handle ID: 0x62c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-font-fms.resources_31bf3856ad364e35_10.0.26100.1_vi-vn_d27920018c1f58fc\fms.dll.mui Handle ID: 0xf68 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-comdlg32.resources_31bf3856ad364e35_10.0.26100.1_ur-pk_16170ff303f42258\comdlg32.dll.mui Handle ID: 0x850 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_networking-mpssvc-svc-tracing_31bf3856ad364e35_10.0.26100.1_none_d8ea1259e7ee745d\firewallapi.mof Handle ID: 0xd58 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-d..opinstallcomponents_31bf3856ad364e35_10.0.26100.1_none_efc13f29d08ec10e\drvinst.mof Handle ID: 0x9c0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-classpnp_31bf3856ad364e35_10.0.26100.1_none_1276d6fc149e6fc7\classlog.mof Handle ID: 0xe5c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-mlang.resources_31bf3856ad364e35_10.0.26100.1_vi-vn_563724ba9842b275\mlang.dll.mui Handle ID: 0xde4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-n..-domain-clients-svc_31bf3856ad364e35_10.0.26100.1_none_410220325491d8f1\ipsecsvc.mof Handle ID: 0xd48 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-comdlg32.resources_31bf3856ad364e35_10.0.26100.1_uz-..-uz_59ae0c1d243afa08\comdlg32.dll.mui Handle ID: 0xd18 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-lsa-mof_31bf3856ad364e35_10.0.26100.1_none_f7c2e21609d3f386\lsasrv.mof Handle ID: 0x7b4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_networking-mpssvc-svc-tracing_31bf3856ad364e35_10.0.26100.1_none_d8ea1259e7ee745d\mpsdrv.mof Handle ID: 0x11f8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-mountpointmanager_31bf3856ad364e35_10.0.26100.1_none_ef8bcd266f925e19\mountmgr.mof Handle ID: 0xde0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_networking-mpssvc-svc-tracing_31bf3856ad364e35_10.0.26100.1_none_d8ea1259e7ee745d\mpssvc.mof Handle ID: 0x9e8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-wsp-spaces_31bf3856ad364e35_10.0.26100.1_none_632caa9216178221\mispace_uninstall.mof Handle ID: 0x1190 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-wmi-mof_31bf3856ad364e35_10.0.26100.1_none_9f6a6df518bd9e17\ncprov.mof Handle ID: 0x5d8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-comdlg32.resources_31bf3856ad364e35_10.0.26100.1_vi-vn_baeab021f561eb73\comdlg32.dll.mui Handle ID: 0xed4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-ndis-minwin_31bf3856ad364e35_10.0.26100.1_none_564926959098a642\ndistrace.mof Handle ID: 0x9d8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-security-netlogon-mof_31bf3856ad364e35_10.0.26100.1_none_5bd9ed13aa8a5295\nlsvc.mof Handle ID: 0x880 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-n..-domain-clients-svc_31bf3856ad364e35_10.0.26100.1_none_410220325491d8f1\polstore.mof Handle ID: 0xdec Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\wow64_microsoft-windows-newdev_31bf3856ad364e35_10.0.26100.1_none_18be9e06ed967433\newdev.mof Handle ID: 0x7e4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-newdev_31bf3856ad364e35_10.0.26100.1_none_0e69f3b4b935b238\newdev.mof Handle ID: 0x9ac Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-refs-mof_31bf3856ad364e35_10.0.26100.1_none_ea4d514e964b1822\refs.mof Handle ID: 0x6cc Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-wmi-mof_31bf3856ad364e35_10.0.26100.1_none_9f6a6df518bd9e17\interop.mof Handle ID: 0x734 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-refs-v1-mof_31bf3856ad364e35_10.0.26100.1_none_373e897e4563a2c0\refsv1.mof Handle ID: 0xf64 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft.windows.h...sdhost-driverclass_31bf3856ad364e35_10.0.26100.1_none_bfe520d930bc2074\sdbus.mof Handle ID: 0x790 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-wmi-mof-admin_31bf3856ad364e35_10.0.26100.1_none_c440296130e6717d\scrcons.mof Handle ID: 0x7e8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-s..s-servicecontroller_31bf3856ad364e35_10.0.26100.1_none_cc5368c835d59b8f\services.mof Handle ID: 0xf8c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\wow64_microsoft-windows-setupapi_31bf3856ad364e35_10.0.26100.1_none_3c3dac63632b36d5\setupapi.mof Handle ID: 0xa08 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-setupapi_31bf3856ad364e35_10.0.26100.1_none_31e902112eca74da\setupapi.mof Handle ID: 0x704 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-wmi-mof-admin_31bf3856ad364e35_10.0.26100.1_none_c440296130e6717d\smtpcons.mof Handle ID: 0xf88 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-s..s-servicecontroller_31bf3856ad364e35_10.0.26100.1_none_cc5368c835d59b8f\scm.mof Handle ID: 0xfa0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-r..ase-rassstp-tracing_31bf3856ad364e35_10.0.26100.1_none_62cbb5e32ade3638\sstpsvc.mof Handle ID: 0x9e4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-wmi-mof-admin_31bf3856ad364e35_10.0.26100.1_none_c440296130e6717d\subscrpt.mof Handle ID: 0x6fc Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-smbserver-apis_31bf3856ad364e35_10.0.26100.1_none_cd1b7ac9ec1d0904\smbwmiv2.mof Handle ID: 0x89c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-classpnp_31bf3856ad364e35_10.0.26100.1_none_1276d6fc149e6fc7\stortrace.mof Handle ID: 0xed0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-d..ry-services-sam-mof_31bf3856ad364e35_10.0.26100.1_none_be21ed9138726f0e\samsrv.mof Handle ID: 0xf80 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-d..opinstallcomponents_31bf3856ad364e35_10.0.26100.1_none_efc13f29d08ec10e\umpnpmgr.mof Handle ID: 0xf78 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-wdf-kernellibrary-mof_31bf3856ad364e35_10.0.26100.1_none_7f51200383e38608\Wdf01000Uninstall.mof Handle ID: 0x88c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_networking-mpssvc-svc-tracing_31bf3856ad364e35_10.0.26100.1_none_d8ea1259e7ee745d\WFAPIGP.mof Handle ID: 0x784 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-network-security-mof_31bf3856ad364e35_10.0.26100.1_none_b34338b54b4620d9\WFP.MOF Handle ID: 0x814 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-n..-domain-clients-svc_31bf3856ad364e35_10.0.26100.1_none_410220325491d8f1\winipsec.mof Handle ID: 0x710 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-wdf-kernellibrary-mof_31bf3856ad364e35_10.0.26100.1_none_7f51200383e38608\Wdf01000.mof Handle ID: 0xde8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-wmi-mof_31bf3856ad364e35_10.0.26100.1_none_9f6a6df518bd9e17\secrcw32.mof Handle ID: 0xf7c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-wmi-mof_31bf3856ad364e35_10.0.26100.1_none_9f6a6df518bd9e17\wmi.mof Handle ID: 0x600 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-wmi-mof-admin_31bf3856ad364e35_10.0.26100.1_none_c440296130e6717d\WBEMCons.mof Handle ID: 0x7a8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-wmi-mof_31bf3856ad364e35_10.0.26100.1_none_9f6a6df518bd9e17\WMI_Tracing.mof Handle ID: 0xf48 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-wmi-mof_31bf3856ad364e35_10.0.26100.1_none_9f6a6df518bd9e17\wmipcima.mof Handle ID: 0x1208 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-wmi-mof_31bf3856ad364e35_10.0.26100.1_none_9f6a6df518bd9e17\system.mof Handle ID: 0xa14 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-storage-refsdedupsvc_31bf3856ad364e35_10.0.26100.1_none_d4cf850c696ef2f9\Microsoft.ReFsDedup.Commands.psd1 Handle ID: 0x1020 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-storage-refsdedupsvc_31bf3856ad364e35_10.0.26100.1_none_d4cf850c696ef2f9\Microsoft.ReFSDedup.Interop.dll Handle ID: 0xdb0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-storage-refsdedupsvc_31bf3856ad364e35_10.0.26100.1_none_d4cf850c696ef2f9\Microsoft.ReFsDedup.Commands.dll Handle ID: 0x1170 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-storage-refsdedupsvc_31bf3856ad364e35_10.0.26100.1_none_d4cf850c696ef2f9\Microsoft.ReFsDedup.Commands.format.ps1xml Handle ID: 0x76c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-smbserver-powershell_31bf3856ad364e35_10.0.26100.1_none_59ff6c5029b94f74\SmbBandwidthLimit.cdxml Handle ID: 0xfb4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-smbserver-powershell_31bf3856ad364e35_10.0.26100.1_none_59ff6c5029b94f74\SmbClientCertificateMapping.cdxml Handle ID: 0xda0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-smbserver-powershell_31bf3856ad364e35_10.0.26100.1_none_59ff6c5029b94f74\Smb.types.ps1xml Handle ID: 0xda4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-smbserver-powershell_31bf3856ad364e35_10.0.26100.1_none_59ff6c5029b94f74\SmbClientNetworkInterface.cdxml Handle ID: 0x6e8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-smbserver-powershell_31bf3856ad364e35_10.0.26100.1_none_59ff6c5029b94f74\SmbComponent.cdxml Handle ID: 0xa1c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-smbserver-powershell_31bf3856ad364e35_10.0.26100.1_none_59ff6c5029b94f74\SmbConnection.cdxml Handle ID: 0xfbc Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-smbserver-powershell_31bf3856ad364e35_10.0.26100.1_none_59ff6c5029b94f74\SmbClientConfiguration.cdxml Handle ID: 0xfb8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-smbserver-powershell_31bf3856ad364e35_10.0.26100.1_none_59ff6c5029b94f74\SmbGlobalMapping.cdxml Handle ID: 0x748 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-smbserver-powershell_31bf3856ad364e35_10.0.26100.1_none_59ff6c5029b94f74\SmbMultichannelConnection.cdxml Handle ID: 0xcd4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-smbserver-powershell_31bf3856ad364e35_10.0.26100.1_none_59ff6c5029b94f74\SmbMultichannelConstraint.cdxml Handle ID: 0x112c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-smbserver-powershell_31bf3856ad364e35_10.0.26100.1_none_59ff6c5029b94f74\SmbMapping.cdxml Handle ID: 0xd3c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-smbserver-powershell_31bf3856ad364e35_10.0.26100.1_none_59ff6c5029b94f74\SmbOpenFile.cdxml Handle ID: 0xcf4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-smbserver-powershell_31bf3856ad364e35_10.0.26100.1_none_59ff6c5029b94f74\Smb.format.ps1xml Handle ID: 0xd34 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-smbserver-powershell_31bf3856ad364e35_10.0.26100.1_none_59ff6c5029b94f74\SmbScriptModule.psm1 Handle ID: 0xc34 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-smbserver-powershell_31bf3856ad364e35_10.0.26100.1_none_59ff6c5029b94f74\SmbServerAlternativePort.cdxml Handle ID: 0x121c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-smbserver-powershell_31bf3856ad364e35_10.0.26100.1_none_59ff6c5029b94f74\SmbServerNetworkInterface.cdxml Handle ID: 0x83c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-smbserver-powershell_31bf3856ad364e35_10.0.26100.1_none_59ff6c5029b94f74\SmbSession.cdxml Handle ID: 0x1090 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-smbserver-powershell_31bf3856ad364e35_10.0.26100.1_none_59ff6c5029b94f74\SmbServerCertificateMapping.cdxml Handle ID: 0x10fc Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-smbserver-powershell_31bf3856ad364e35_10.0.26100.1_none_59ff6c5029b94f74\SmbShare.Format.Helper.psm1 Handle ID: 0x1218 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-smbserver-powershell_31bf3856ad364e35_10.0.26100.1_none_59ff6c5029b94f74\SmbServerConfiguration.cdxml Handle ID: 0xf38 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-smbserver-powershell_31bf3856ad364e35_10.0.26100.1_none_59ff6c5029b94f74\SmbShare.psd1 Handle ID: 0xa24 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-smbserver-powershell_31bf3856ad364e35_10.0.26100.1_none_59ff6c5029b94f74\SmbShare.cdxml Handle ID: 0x618 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-comctl32-v5.resources_31bf3856ad364e35_10.0.26100.1_zh-cn_bf43d699e59179bd\comctl32.dll.mui Handle ID: 0x9f4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-cdosys.resources_31bf3856ad364e35_10.0.26100.1_zh-cn_bcc4ddba119e7d9b\cdosys.dll.mui Handle ID: 0x1228 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-font-fms.resources_31bf3856ad364e35_10.0.26100.1_zh-cn_5efeb0e95659cafc\fms.dll.mui Handle ID: 0x1224 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-mlang.resources_31bf3856ad364e35_10.0.26100.1_zh-cn_e2bcb5a2627d2475\mlang.dll.mui Handle ID: 0x8ac Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-lsa-msprivs.resources_31bf3856ad364e35_10.0.26100.1_zh-cn_c3d8414b489f58e7\msprivs.dll.mui Handle ID: 0x122c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..er-engine.resources_31bf3856ad364e35_10.0.26100.1_zh-cn_a39c02dcae6edd93\msimsg.dll.mui Handle ID: 0xbc8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-comdlg32.resources_31bf3856ad364e35_10.0.26100.1_zh-cn_47704109bf9c5d73\comdlg32.dll.mui Handle ID: 0x8c0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-cdosys.resources_31bf3856ad364e35_10.0.26100.1_zh-tw_c0c11b100f0f5a0b\cdosys.dll.mui Handle ID: 0x7a4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-comctl32-v5.resources_31bf3856ad364e35_10.0.26100.1_zh-tw_c34013efe302562d\comctl32.dll.mui Handle ID: 0x9d4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-font-fms.resources_31bf3856ad364e35_10.0.26100.1_zh-tw_62faee3f53caa76c\fms.dll.mui Handle ID: 0x888 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-mlang.resources_31bf3856ad364e35_10.0.26100.1_zh-tw_e6b8f2f85fee00e5\mlang.dll.mui Handle ID: 0x74c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-lsa-msprivs.resources_31bf3856ad364e35_10.0.26100.1_zh-tw_c7d47ea146103557\msprivs.dll.mui Handle ID: 0x120c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-comdlg32.resources_31bf3856ad364e35_10.0.26100.1_zh-tw_4b6c7e5fbd0d39e3\comdlg32.dll.mui Handle ID: 0xa34 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..er-engine.resources_31bf3856ad364e35_10.0.26100.1_zh-tw_a7984032abdfba03\msimsg.dll.mui Handle ID: 0x10d0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-a..on-authui-component_31bf3856ad364e35_10.0.26100.1_none_d9caf3467864548e\authui.dll.mun Handle ID: 0x1210 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-comdlg32_31bf3856ad364e35_10.0.26100.1_none_b2a4ba020e342e2a\comdlg32.dll.mun Handle ID: 0x718 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-aclui_31bf3856ad364e35_10.0.26100.1_none_51fe067e1c335541\aclui.dll.mun Handle ID: 0xc04 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-wsp-spaces_31bf3856ad364e35_10.0.26100.1_none_632caa9216178221\mispace.mof Handle ID: 0xa10 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-cryptui-dll_31bf3856ad364e35_10.0.26100.1_none_82e203bf00afed9c\cryptui.dll.mun Handle ID: 0x9dc Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-t..icesframework-msctf_31bf3856ad364e35_10.0.26100.1_none_72b7587a5751b41e\msctf.dll.mun Handle ID: 0xa44 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-crypt32-dll_31bf3856ad364e35_10.0.26100.1_none_58636a3c4660615f\crypt32.dll.mun Handle ID: 0xa3c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-msxml30_31bf3856ad364e35_10.0.26100.1_none_8561e8faff62bcc1\msxml3.dll.mun Handle ID: 0x780 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-newdev_31bf3856ad364e35_10.0.26100.1_none_0e69f3b4b935b238\newdev.dll.mun Handle ID: 0x11f4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-ntshrui_31bf3856ad364e35_10.0.26100.1_none_590356d164eb5f92\ntshrui.dll.mun Handle ID: 0x1220 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-raschap_31bf3856ad364e35_10.0.26100.1_none_0fb2ab65dfd9116b\raschapext.dll.mun Handle ID: 0x1230 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-com-complus.res_31bf3856ad364e35_10.0.26100.1_none_29a483384ebe73a8\comres.dll.mun Handle ID: 0x99c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-p..randprintui-printui_31bf3856ad364e35_10.0.26100.1_none_d928f8cadc871c41\printui.dll.mun Handle ID: 0x1100 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-onecoreuap-rastls_31bf3856ad364e35_10.0.26100.1_none_2b23033e43740d4c\rastls.dll.mun Handle ID: 0x8bc Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-rastls_31bf3856ad364e35_10.0.26100.1_none_6958d44eb8b07ad2\rastlsext.dll.mun Handle ID: 0xa38 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-rasdlg_31bf3856ad364e35_10.0.26100.1_none_6a06e46eb82d8836\rasdlg.dll.mun Handle ID: 0x8a0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-propsys_31bf3856ad364e35_7.0.26100.1_none_79eb5ca32853cfdd\propsys.dll.mun Handle ID: 0x8c8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\wow64_microsoft-windows-system-counters_31bf3856ad364e35_10.0.26100.1_none_6e7a5ef54393e285\advapi32res.dll Handle ID: 0x8b8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\wow64_microsoft-windows-s..entication-usermode_31bf3856ad364e35_10.0.26100.1_none_416a15e61141c89e\authz.dll Handle ID: 0xf9c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\wow64_microsoft-windows-bcrypt-dll_31bf3856ad364e35_10.0.26100.1_none_f5d4e61f8c53050f\bcrypt.dll Handle ID: 0xf98 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\wow64_microsoft-windows-a..ence-inventory-core_31bf3856ad364e35_10.0.26100.1_none_661c2645964d2dac\aepic.dll Handle ID: 0x8a4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\wow64_microsoft-windows-browserservice-netapi_31bf3856ad364e35_10.0.26100.1_none_34d5b68c34a82d3b\browcli.dll Handle ID: 0x760 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-netshell_31bf3856ad364e35_10.0.26100.1_none_d2771333769763b2\netshell.dll.mun Handle ID: 0xa28 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\wow64_microsoft-windows-cabapi_31bf3856ad364e35_10.0.26100.1_none_64edc6f27885b7de\cabapi.dll Handle ID: 0x8b0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\wow64_microsoft-windows-cabinet_31bf3856ad364e35_10.0.26100.1_none_3e87a3cf7ed910c6\cabinet.dll Handle ID: 0xa30 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\wow64_microsoft-windows-bcrypt-primitives-dll_31bf3856ad364e35_10.0.26100.1_none_1979cc17b3f7a95c\bcryptprimitives.dll Handle ID: 0xff4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\wow64_microsoft-onecore-pnp-devicemanagement_31bf3856ad364e35_10.0.26100.1_none_4aa94869fae128fe\cfgmgr32.dll Handle ID: 0xff0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\wow64_microsoft-onecore-console-host-propsheet_31bf3856ad364e35_10.0.26100.1_none_2520b4ddba9ca283\console.dll Handle ID: 0x1214 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-wmi-mof_31bf3856ad364e35_10.0.26100.1_none_9f6a6df518bd9e17\cimwin32.mof Handle ID: 0x1204 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\wow64_microsoft-windows-com-coml2_31bf3856ad364e35_10.0.26100.1_none_2505a6b31ae5051b\coml2.dll Handle ID: 0x11fc Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\wow64_microsoft-windows-a..cation-creduibroker_31bf3856ad364e35_10.0.26100.1_none_d2037290aa25e1f8\CredentialUIBroker.exe Handle ID: 0x1250 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\wow64_microsoft-onecore-c..rivacysettingsstore_31bf3856ad364e35_10.0.26100.1_none_0f677af36bc2a7ef\CorePrivacySettingsStore.dll Handle ID: 0x1248 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\wow64_microsoft-windows-c..vcommoncore-library_31bf3856ad364e35_10.0.26100.1_none_6e5a474911698f11\CredProvCommonCore.dll Handle ID: 0x1240 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\wow64_microsoft-windows-c..ov2fahelper-library_31bf3856ad364e35_10.0.26100.1_none_b80f7456f25ced82\CredProv2faHelper.dll Handle ID: 0x1244 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\wow64_microsoft-windows-consolelogon-library_31bf3856ad364e35_10.0.26100.1_none_8c9d050bc3e4e9da\ConsoleLogon.dll Handle ID: 0xfec Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\wow64_microsoft-windows-credprovhost-library_31bf3856ad364e35_10.0.26100.1_none_bac5ef5ccb0e68bb\credprovhost.dll Handle ID: 0x8f8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\wow64_microsoft-windows-c..alproviders-library_31bf3856ad364e35_10.0.26100.1_none_936352cdf90b3e0d\credprovs.dll Handle ID: 0x798 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\wow64_microsoft-windows-credui-onecore_31bf3856ad364e35_10.0.26100.1_none_829e2f93c0b35c1e\credui.dll Handle ID: 0x1238 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\wow64_microsoft-windows-c..iderslegacy-library_31bf3856ad364e35_10.0.26100.1_none_63b576b8c2fb5942\credprovslegacy.dll Handle ID: 0x93c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\wow64_microsoft-windows-c..ovdatamodel-library_31bf3856ad364e35_10.0.26100.1_none_b594de61f3fc6244\CredProvDataModel.dll Handle ID: 0x890 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\wow64_microsoft-windows-cryptdll-dll_31bf3856ad364e35_10.0.26100.1_none_0ce6d8994ab2cda5\cryptdll.dll Handle ID: 0x8dc Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\wow64_microsoft-windows-cryptnet-dll_31bf3856ad364e35_10.0.26100.1_none_1e6193cc98c315c4\cryptnet.dll Handle ID: 0xa0c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\wow64_microsoft-windows-cryptsp-dll_31bf3856ad364e35_10.0.26100.1_none_30a5c0bfa3b9dee8\cryptsp.dll Handle ID: 0xa18 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\wow64_microsoft-windows-d..opactivitybrokerapi_31bf3856ad364e35_10.0.26100.1_none_84d03f97ea93d880\dabapi.dll Handle ID: 0x788 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\wow64_microsoft-windows-debugcore_31bf3856ad364e35_10.0.26100.1_none_03b8c1c6e85920a2\dbgcore.dll Handle ID: 0x7ec Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\wow64_microsoft-windows-crypt32-dll_31bf3856ad364e35_10.0.26100.1_none_62b8148e7ac1235a\crypt32.dll Handle ID: 0x71c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\wow64_microsoft-windows-s..authfactor-credprov_31bf3856ad364e35_10.0.26100.1_none_ef761892eb85eb48\devicengccredprov.dll Handle ID: 0x6e0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\wow64_microsoft-onecore-p..evicemanagement-rtl_31bf3856ad364e35_10.0.26100.1_none_300d627219b44a0d\devobj.dll Handle ID: 0x11e8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\wow64_microsoft-onecore-p..evicemanagement-rtl_31bf3856ad364e35_10.0.26100.1_none_300d627219b44a0d\devrtl.dll Handle ID: 0x9f8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\wow64_microsoft-windows-dfsclient-netapi_31bf3856ad364e35_10.0.26100.1_none_67e48e02cd64fc20\dfscli.dll Handle ID: 0xa74 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\wow64_microsoft-windows-com-base_31bf3856ad364e35_10.0.26100.1_none_15368929c372dac3\combase.dll Handle ID: 0x980 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\wow64_microsoft-windows-cryptoss-dll_31bf3856ad364e35_10.0.26100.1_none_c5d0dc1dd86a1d32\cryptoss.dll Handle ID: 0xf54 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\wow64_microsoft-windows-wer-sdktools_31bf3856ad364e35_10.0.26100.1_none_476a46f97dd5dcc6\DbgModel.dll Handle ID: 0xa70 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\wow64_microsoft-windows-dhcp-client-dll-minwin_31bf3856ad364e35_10.0.26100.1_none_743d0440f5f8149f\dhcpcsvc6.dll Handle ID: 0x11e4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\wow64_microsoft-windows-dhcp-client-dll-minwin_31bf3856ad364e35_10.0.26100.1_none_743d0440f5f8149f\dhcpcsvc.dll Handle ID: 0x868 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\wow64_microsoft-windows-telemetrypermission_31bf3856ad364e35_10.0.26100.1_none_f6855596b16080f8\DiagnosticDataSettings.dll Handle ID: 0x11ec Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\wow64_microsoft-windows-dhcp-client-dll-minwin_31bf3856ad364e35_10.0.26100.1_none_743d0440f5f8149f\dhcpcore.dll Handle ID: 0xa50 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\wow64_microsoft-windows-u..etry-client-wowonly_31bf3856ad364e35_10.0.26100.1_none_93803c74aeb28980\diagnosticdataquery.dll Handle ID: 0x7cc Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\wow64_microsoft-windows-dhcp-client-dll-minwin_31bf3856ad364e35_10.0.26100.1_none_743d0440f5f8149f\dhcpcore6.dll Handle ID: 0x808 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\wow64_microsoft-windows-com-surrogate-core_31bf3856ad364e35_10.0.26100.1_none_3c32e2b773856e68\dllhost.exe Handle ID: 0xa78 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\wow64_microsoft-windows-dpapi-dll_31bf3856ad364e35_10.0.26100.1_none_7f2caec0af6beb7d\dpapi.dll Handle ID: 0x730 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\wow64_microsoft-windows-driverquery_31bf3856ad364e35_10.0.26100.1_none_9d6b1e2831f6fc5c\driverquery.exe Handle ID: 0xf14 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\wow64_microsoft-onecore-pnp-drvsetup_31bf3856ad364e35_10.0.26100.1_none_6526083b0084055e\drvsetup.dll Handle ID: 0x738 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\wow64_microsoft-windows-d..oryservices-dsparse_31bf3856ad364e35_10.0.26100.1_none_5760197a1f34ebd6\dsparse.dll Handle ID: 0x8b4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\wow64_microsoft-windows-dssetupcli_31bf3856ad364e35_10.0.26100.1_none_008273fb558df09e\dsrole.dll Handle ID: 0x104c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\x86_microsoft-windows-difxapi_31bf3856ad364e35_10.0.26100.1_none_a918aa6b466145ac\difxapi.dll Handle ID: 0x1050 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\wow64_microsoft-windows-d..ellman_software_csp_31bf3856ad364e35_10.0.26100.1_none_43410e3621d209d6\dssenh.dll Handle ID: 0x107c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\wow64_microsoft-windows-u..etry-client-wowonly_31bf3856ad364e35_10.0.26100.1_none_93803c74aeb28980\dtdump.exe Handle ID: 0xa5c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\wow64_microsoft-windows-debughelp_31bf3856ad364e35_10.0.26100.1_none_ff94eac8eaf8e298\dbghelp.dll Handle ID: 0x7c4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\wow64_microsoft-windows-vss-eventcls_31bf3856ad364e35_10.0.26100.1_none_e9a8462d9c1aa32b\eventcls.dll Handle ID: 0xaa0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\wow64_microsoft-windows-expand_31bf3856ad364e35_10.0.26100.1_none_5fbacf2ef4cdcd88\expand.exe Handle ID: 0xa7c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\wow64_microsoft-windows-dns-client-minwin_31bf3856ad364e35_10.0.26100.1_none_9cd40672c012f666\dnsapi.dll Handle ID: 0xa6c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\wow64_microsoft-windows-f..eatureconfiguration_31bf3856ad364e35_10.0.26100.1_none_5f2e20a25d9c54ad\fcon.dll Handle ID: 0x1254 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\wow64_microsoft-windows-filtermanager-utils_31bf3856ad364e35_10.0.26100.1_none_20d605b4c2450a61\fltLib.dll Handle ID: 0xac0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\wow64_microsoft-windows-errorreportingfaults_31bf3856ad364e35_10.0.26100.1_none_774f6f54d9b6adb9\Faultrep.dll Handle ID: 0xabc Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\wow64_microsoft-windows-filtermanager-utils_31bf3856ad364e35_10.0.26100.1_none_20d605b4c2450a61\fltMC.exe Handle ID: 0x5d4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\wow64_microsoft-windows-s..ertificates-utility_31bf3856ad364e35_10.0.26100.1_none_9045fee4c79737fe\fvecerts.dll Handle ID: 0xb6c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\wow64_microsoft-windows-s..-gmsaclient-library_31bf3856ad364e35_10.0.26100.1_none_330658c3f97d6e8c\gmsaclient.dll Handle ID: 0x8cc Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\wow64_microsoft-windows-http-api_31bf3856ad364e35_10.0.26100.1_none_fcf48fb23a393653\httpapi.dll Handle ID: 0xa54 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\wow64_microsoft-windows-coreos_31bf3856ad364e35_10.0.26100.1_none_2c9a98f9db3ea3b7\imagehlp.dll Handle ID: 0x764 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\wow64_microsoft-windows-infdefaultinstall_31bf3856ad364e35_10.0.26100.1_none_73dcd67238fcc679\InfDefaultInstall.exe Handle ID: 0x70c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\wow64_microsoft-windows-drvstore_31bf3856ad364e35_10.0.26100.1_none_f83ca7dde0728a09\drvstore.dll Handle ID: 0xa40 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\wow64_microsoft-windows-t..rm-libraries-minwin_31bf3856ad364e35_10.0.26100.1_none_a6fb3d6a0deadfe9\IPHLPAPI.DLL Handle ID: 0xae4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\wow64_microsoft-windows-security-kerberos_31bf3856ad364e35_10.0.26100.1_none_ee1f2fde4dbaec78\kerb3961.dll Handle ID: 0xb60 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\wow64_microsoft-windows-s..ty-kerbclientshared_31bf3856ad364e35_10.0.26100.1_none_e941056258dca99f\KerbClientShared.dll Handle ID: 0xae0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\wow64_microsoft-windows-securestartup-core_31bf3856ad364e35_10.0.26100.1_none_3c22f89b8f0c5552\fveapibase.dll Handle ID: 0x7c8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\wow64_microsoft-windows-flighting-settings_31bf3856ad364e35_10.0.26100.1_none_901ea6ad8c047b20\FlightSettings.dll Handle ID: 0xa2c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\wow64_microsoft-windows-s..ty-cng-keyisolation_31bf3856ad364e35_10.0.26100.1_none_cb84ef1e93073443\keyiso.dll Handle ID: 0x8c4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\wow64_microsoft-windows-s..-credential-manager_31bf3856ad364e35_10.0.26100.1_none_58df163724454d85\KeyCredMgr.dll Handle ID: 0x1010 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\wow64_microsoft-windows-mpr_31bf3856ad364e35_10.0.26100.1_none_b51e1c24f4deae21\mpr.dll Handle ID: 0xaf0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\wow64_microsoft-windows-msasn1_31bf3856ad364e35_10.0.26100.1_none_cea2687d424ebfab\msasn1.dll Handle ID: 0x1004 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\wow64_microsoft-windows-s..ity-netlogon-netapi_31bf3856ad364e35_10.0.26100.1_none_da7e3d92f2e748e1\logoncli.dll Handle ID: 0xad4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\wow64_microsoft-windows-securestartup-core_31bf3856ad364e35_10.0.26100.1_none_3c22f89b8f0c5552\fveapi.dll Handle ID: 0x1064 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\wow64_microsoft-windows-security-ntlm_31bf3856ad364e35_10.0.26100.1_none_83fb3f85ff781f98\msv1_0.dll Handle ID: 0xb40 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\wow64_microsoft-windows-msvcp110_31bf3856ad364e35_10.0.26100.1_none_f4fe9db80e0369e3\msvcp110_win.dll Handle ID: 0x1060 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\wow64_microsoft-windows-security-kerberos_31bf3856ad364e35_10.0.26100.1_none_ee1f2fde4dbaec78\kerberos.dll Handle ID: 0x1260 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\wow64_microsoft-windows-international-unattend_31bf3856ad364e35_10.0.26100.1_none_c76215078a870f12\MuiUnattend.exe Handle ID: 0x758 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\wow64_microsoft-windows-msvcp60_31bf3856ad364e35_10.0.26100.1_none_49e9e7434e4cdf1f\msvcp60.dll Handle ID: 0x1268 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\wow64_microsoft-windows-ncrypt-dll_31bf3856ad364e35_10.0.26100.1_none_6526a8448e896b23\ncrypt.dll Handle ID: 0x125c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\wow64_microsoft-windows-w..-infrastructure-bsp_31bf3856ad364e35_10.0.26100.1_none_bf9ba9b8ca391b0e\mswsock.dll Handle ID: 0xb4c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\wow64_microsoft-windows-newdev_31bf3856ad364e35_10.0.26100.1_none_18be9e06ed967433\ndadmin.exe Handle ID: 0xad0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\wow64_microsoft-windows-ncryptsslp-dll_31bf3856ad364e35_10.0.26100.1_none_c3ba316b415e6f85\ncryptsslp.dll Handle ID: 0xa60 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\wow64_microsoft-windows-ucrt_31bf3856ad364e35_10.0.26100.1_none_b30987f9b66d4608\msvcp_win.dll Handle ID: 0x73c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\wow64_microsoft-windows-basic-misc-tools_31bf3856ad364e35_10.0.26100.1_none_1ea50a235c58ebf7\netmsg.dll Handle ID: 0xa4c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\wow64_microsoft-windows-n..ork-setup-servicing_31bf3856ad364e35_10.0.26100.1_none_8d90df89ab131677\NetDriverInstall.dll Handle ID: 0xfe0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\wow64_microsoft-windows-n..ork-setup-servicing_31bf3856ad364e35_10.0.26100.1_none_8d90df89ab131677\NetSetupApi.dll Handle ID: 0xaf4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\wow64_microsoft-windows-ncryptprov-dll_31bf3856ad364e35_10.0.26100.1_none_25be23ac3101c480\ncryptprov.dll Handle ID: 0xffc Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\wow64_microsoft-windows-netutils_31bf3856ad364e35_10.0.26100.1_none_37616051e706407a\netutils.dll Handle ID: 0x1264 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\wow64_microsoft-windows-newdev_31bf3856ad364e35_10.0.26100.1_none_18be9e06ed967433\newdev.exe Handle ID: 0x1110 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\wow64_microsoft-windows-security-ngc-local_31bf3856ad364e35_10.0.26100.1_none_105e96dd683a03b5\ngclocal.dll Handle ID: 0xc9c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\wow64_microsoft-windows-i..ional-normalization_31bf3856ad364e35_10.0.26100.1_none_fd3553676ade41b2\normaliz.dll Handle ID: 0x1270 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\wow64_microsoft-windows-newdev_31bf3856ad364e35_10.0.26100.1_none_18be9e06ed967433\newdev.dll Handle ID: 0xa68 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\wow64_microsoft-windows-t..rm-libraries-minwin_31bf3856ad364e35_10.0.26100.1_none_a6fb3d6a0deadfe9\nrtapi.dll Handle ID: 0x103c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\wow64_microsoft-windows-usermodensi_31bf3856ad364e35_10.0.26100.1_none_79aa759264613d22\nsi.dll Handle ID: 0x744 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\wow64_microsoft-windows-ntasn1-dll_31bf3856ad364e35_10.0.26100.1_none_c17c42b961c21742\ntasn1.dll Handle ID: 0xce8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\wow64_microsoft-windows-ntlanman_31bf3856ad364e35_10.0.26100.1_none_375968777f8d7ccf\ntlanman.dll Handle ID: 0xe68 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\wow64_microsoft-windows-n..ork-setup-servicing_31bf3856ad364e35_10.0.26100.1_none_8d90df89ab131677\NetSetupEngine.dll Handle ID: 0x7f8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\wow64_microsoft-windows-security-ntlmshared_31bf3856ad364e35_10.0.26100.1_none_c4a0462b0e935dbb\NtlmShared.dll Handle ID: 0xac8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\wow64_microsoft-windows-security-netlogon_31bf3856ad364e35_10.0.26100.1_none_050009f5d4e744d7\netlogon.dll Handle ID: 0x100c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\wow64_microsoft-windows-lsa_31bf3856ad364e35_10.0.26100.1_none_ad92dd74f9b894b6\offlinelsa.dll Handle ID: 0xad8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\wow64_microsoft-windows-security-ntmarta_31bf3856ad364e35_10.0.26100.1_none_82ced45a2c8efad2\ntmarta.dll Handle ID: 0x830 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\wow64_microsoft-windows-directory-services-sam_31bf3856ad364e35_10.0.26100.1_none_b936ac103de1eae4\offlinesam.dll Handle ID: 0x810 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\wow64_microsoft-windows-onecorecommonproxystub_31bf3856ad364e35_10.0.26100.1_none_3deb54c9aeedb6f6\OneCoreCommonProxyStub.dll Handle ID: 0x924 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\wow64_microsoft-windows-onesettings-client_31bf3856ad364e35_10.0.26100.1_none_f893cb566ac72349\OneSettingsClient.dll Handle ID: 0x1028 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\wow64_microsoft-windows-pcwum_31bf3856ad364e35_10.0.26100.1_none_693f920ec633388c\pcwum.dll Handle ID: 0x90c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\wow64_microsoft-windows-kernelbase_31bf3856ad364e35_10.0.26100.1_none_2e4acb0651816d1a\KernelBase.dll Handle ID: 0x910 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\wow64_microsoft-windows-ole-automation_31bf3856ad364e35_10.0.26100.1_none_c4487d4098678fa8\oleaut32.dll Handle ID: 0xb10 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\wow64_microsoft-windows-r..eak-diagnostic-core_31bf3856ad364e35_10.0.26100.1_none_6259f5b61a4fa510\rdrleakdiag.exe Handle ID: 0xbbc Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\wow64_microsoft-windows-packagemanager_31bf3856ad364e35_10.0.26100.1_none_f42016ce9031a227\PkgMgr.exe Handle ID: 0xb1c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\wow64_microsoft-windows-userpowermanagement_31bf3856ad364e35_10.0.26100.1_none_aa61f11399c5bbf1\powrprof.dll Handle ID: 0x914 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\wow64_microsoft-windows-d..services-sam-netapi_31bf3856ad364e35_10.0.26100.1_none_8e0a933c63187162\samcli.dll Handle ID: 0xb78 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\wow64_microsoft-windows-rsaenh-dll_31bf3856ad364e35_10.0.26100.1_none_670f627a4e31d554\rsaenh.dll Handle ID: 0xb7c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\wow64_microsoft-windows-d..ory-services-samlib_31bf3856ad364e35_10.0.26100.1_none_3bba156c38ad088d\samlib.dll Handle ID: 0xb58 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\wow64_microsoft-windows-taskscheduler-netapi_31bf3856ad364e35_10.0.26100.1_none_1109104ad4f4e346\schedcli.dll Handle ID: 0xb44 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_11.0.26100.1_none_32ce16b675398a42\wininet.dll.mun Handle ID: 0xaec Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\x86_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.1_none_aa346e257779a3b3\poqexec.exe Handle ID: 0xb18 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\wow64_microsoft-windows-spinf_31bf3856ad364e35_10.0.26100.1_none_64e8e970155a869a\spinf.dll Handle ID: 0xaf8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\wow64_microsoft-windows-spfileq_31bf3856ad364e35_10.0.26100.1_none_7c2f28e05caba748\spfileq.dll Handle ID: 0x6f4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\wow64_microsoft-windows-smbserver_31bf3856ad364e35_10.0.26100.1_none_003d3bab87c8da11\sscore.dll Handle ID: 0x918 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\wow64_microsoft-windows-smbserver-netapi_31bf3856ad364e35_10.0.26100.1_none_47eec5efed78e83b\srvcli.dll Handle ID: 0x123c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\wow64_microsoft-windows-ole-automation-stdole2_31bf3856ad364e35_10.0.26100.1_none_f01f15f6b5e2a654\stdole2.tlb Handle ID: 0xb24 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\wow64_microsoft-windows-packagemanager_31bf3856ad364e35_10.0.26100.1_none_f42016ce9031a227\SSShim.dll Handle ID: 0xb3c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\wow64_microsoft-windows-services-svchost_31bf3856ad364e35_10.0.26100.1_none_bd03ac53a23b1a65\svchost.exe Handle ID: 0x75c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\wow64_microsoft-windows-wer-sdktools_31bf3856ad364e35_10.0.26100.1_none_476a46f97dd5dcc6\dbgeng.dll Handle ID: 0x724 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\wow64_microsoft-windows-security-tokenbinding_31bf3856ad364e35_10.0.26100.1_none_846822b50705800d\tokenbinding.dll Handle ID: 0xf58 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\wow64_microsoft-windows-syssetup_31bf3856ad364e35_10.0.26100.1_none_7818de8034a427da\syssetup.dll Handle ID: 0xb38 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\wow64_microsoft-windows-i..rnational-timezones_31bf3856ad364e35_10.0.26100.1_none_1c8fa928a67f6d63\tzres.dll Handle ID: 0x770 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\wow64_microsoft-windows-security-schannel_31bf3856ad364e35_10.0.26100.1_none_295e9dc0f2303341\schannel.dll Handle ID: 0xb5c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\wow64_microsoft-windows-pdc-dll_31bf3856ad364e35_10.0.26100.1_none_a324e2670554307e\umpdc.dll Handle ID: 0x106c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\wow64_microsoft-windows-s..stedsignal-credprov_31bf3856ad364e35_10.0.26100.1_none_d5ab89f077aac140\TrustedSignalCredProv.dll Handle ID: 0xf34 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\wow64_microsoft-windows-u..etry-client-wowonly_31bf3856ad364e35_10.0.26100.1_none_93803c74aeb28980\utcapi.dll Handle ID: 0xf50 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\wow64_microsoft-windows-userinit_31bf3856ad364e35_10.0.26100.1_none_e3710cc86e9d548b\userinit.exe Handle ID: 0x994 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\wow64_microsoft-windows-userenv_31bf3856ad364e35_10.0.26100.1_none_9788bd25e8303622\userenv.dll Handle ID: 0xe30 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\wow64_microsoft-windows-ntdll_31bf3856ad364e35_10.0.26100.1_none_601f30f4991b0896\ntdll.dll Handle ID: 0xb30 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\wow64_microsoft-windows-vssapi-core_31bf3856ad364e35_10.0.26100.1_none_e1820dcab8b63016\vsstrace.dll Handle ID: 0xac4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\wow64_microsoft-windows-servicingcommon_31bf3856ad364e35_10.0.26100.1_none_42a575b2b8cbfdbb\ServicingCommon.dll Handle ID: 0xa80 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\wow64_microsoft-windows-security-digest_31bf3856ad364e35_10.0.26100.1_none_42159dca19a27049\wdigest.dll Handle ID: 0xab8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\wow64_microsoft-windows-w..-protocol-component_31bf3856ad364e35_10.0.26100.1_none_e8c15dd307a517a6\Websocket.dll Handle ID: 0x1054 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\wow64_microsoft-windows-errorreportingcore_31bf3856ad364e35_10.0.26100.1_none_27bf04c8a2d19869\werdiagcontroller.dll Handle ID: 0xb80 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\wow64_microsoft-windows-pantherengine_31bf3856ad364e35_10.0.26100.1_none_b559c24342c41454\wdscore.dll Handle ID: 0x1074 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\wow64_microsoft-windows-errorreportingfaults_31bf3856ad364e35_10.0.26100.1_none_774f6f54d9b6adb9\WerEnc.dll Handle ID: 0x1070 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\wow64_microsoft-windows-errorreportingcore_31bf3856ad364e35_10.0.26100.1_none_27bf04c8a2d19869\weretw.dll Handle ID: 0x1030 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\wow64_microsoft-windows-errorreportingfaults_31bf3856ad364e35_10.0.26100.1_none_774f6f54d9b6adb9\WerFaultSecure.exe Handle ID: 0xa98 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\wow64_microsoft-windows-webio_31bf3856ad364e35_10.0.26100.1_none_64328cd07ba096fc\webio.dll Handle ID: 0xb68 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\wow64_microsoft-windows-win32k_31bf3856ad364e35_10.0.26100.1_none_c03bcc6d37742640\win32u.dll Handle ID: 0xf30 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\wow64_microsoft-windows-errorreportingfaults_31bf3856ad364e35_10.0.26100.1_none_774f6f54d9b6adb9\WerFault.exe Handle ID: 0x80c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\wow64_microsoft-windows-errorreportingcore_31bf3856ad364e35_10.0.26100.1_none_27bf04c8a2d19869\wermgr.exe Handle ID: 0xb54 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\wow64_microsoft-windows-ucrt_31bf3856ad364e35_10.0.26100.1_none_b30987f9b66d4608\ucrtbase.dll Handle ID: 0x6ac Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\wow64_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.26100.1_none_cead2d631e07aa5b\ucrtbase.dll Handle ID: 0xb20 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\wow64_microsoft-windows-i..-ui-logon-proxystub_31bf3856ad364e35_10.0.26100.1_none_03722bfd5f748f41\Windows.Internal.UI.Logon.ProxyStub.dll Handle ID: 0x91c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\wow64_microsoft-windows-wincredui_31bf3856ad364e35_10.0.26100.1_none_f83d075a9895be58\wincredui.dll Handle ID: 0x818 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\wow64_microsoft-windows-errorreportingcore_31bf3856ad364e35_10.0.26100.1_none_27bf04c8a2d19869\wer.dll Handle ID: 0x1040 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\wow64_microsoft.windows.winhttpcom_31bf3856ad364e35_5.1.26100.1_none_44e56c9b5c778c96\winhttpcom.dll Handle ID: 0x690 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\wow64_microsoft-windows-com-base_31bf3856ad364e35_10.0.26100.1_none_15368929c372dac3\wincorlib.dll Handle ID: 0x820 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\wow64_microsoft-windows-i..nal-core-locale-nls_31bf3856ad364e35_10.0.26100.1_none_7200838c46331e51\winnlsres.dll Handle ID: 0xaa4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\wow64_microsoft-windows-usermodensi_31bf3856ad364e35_10.0.26100.1_none_79aa759264613d22\winnsi.dll Handle ID: 0x109c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\wow64_microsoft-windows-creddialogcontroller_31bf3856ad364e35_10.0.26100.1_none_344d1c4200364fcc\Windows.UI.CredDialogController.dll Handle ID: 0x8a8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\wow64_microsoft-windows-vssapi-core_31bf3856ad364e35_10.0.26100.1_none_e1820dcab8b63016\vssapi.dll Handle ID: 0xfa8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\wow64_microsoft-windows-t..nalservices-runtime_31bf3856ad364e35_10.0.26100.1_none_e428421768ee427b\winsta.dll Handle ID: 0x8e4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\wow64_microsoft-windows-w..ationservice-netapi_31bf3856ad364e35_10.0.26100.1_none_7cc3a96d521e9c5c\wkscli.dll Handle ID: 0xf90 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\wow64_microsoft-windows-wintrust-dll_31bf3856ad364e35_10.0.26100.1_none_f6f68c7836fe4183\wintrust.dll Handle ID: 0xf94 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\wow64_microsoft.windows.winhttp_31bf3856ad364e35_5.1.26100.1_none_93bc5db8fea17f59\winhttp.dll Handle ID: 0xfc0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\wow64_microsoft-windows-wmistub_31bf3856ad364e35_10.0.26100.1_none_a50a9a5d50743d03\wmi.dll Handle ID: 0xfc4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\wow64_microsoft-windows-winsqlite3_31bf3856ad364e35_10.0.26100.1_none_1da5681dc65dc7a5\winsqlite3.dll Handle ID: 0xa04 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\wow64_microsoft-windows-ldap-client_31bf3856ad364e35_10.0.26100.1_none_fa849a49f359105b\Wldap32.dll Handle ID: 0xb70 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\wow64_microsoft-windows-wininit_31bf3856ad364e35_10.0.26100.1_none_383b0b81a13e0322\wmsgapi.dll Handle ID: 0x84c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\wow64_microsoft-windows-wmi-wmiclnt_31bf3856ad364e35_10.0.26100.1_none_fd3e07a82ce9c8ec\wmiclnt.dll Handle ID: 0xbd4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\wow64_microsoft-windows-ci-wldp-dll_31bf3856ad364e35_10.0.26100.1_none_9c4cc0472760d23b\wldp.dll Handle ID: 0xb98 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\wow64_microsoft-windows-winsock-helper-tcpip_31bf3856ad364e35_10.0.26100.1_none_d2fb5874ce74e1da\wship6.dll Handle ID: 0x828 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\wow64_microsoft-windows-setupapi_31bf3856ad364e35_10.0.26100.1_none_3c3dac63632b36d5\wowreg32.exe Handle ID: 0xf70 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\wow64_microsoft-windows-winsock-helper-tcpip_31bf3856ad364e35_10.0.26100.1_none_d2fb5874ce74e1da\WSHTCPIP.DLL Handle ID: 0xf6c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\wow64_microsoft-windows-wofutil_31bf3856ad364e35_10.0.26100.1_none_926f5126a944b432\WofUtil.dll Handle ID: 0x10dc Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\wow64_microsoft-windows-coresystem-wpr_31bf3856ad364e35_10.0.26100.1_none_6977c0db34decfe4\windowsperformancerecordercontrol.dll Handle ID: 0x938 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\wow64_microsoft-windows-d..ing-management-host_31bf3856ad364e35_10.0.26100.1_none_34b3c72fc640281d\DismHost.exe Handle ID: 0xba0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\wow64_microsoft-windows-d..ing-management-core_31bf3856ad364e35_10.0.26100.1_none_327c78b7c7ac77b4\DismCorePS.dll Handle ID: 0x10d8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\wow64_microsoft-windows-d..ing-management-core_31bf3856ad364e35_10.0.26100.1_none_327c78b7c7ac77b4\DismProv.dll Handle ID: 0x10e0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\wow64_microsoft-windows-d..ing-management-core_31bf3856ad364e35_10.0.26100.1_none_327c78b7c7ac77b4\FolderProvider.dll Handle ID: 0x728 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\wow64_microsoft-windows-com-base_31bf3856ad364e35_10.0.26100.1_none_15368929c372dac3\WinTypes.dll Handle ID: 0xfa4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\wow64_microsoft-windows-d..ing-management-core_31bf3856ad364e35_10.0.26100.1_none_327c78b7c7ac77b4\DismCore.dll Handle ID: 0xb9c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\wow64_microsoft-windows-d..-winproviders-image_31bf3856ad364e35_10.0.26100.1_none_a627c7e4c6afa4e7\DmiProvider.dll Handle ID: 0x79c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\wow64_microsoft-windows-d..-winproviders-image_31bf3856ad364e35_10.0.26100.1_none_a627c7e4c6afa4e7\GenericProvider.dll Handle ID: 0xc28 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\wow64_microsoft-windows-d..ing-management-core_31bf3856ad364e35_10.0.26100.1_none_327c78b7c7ac77b4\LogProvider.dll Handle ID: 0x9fc Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\wow64_microsoft-windows-d..-winproviders-local_31bf3856ad364e35_10.0.26100.1_none_2b753f3d226c5431\ImagingProvider.dll Handle ID: 0x898 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\wow64_microsoft-windows-d..-winproviders-image_31bf3856ad364e35_10.0.26100.1_none_a627c7e4c6afa4e7\OfflineSetupProvider.dll Handle ID: 0xc08 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\wow64_microsoft-windows-d..-winproviders-image_31bf3856ad364e35_10.0.26100.1_none_a627c7e4c6afa4e7\OSProvider.dll Handle ID: 0xbf0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\wow64_microsoft-windows-d..-winproviders-image_31bf3856ad364e35_10.0.26100.1_none_a627c7e4c6afa4e7\IntlProvider.dll Handle ID: 0xbb8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\wow64_microsoft-windows-d..-winproviders-local_31bf3856ad364e35_10.0.26100.1_none_2b753f3d226c5431\FfuProvider.dll Handle ID: 0x92c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\x86_microsoft-windows-d..-winproviders-winpe_31bf3856ad364e35_10.0.26100.1_none_bf84beb67a83c698\PEProvider.dll Handle ID: 0xbe4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\wow64_microsoft-windows-d..-winproviders-image_31bf3856ad364e35_10.0.26100.1_none_a627c7e4c6afa4e7\UnattendProvider.dll Handle ID: 0x1068 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\wow64_microsoft-windows-d..-winproviders-image_31bf3856ad364e35_10.0.26100.1_none_a627c7e4c6afa4e7\SmiProvider.dll Handle ID: 0x1098 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\wow64_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.26100.1_none_42db6a68329f6fe9\api-ms-win-base-util-l1-1-0.dll Handle ID: 0xb8c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\wow64_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.26100.1_none_cead2d631e07aa5b\api-ms-win-core-comm-l1-1-0.dll Handle ID: 0x1274 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\wow64_microsoft-windows-c..namespace-downlevel_31bf3856ad364e35_10.0.26100.1_none_df41fc6f2ed13bb3\api-ms-win-core-com-l1-1-0.dll Handle ID: 0x1278 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\wow64_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.26100.1_none_cead2d631e07aa5b\api-ms-win-core-console-l1-1-0.dll Handle ID: 0x10a4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\wow64_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.26100.1_none_cead2d631e07aa5b\api-ms-win-core-datetime-l1-1-0.dll Handle ID: 0xc48 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\wow64_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.26100.1_none_cead2d631e07aa5b\api-ms-win-core-datetime-l1-1-1.dll Handle ID: 0xba4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\wow64_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.26100.1_none_cead2d631e07aa5b\api-ms-win-core-debug-l1-1-0.dll Handle ID: 0x10b0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\wow64_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.26100.1_none_cead2d631e07aa5b\api-ms-win-core-debug-l1-1-1.dll Handle ID: 0x10c0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\wow64_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.26100.1_none_cead2d631e07aa5b\api-ms-win-core-delayload-l1-1-0.dll Handle ID: 0x127c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\wow64_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.26100.1_none_cead2d631e07aa5b\api-ms-win-core-errorhandling-l1-1-0.dll Handle ID: 0x10bc Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\wow64_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.26100.1_none_cead2d631e07aa5b\api-ms-win-core-errorhandling-l1-1-1.dll Handle ID: 0xc10 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\wow64_microsoft-windows-d..-winproviders-image_31bf3856ad364e35_10.0.26100.1_none_a627c7e4c6afa4e7\CbsProvider.dll Handle ID: 0xc40 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\wow64_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.26100.1_none_cead2d631e07aa5b\api-ms-win-core-fibers-l1-1-0.dll Handle ID: 0x10e4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\wow64_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.26100.1_none_cead2d631e07aa5b\api-ms-win-core-fibers-l1-1-1.dll Handle ID: 0x10e8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\wow64_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.26100.1_none_cead2d631e07aa5b\api-ms-win-core-file-l1-2-0.dll Handle ID: 0xc0c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\wow64_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.26100.1_none_cead2d631e07aa5b\api-ms-win-core-file-l1-2-1.dll Handle ID: 0xc98 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\wow64_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.26100.1_none_cead2d631e07aa5b\api-ms-win-core-file-l1-1-0.dll Handle ID: 0x10cc Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\wow64_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.26100.1_none_42db6a68329f6fe9\API-MS-Win-core-file-l2-1-1.dll Handle ID: 0xba8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\wow64_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.26100.1_none_42db6a68329f6fe9\API-MS-Win-core-file-l2-1-0.dll Handle ID: 0xacc Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\wow64_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.26100.1_none_cead2d631e07aa5b\api-ms-win-core-handle-l1-1-0.dll Handle ID: 0xf74 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\wow64_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.26100.1_none_cead2d631e07aa5b\api-ms-win-core-heap-l1-1-0.dll Handle ID: 0xa20 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\wow64_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.26100.1_none_42db6a68329f6fe9\API-MS-Win-Core-Heap-Obsolete-L1-1-0.dll Handle ID: 0x10f4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\wow64_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.26100.1_none_cead2d631e07aa5b\api-ms-win-core-interlocked-l1-1-0.dll Handle ID: 0xfcc Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\wow64_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.26100.1_none_cead2d631e07aa5b\api-ms-win-core-io-l1-1-0.dll Handle ID: 0xb28 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\wow64_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.26100.1_none_cead2d631e07aa5b\api-ms-win-core-io-l1-1-1.dll Handle ID: 0xc68 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\wow64_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.26100.1_none_42db6a68329f6fe9\api-ms-win-core-kernel32-legacy-l1-1-0.dll Handle ID: 0x1114 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\wow64_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.26100.1_none_42db6a68329f6fe9\api-ms-win-core-kernel32-legacy-l1-1-1.dll Handle ID: 0xb2c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\wow64_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.26100.1_none_42db6a68329f6fe9\API-MS-Win-Core-Kernel32-Private-L1-1-0.dll Handle ID: 0xc64 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\wow64_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.26100.1_none_42db6a68329f6fe9\API-MS-Win-Core-Kernel32-Private-L1-1-1.dll Handle ID: 0xbb4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\wow64_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.26100.1_none_cead2d631e07aa5b\api-ms-win-core-libraryloader-l1-1-0.dll Handle ID: 0xc5c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\wow64_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.26100.1_none_cead2d631e07aa5b\api-ms-win-core-libraryloader-l1-1-1.dll Handle ID: 0xc20 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\wow64_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.26100.1_none_cead2d631e07aa5b\api-ms-win-core-localization-l1-2-0.dll Handle ID: 0xbec Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\wow64_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.26100.1_none_cead2d631e07aa5b\api-ms-win-core-localization-l1-2-1.dll Handle ID: 0xce4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\wow64_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.26100.1_none_cead2d631e07aa5b\API-MS-Win-core-localization-obsolete-l1-2-0.dll Handle ID: 0x5f8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\wow64_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.26100.1_none_cead2d631e07aa5b\api-ms-win-core-memory-l1-1-0.dll Handle ID: 0xcf0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\wow64_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.26100.1_none_cead2d631e07aa5b\api-ms-win-core-memory-l1-1-1.dll Handle ID: 0xc50 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\wow64_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.26100.1_none_cead2d631e07aa5b\api-ms-win-core-memory-l1-1-2.dll Handle ID: 0x1124 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\wow64_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.26100.1_none_cead2d631e07aa5b\api-ms-win-core-namedpipe-l1-1-0.dll Handle ID: 0xd10 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\wow64_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.26100.1_none_42db6a68329f6fe9\api-ms-win-core-privateprofile-l1-1-0.dll Handle ID: 0xc7c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\wow64_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.26100.1_none_42db6a68329f6fe9\api-ms-win-core-privateprofile-l1-1-1.dll Handle ID: 0xcc4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\wow64_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.26100.1_none_cead2d631e07aa5b\api-ms-win-core-processenvironment-l1-1-0.dll Handle ID: 0xd4c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\wow64_microsoft-windows-setupapi_31bf3856ad364e35_10.0.26100.1_none_3c3dac63632b36d5\setupapi.dll Handle ID: 0xd1c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\wow64_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.26100.1_none_cead2d631e07aa5b\api-ms-win-core-processenvironment-l1-2-0.dll Handle ID: 0xd24 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\wow64_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.26100.1_none_cead2d631e07aa5b\api-ms-win-core-processthreads-l1-1-0.dll Handle ID: 0xd0c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\wow64_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.26100.1_none_cead2d631e07aa5b\api-ms-win-core-processthreads-l1-1-1.dll Handle ID: 0x1120 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\wow64_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.26100.1_none_cead2d631e07aa5b\api-ms-win-core-processthreads-l1-1-2.dll Handle ID: 0xcc0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\wow64_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.26100.1_none_cead2d631e07aa5b\api-ms-win-core-profile-l1-1-0.dll Handle ID: 0x1128 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\wow64_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.26100.1_none_42db6a68329f6fe9\api-ms-win-core-processtopology-obsolete-l1-1-0.dll Handle ID: 0xd30 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\wow64_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.26100.1_none_cead2d631e07aa5b\api-ms-win-core-realtime-l1-1-0.dll Handle ID: 0xfd4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\wow64_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.26100.1_none_cead2d631e07aa5b\api-ms-win-core-registry-l1-1-0.dll Handle ID: 0xfd0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\wow64_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.26100.1_none_cead2d631e07aa5b\api-ms-win-core-rtlsupport-l1-1-0.dll Handle ID: 0xcfc Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\wow64_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.26100.1_none_42db6a68329f6fe9\api-ms-win-core-registry-l2-1-0.dll Handle ID: 0x5c8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\wow64_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.26100.1_none_42db6a68329f6fe9\api-ms-win-core-shlwapi-obsolete-l1-1-0.dll Handle ID: 0xc14 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\wow64_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.26100.1_none_42db6a68329f6fe9\api-ms-win-core-shlwapi-legacy-l1-1-0.dll Handle ID: 0x1280 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\wow64_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.26100.1_none_42db6a68329f6fe9\api-ms-win-core-shutdown-l1-1-0.dll Handle ID: 0xd60 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\wow64_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.26100.1_none_cead2d631e07aa5b\api-ms-win-core-string-l1-1-0.dll Handle ID: 0x944 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\wow64_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.26100.1_none_42db6a68329f6fe9\API-MS-Win-core-string-l2-1-0.dll Handle ID: 0x1284 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\wow64_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.26100.1_none_42db6a68329f6fe9\API-MS-Win-core-string-obsolete-l1-1-0.dll Handle ID: 0x1288 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\wow64_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.26100.1_none_42db6a68329f6fe9\api-ms-win-core-stringansi-l1-1-0.dll Handle ID: 0xd50 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\wow64_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.26100.1_none_cead2d631e07aa5b\api-ms-win-core-stringloader-l1-1-1.dll Handle ID: 0x934 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\wow64_microsoft-windows-d..-winproviders-local_31bf3856ad364e35_10.0.26100.1_none_2b753f3d226c5431\VhdProvider.dll Handle ID: 0x128c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\wow64_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.26100.1_none_cead2d631e07aa5b\api-ms-win-core-synch-l1-2-0.dll Handle ID: 0x1290 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\wow64_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.26100.1_none_cead2d631e07aa5b\api-ms-win-core-synch-l1-1-0.dll Handle ID: 0x1294 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\wow64_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.26100.1_none_cead2d631e07aa5b\api-ms-win-core-sysinfo-l1-2-0.dll Handle ID: 0xbe0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\wow64_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.26100.1_none_cead2d631e07aa5b\api-ms-win-core-sysinfo-l1-1-0.dll Handle ID: 0x1298 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\wow64_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.26100.1_none_cead2d631e07aa5b\api-ms-win-core-sysinfo-l1-2-1.dll Handle ID: 0x6ec Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\wow64_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.26100.1_none_cead2d631e07aa5b\api-ms-win-core-threadpool-legacy-l1-1-0.dll Handle ID: 0xcdc Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\wow64_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.26100.1_none_cead2d631e07aa5b\api-ms-win-core-threadpool-private-l1-1-0.dll Handle ID: 0xd88 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\wow64_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.26100.1_none_cead2d631e07aa5b\api-ms-win-core-threadpool-l1-2-0.dll Handle ID: 0xc70 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\wow64_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.26100.1_none_cead2d631e07aa5b\api-ms-win-core-timezone-l1-1-0.dll Handle ID: 0xd84 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\wow64_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.26100.1_none_42db6a68329f6fe9\api-ms-win-core-url-l1-1-0.dll Handle ID: 0xd78 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\wow64_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.26100.1_none_cead2d631e07aa5b\api-ms-win-core-util-l1-1-0.dll Handle ID: 0x129c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\wow64_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.26100.1_none_42db6a68329f6fe9\api-ms-win-core-version-l1-1-0.dll Handle ID: 0xdbc Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\wow64_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.26100.1_none_cead2d631e07aa5b\api-ms-win-core-wow64-l1-1-0.dll Handle ID: 0xbb0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\wow64_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.26100.1_none_cead2d631e07aa5b\api-ms-win-core-xstate-l1-1-0.dll Handle ID: 0xc6c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\wow64_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.26100.1_none_42db6a68329f6fe9\API-MS-Win-core-xstate-l2-1-0.dll Handle ID: 0xb74 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\wow64_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.26100.1_none_cead2d631e07aa5b\api-ms-win-crt-conio-l1-1-0.dll Handle ID: 0xbac Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\wow64_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.26100.1_none_cead2d631e07aa5b\api-ms-win-crt-environment-l1-1-0.dll Handle ID: 0xb84 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\wow64_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.26100.1_none_cead2d631e07aa5b\api-ms-win-crt-convert-l1-1-0.dll Handle ID: 0xdc8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\wow64_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.26100.1_none_cead2d631e07aa5b\api-ms-win-crt-filesystem-l1-1-0.dll Handle ID: 0xccc Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\wow64_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.26100.1_none_cead2d631e07aa5b\api-ms-win-crt-heap-l1-1-0.dll Handle ID: 0xcd0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\wow64_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.26100.1_none_cead2d631e07aa5b\api-ms-win-crt-locale-l1-1-0.dll Handle ID: 0x12a0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\wow64_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.26100.1_none_cead2d631e07aa5b\api-ms-win-crt-process-l1-1-0.dll Handle ID: 0xdd0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\wow64_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.26100.1_none_cead2d631e07aa5b\api-ms-win-crt-math-l1-1-0.dll Handle ID: 0x114c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\wow64_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.26100.1_none_cead2d631e07aa5b\api-ms-win-crt-multibyte-l1-1-0.dll Handle ID: 0xdc4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\wow64_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.26100.1_none_cead2d631e07aa5b\api-ms-win-crt-runtime-l1-1-0.dll Handle ID: 0xd14 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\wow64_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.26100.1_none_cead2d631e07aa5b\api-ms-win-crt-stdio-l1-1-0.dll Handle ID: 0x1148 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\wow64_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.26100.1_none_cead2d631e07aa5b\api-ms-win-crt-utility-l1-1-0.dll Handle ID: 0xdcc Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\wow64_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.26100.1_none_cead2d631e07aa5b\api-ms-win-crt-time-l1-1-0.dll Handle ID: 0xcec Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\wow64_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.26100.1_none_cead2d631e07aa5b\api-ms-win-crt-string-l1-1-0.dll Handle ID: 0xd20 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\wow64_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.26100.1_none_cead2d631e07aa5b\api-ms-win-crt-private-l1-1-0.dll Handle ID: 0x115c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\wow64_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.26100.1_none_42db6a68329f6fe9\API-MS-Win-Eventing-ClassicProvider-L1-1-0.dll Handle ID: 0xbfc Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\wow64_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.26100.1_none_42db6a68329f6fe9\API-MS-Win-devices-config-L1-1-0.dll Handle ID: 0xb88 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\wow64_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.26100.1_none_42db6a68329f6fe9\API-MS-Win-devices-config-L1-1-1.dll Handle ID: 0xc58 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\wow64_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.26100.1_none_788ac20876c38616\api-ms-win-eventing-consumer-l1-1-0.dll Handle ID: 0xc38 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\wow64_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.26100.1_none_788ac20876c38616\API-MS-Win-Eventing-Controller-L1-1-0.dll Handle ID: 0xc54 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\wow64_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.26100.1_none_42db6a68329f6fe9\API-MS-Win-Eventing-Legacy-L1-1-0.dll Handle ID: 0xe04 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\wow64_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.26100.1_none_42db6a68329f6fe9\API-MS-Win-Eventing-Provider-L1-1-0.dll Handle ID: 0xcc8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\wow64_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.26100.1_none_42db6a68329f6fe9\API-MS-Win-EventLog-Legacy-L1-1-0.dll Handle ID: 0xbdc Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\wow64_microsoft-windows-d..-winproviders-image_31bf3856ad364e35_10.0.26100.1_none_a627c7e4c6afa4e7\ProvProvider.dll Handle ID: 0xd44 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\wow64_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.26100.1_none_42db6a68329f6fe9\API-MS-Win-Security-Lsalookup-L2-1-0.dll Handle ID: 0xd38 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\wow64_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.26100.1_none_42db6a68329f6fe9\API-MS-Win-Security-Lsalookup-L2-1-1.dll Handle ID: 0xd70 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\wow64_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.26100.1_none_788ac20876c38616\api-ms-win-security-cryptoapi-l1-1-0.dll Handle ID: 0xb08 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\wow64_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.26100.1_none_788ac20876c38616\API-MS-Win-security-lsapolicy-l1-1-0.dll Handle ID: 0xb14 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\wow64_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.26100.1_none_cead2d631e07aa5b\api-ms-win-security-base-l1-1-0.dll Handle ID: 0xd40 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\wow64_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.26100.1_none_42db6a68329f6fe9\API-MS-Win-security-provider-L1-1-0.dll Handle ID: 0x948 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\wow64_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.26100.1_none_788ac20876c38616\api-ms-win-security-sddl-l1-1-0.dll Handle ID: 0xab0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\wow64_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.26100.1_none_cead2d631e07aa5b\api-ms-win-service-core-l1-1-0.dll Handle ID: 0xd5c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\wow64_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.26100.1_none_cead2d631e07aa5b\api-ms-win-service-core-l1-1-1.dll Handle ID: 0x1164 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\wow64_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.26100.1_none_cead2d631e07aa5b\api-ms-win-service-management-l1-1-0.dll Handle ID: 0x1138 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\wow64_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.26100.1_none_cead2d631e07aa5b\api-ms-win-service-management-l2-1-0.dll Handle ID: 0xe0c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\wow64_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.26100.1_none_cead2d631e07aa5b\api-ms-win-service-private-l1-1-0.dll Handle ID: 0xe20 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\wow64_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.26100.1_none_cead2d631e07aa5b\api-ms-win-service-private-l1-1-1.dll Handle ID: 0xd7c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\wow64_microsoft-windows-o..namespace-downlevel_31bf3856ad364e35_10.0.26100.1_none_4865757b1f196c21\api-ms-win-shcore-stream-l1-1-0.dll Handle ID: 0xe1c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\wow64_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.26100.1_none_cead2d631e07aa5b\api-ms-win-service-winsvc-l1-1-0.dll Handle ID: 0xe2c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-trustedinstaller_31bf3856ad364e35_10.0.26100.1_none_8e00dbe4b5b35080\20bbcadaff3e0543ef358ba4dd8b74bfe8e747c8.xml Handle ID: 0x1150 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\wow64_microsoft-windows-d..-winproviders-local_31bf3856ad364e35_10.0.26100.1_none_2b753f3d226c5431\WimProvider.dll Handle ID: 0x1178 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-shell32_31bf3856ad364e35_10.0.26100.1_none_691cd33e7a888844\shell32.dll.mun Handle ID: 0xe10 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-autofstx_31bf3856ad364e35_10.0.26100.1_none_ac035a0e50e062b5\fstx.dll Handle ID: 0x714 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_appcompat_programs_99c7f419bd54f4ca.cdf-ms Handle ID: 0xdec Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_apppatch_1143992cbbbebcab.cdf-ms Handle ID: 0x9ac Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_apppatch_apppatch64_e39bab3b20714e20.cdf-ms Handle ID: 0x6cc Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_boot_efi_qps-plocm_422982dcd6c994d6.cdf-ms Handle ID: 0x9a0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_boot_efi_qps-ploc_24e8203102ababf9.cdf-ms Handle ID: 0x7e4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_boot_misc_pcat_6b00b12988eafd38.cdf-ms Handle ID: 0xbd8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_boot_pcat_cs-cz_da8bfa0c28cad1cc.cdf-ms Handle ID: 0x5d8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_boot_pcat_da-dk_da67f50e291bdec5.cdf-ms Handle ID: 0x880 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_boot_pcat_de-de_da67f5ee291bdcbb.cdf-ms Handle ID: 0x9d8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_boot_pcat_el-gr_da43f0fe296cebfd.cdf-ms Handle ID: 0xed4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_boot_pcat_es-es_da43ed1c296cf1c1.cdf-ms Handle ID: 0xca0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_boot_pcat_fi-fi_da1fe77a29be0007.cdf-ms Handle ID: 0x958 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_boot_pcat_fr-fr_da1fe64829be028f.cdf-ms Handle ID: 0xd3c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_boot_pcat_hu-hu_d9d7d7f62a602593.cdf-ms Handle ID: 0x7c0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_boot_pcat_it-it_d9b3d1222ab13661.cdf-ms Handle ID: 0x122c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_boot_pcat_ja-jp_d98fca962b0246de.cdf-ms Handle ID: 0x1228 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_boot_pcat_ko-kr_d96bc3742b535818.cdf-ms Handle ID: 0x1224 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_boot_pcat_nb-no_d8ffaee42c468adc.cdf-ms Handle ID: 0x8ac Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_boot_pcat_nl-nl_d8ffaf642c46898f.cdf-ms Handle ID: 0x720 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_boot_pcat_pl-pl_d8b7a1782ce8abbb.cdf-ms Handle ID: 0x870 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_boot_pcat_pt-br_d8b7861c2ce8d537.cdf-ms Handle ID: 0xe90 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_boot_pcat_pt-pt_d8b7a0682ce8adfb.cdf-ms Handle ID: 0xdf0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_boot_pcat_qps-plocm_a218927645e9595a.cdf-ms Handle ID: 0x9c0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_boot_pcat_qps-ploc_109d95b40d3e11cb.cdf-ms Handle ID: 0xe98 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_boot_pcat_ru-ru_d86f925a2d8ad06f.cdf-ms Handle ID: 0x8c8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_boot_pcat_sv-se_d84b8da62ddbdc6c.cdf-ms Handle ID: 0xf2c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_boot_pcat_tr-tr_d82784d42e2cf1c3.cdf-ms Handle ID: 0xf04 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_boot_pcat_zh-cn_d74f2fe2301398dc.cdf-ms Handle ID: 0xf98 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_boot_pcat_zh-tw_d74f4ee430136b4c.cdf-ms Handle ID: 0x8c0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_boot_pxe_0f8921d4be2465c5.cdf-ms Handle ID: 0x7a4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_boot_pxe_en-us_0b07b16f9ae2fba9.cdf-ms Handle ID: 0x1244 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_boot_pxe_ex_8bdcca8988c90d0b.cdf-ms Handle ID: 0x6e8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_boot_pxe_ex_en-us_12844c689b98a581.cdf-ms Handle ID: 0x1100 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_boot_resources_0adab7ac98c3dc03.cdf-ms Handle ID: 0x8b0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_branding_1728f5d8b15e5263.cdf-ms Handle ID: 0x8dc Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_branding_shellbrd_be1f632087fb0947.cdf-ms Handle ID: 0xa18 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_diagtrack_0600d0deecd2b5a2.cdf-ms Handle ID: 0x9f8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_diagtrack_scenarios_ce5f6e43b7ab3f41.cdf-ms Handle ID: 0x780 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_diagtrack_settings_56f8a3f40ce5a801.cdf-ms Handle ID: 0x99c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_globalization_sorting_04883de290c6ef1b.cdf-ms Handle ID: 0x980 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_inf_lsm_0000_b44cadf303cf745f.cdf-ms Handle ID: 0x1204 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_inf_remoteaccess_0000_86bc982ae65d5d49.cdf-ms Handle ID: 0xff4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_microsoft.net_framework_v2.0.50727_e9368840261e60ee.cdf-ms Handle ID: 0x120c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_rescache_fbd63394dc9300f8.cdf-ms Handle ID: 0xa78 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_rescache_merged_98aae8e844b93807.cdf-ms Handle ID: 0xddc Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_resources_fbee56ab048ab239.cdf-ms Handle ID: 0x8b8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_resources_themes_aero_vscache_f7bbc75044896c89.cdf-ms Handle ID: 0xa70 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_schemas_eaphost_52e2de002c0b1796.cdf-ms Handle ID: 0x8b4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_security_fe3ad40cd6e08c7c.cdf-ms Handle ID: 0x808 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_schemas_eapmethods_2935fdc1307d3ad6.cdf-ms Handle ID: 0x104c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_servicestate_5273c861cc221018.cdf-ms Handle ID: 0xaa0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_system32_af-za_3b02d2e090436def.cdf-ms Handle ID: 0x7c4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_system32_am-et_3b02f5f6904339f6.cdf-ms Handle ID: 0x1050 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_system32_ar-sa_3b02d130904371b4.cdf-ms Handle ID: 0x107c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_system32_as-in_3b02e9ba90434cf6.cdf-ms Handle ID: 0x730 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_system32_az-latn-az_d54681d79b13c6b3.cdf-ms Handle ID: 0xa5c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_system32_be-by_3ce9782e8d6975c7.cdf-ms Handle ID: 0x738 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_system32_bg-bg_3ce955ba8d69a9ab.cdf-ms Handle ID: 0x74c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_system32_bn-in_3ce962088d6997fa.cdf-ms Handle ID: 0xf9c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_system32_bs-latn-ba_40af39211ce53ee1.cdf-ms Handle ID: 0x11f4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_system32_catroot2_dcafaffaaa56ddae.cdf-ms Handle ID: 0xae4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_system32_ca-es-valencia_d9502d6b71863d29.cdf-ms Handle ID: 0x8c4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_system32_ca-es_3ecfe4f48a8fd235.cdf-ms Handle ID: 0x1010 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_system32_catroot_127d0a1d-4ef2-11d1-8608-00c04fc295ee__43d274f6525c55b6.cdf-ms Handle ID: 0xaf0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_system32_chr-cher-us_6d8240fe66f8158d.cdf-ms Handle ID: 0x1004 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_system32_config_1277fa612e559336.cdf-ms Handle ID: 0xa40 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_system32_config_regback_2cc4cf1020372405.cdf-ms Handle ID: 0x5d4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_system32_config_systemprofile_9dec82772012c8ca.cdf-ms Handle ID: 0xb6c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_system32_config_systemprofile_appdata_92209b51227f4d2f.cdf-ms Handle ID: 0xa7c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_system32_config_systemprofile_appdata_locallow_ecfb9e22d0b5fdec.cdf-ms Handle ID: 0xb40 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_system32_config_systemprofile_appdata_local_bceee85fd37df118.cdf-ms Handle ID: 0x1270 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_system32_config_systemprofile_appdata_roaming_3488f27ae602299c.cdf-ms Handle ID: 0x788 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_system32_cy-gb_3ecfc14e8a900a38.cdf-ms Handle ID: 0x7ec Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_system32_cs-cz_3ecfefb68a8fc3f6.cdf-ms Handle ID: 0x1028 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_system32_da-dk_40b64d5e87b63595.cdf-ms Handle ID: 0xb50 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_system32_de-de_40b6416a87b647ef.cdf-ms Handle ID: 0x1060 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_system32_driverstate_a5318eeab3dff807.cdf-ms Handle ID: 0xad8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_system32_driverstate_devices_144618422831c928.cdf-ms Handle ID: 0x830 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_system32_drivers_driverdata_4e302c7c62b76407.cdf-ms Handle ID: 0x100c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_system32_drivers_etc_a531967eb3dfecbd.cdf-ms Handle ID: 0xa84 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_system32_el-gr_429cd0b684dc71bd.cdf-ms Handle ID: 0xc9c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_system32_en-gb_429cb20e84dc9fef.cdf-ms Handle ID: 0x760 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_system32_es-es_429cd1a084dc7119.cdf-ms Handle ID: 0xabc Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_system32_es-mx_429cdb1e84dc62e4.cdf-ms Handle ID: 0xf54 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_system32_eu-es_429cd15884dc71bb.cdf-ms Handle ID: 0x1230 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_system32_et-ee_429cb6e884dc9948.cdf-ms Handle ID: 0x798 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_system32_fa-ir_448349dc8202badd.cdf-ms Handle ID: 0x1238 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_system32_fi-fi_448337a68202d703.cdf-ms Handle ID: 0xaf8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_system32_fil-ph_1903a37923e1edc2.cdf-ms Handle ID: 0xce8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_system32_fr-ca_448327328202f0a1.cdf-ms Handle ID: 0x6f4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_system32_ga-ie_4669a8c87f292c7b.cdf-ms Handle ID: 0xb5c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_system32_fr-fr_448347788202c03b.cdf-ms Handle ID: 0xaec Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_system32_gd-gb_4669a2aa7f2935f7.cdf-ms Handle ID: 0x93c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_system32_grouppolicyusers_dc4bf95b336ab265.cdf-ms Handle ID: 0x724 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_system32_gl-es_4669c1d07f290814.cdf-ms Handle ID: 0xf58 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_system32_grouppolicy_8e35dabe44804e33.cdf-ms Handle ID: 0xb38 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_system32_gu-in_4669b70e7f29192e.cdf-ms Handle ID: 0xb7c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_system32_he-il_48502d1c7c4f6669.cdf-ms Handle ID: 0x7f8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_system32_hi-in_485030587c4f61fb.cdf-ms Handle ID: 0x1030 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_system32_hr-hr_485036ac7c4f596f.cdf-ms Handle ID: 0x994 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_system32_hy-am_48502c327c4f69dc.cdf-ms Handle ID: 0xb58 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_system32_hu-hu_48503bf27c4f51d7.cdf-ms Handle ID: 0xf30 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_system32_id-id_4a3695aa7975c979.cdf-ms Handle ID: 0x6ac Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_system32_is-is_4a36b0087975a381.cdf-ms Handle ID: 0xfa8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_system32_it-it_4a36b1ca7975a0f9.cdf-ms Handle ID: 0x8e4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_system32_ka-ge_4e03873073c25edd.cdf-ms Handle ID: 0x910 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_system32_ja-jp_4c1d2478769bf2f4.cdf-ms Handle ID: 0xb10 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_system32_kk-kz_4e03ada673c2263e.cdf-ms Handle ID: 0x10d0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_system32_km-kh_4e038b3273c25a22.cdf-ms Handle ID: 0xaa4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_system32_kn-in_4e03967273c2495b.cdf-ms Handle ID: 0xa04 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_system32_ko-kr_4e039de673c23e4a.cdf-ms Handle ID: 0xfa4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_system32_kok-in_21abb62f1787fa37.cdf-ms Handle ID: 0x10d8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_system32_lb-lu_4fea1d0670e87e3c.cdf-ms Handle ID: 0x10e0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_system32_lo-la_4fe9f53a70e8bb4d.cdf-ms Handle ID: 0x91c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_system32_logfiles_firewall_488be49cc4415d55.cdf-ms Handle ID: 0x898 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_system32_logfiles_sam_5b4992809d2e7248.cdf-ms Handle ID: 0xc08 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_system32_logfiles_scm_5b4992849d2e7236.cdf-ms Handle ID: 0xbf0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_system32_logfiles_unionfs_0bc21fe620de5f63.cdf-ms Handle ID: 0xbb8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_system32_logfiles_wmi_5b4992089d2e731c.cdf-ms Handle ID: 0x10e4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_system32_logfiles_wmi_rtbackup_03b1b65215e9856c.cdf-ms Handle ID: 0xba4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_system32_lt-lt_4fea189870e886c7.cdf-ms Handle ID: 0x10b0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_system32_lv-lv_4fea1c1c70e881b7.cdf-ms Handle ID: 0x9fc Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_system32_mi-nz_51d09d226e0ebed1.cdf-ms Handle ID: 0xb9c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_system32_mk-mk_51d080606e0eea29.cdf-ms Handle ID: 0x10bc Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_system32_ml-in_51d085ee6e0ee1eb.cdf-ms Handle ID: 0xc98 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_system32_mr-in_51d085166e0ee3d1.cdf-ms Handle ID: 0xcf0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_system32_ms-my_51d099d46e0ec4d3.cdf-ms Handle ID: 0xc50 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_system32_mt-mt_51d090326e0ed361.cdf-ms Handle ID: 0x1124 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_system32_nb-no_53b700d66b352886.cdf-ms Handle ID: 0x10cc Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_system32_ne-np_53b702506b3526a0.cdf-ms Handle ID: 0xcb4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_system32_networklist_icons_stockicons_c7f9dde8d52dc62c.cdf-ms Handle ID: 0x1294 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_system32_oobe_06655c95df2fa06f.cdf-ms Handle ID: 0xcc4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_system32_nn-no_53b6ff266b352c52.cdf-ms Handle ID: 0xba8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_system32_nl-nl_53b6f9bc6b35343b.cdf-ms Handle ID: 0x128c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_system32_or-in_559d744a685b7d03.cdf-ms Handle ID: 0xc58 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_system32_pa-in_5783ee486581c43b.cdf-ms Handle ID: 0xc38 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_system32_pl-pl_5783e8f06581cd6f.cdf-ms Handle ID: 0xd14 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_system32_pt-br_5783f3346581bed3.cdf-ms Handle ID: 0x1148 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_system32_pt-pt_5783f7006581b92f.cdf-ms Handle ID: 0xbdc Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_system32_qps-plocm_6b5ca6a155c9c794.cdf-ms Handle ID: 0xb88 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_system32_rastoast_f92eb3787fa05917.cdf-ms Handle ID: 0xd44 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_system32_quz-pe_2c3a5d4f08542618.cdf-ms Handle ID: 0xc54 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_system32_qps-ploc_f52bb74c87132e9b.cdf-ms Handle ID: 0x10e8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_system32_ras_06656461d047b86c.cdf-ms Handle ID: 0xc0c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_system32_ras_sstpproxy_454ca701ebc80170.cdf-ms Handle ID: 0x818 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_system32_ro-ro_5b50dd6a5fce5f0b.cdf-ms Handle ID: 0xc90 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_system32_ru-ru_5b50e7f65fce4fdb.cdf-ms Handle ID: 0x778 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_system32_smi_06656483d047b9b9.cdf-ms Handle ID: 0x11ac Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_system32_sk-sk_5d374dfc5cf4b5c5.cdf-ms Handle ID: 0xca4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_system32_sl-si_5d374a0c5cf4bbc8.cdf-ms Handle ID: 0xe48 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_system32_smi_manifests_0e3cdef1f9ad7c5f.cdf-ms Handle ID: 0xc3c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_system32_smi_schema_b445cd341d59fadc.cdf-ms Handle ID: 0x1040 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_system32_smi_store_500af0907ede5ff6.cdf-ms Handle ID: 0xb54 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_system32_smi_store_machine_f7f45ee58c75b061.cdf-ms Handle ID: 0x11b4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_system32_spp_tokens_ppdlic_0f09ba294211a24b.cdf-ms Handle ID: 0xf24 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_system32_sq-al_5d374f0a5cf4b4c0.cdf-ms Handle ID: 0xefc Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_system32_sr-cyrl-ba_64b50c96d951cf7c.cdf-ms Handle ID: 0xa98 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_system32_sr-cyrl-rs_64b5286ed951a79e.cdf-ms Handle ID: 0x1074 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_system32_sr-latn-rs_36d1e04b1e65a349.cdf-ms Handle ID: 0x96c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_system32_ta-in_5f1dccb05a1af69f.cdf-ms Handle ID: 0x974 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_system32_sv-se_5d37410c5cf4ca56.cdf-ms Handle ID: 0x858 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_system32_te-in_5f1dcc205a1af7e3.cdf-ms Handle ID: 0xeec Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_system32_th-th_5f1dc0505a1b09f7.cdf-ms Handle ID: 0x9b0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_system32_tr-tr_5f1dd1e45a1af0a7.cdf-ms Handle ID: 0xe78 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_system32_tt-ru_5f1dd74e5a1ae8bc.cdf-ms Handle ID: 0x6c4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_system32_ug-cn_6104437257414518.cdf-ms Handle ID: 0x111c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_system32_uk-ua_61042a3457416b73.cdf-ms Handle ID: 0x10a8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_system32_ur-pk_61043c345741512b.cdf-ms Handle ID: 0xef0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_system32_uz-latn-uz_87a351ab8f888ecb.cdf-ms Handle ID: 0xf44 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_system32_vi-vn_62eabac454679266.cdf-ms Handle ID: 0x11dc Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_system32_wbem_autorecover_78e2d7bf652dcf48.cdf-ms Handle ID: 0xf84 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_system32_wbem_logs_1fef5bbcc5e77768.cdf-ms Handle ID: 0xf1c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_system32_wbem_repository_3ba7d111b51b3c3b.cdf-ms Handle ID: 0x7d8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_system32_wbem_tmf_026f0fb07227ea72.cdf-ms Handle ID: 0x1154 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_system32_windowspowershell_v1.0_modules_microsoft.refsdedup.commands_985f6be6167c457c.cdf-ms Handle ID: 0x7f0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_system32_winevt_39519e6af36cf6a7.cdf-ms Handle ID: 0x98c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_system32_zh-cn_6a8499504900c466.cdf-ms Handle ID: 0x124c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_systemtemp_64d28130e78475a3.cdf-ms Handle ID: 0x7ac Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_system32_zh-tw_6a84aa664900aad6.cdf-ms Handle ID: 0x1070 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_syswow64_config_397022e597c7bf30.cdf-ms Handle ID: 0xa80 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_syswow64_config_regback_520dcf8c985ef2ff.cdf-ms Handle ID: 0xab8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_syswow64_driverstore_9d5a0097549f0abb.cdf-ms Handle ID: 0x1150 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_syswow64_drivers_193c6528ad70a5e7.cdf-ms Handle ID: 0x1054 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_syswow64_logfiles_lsa_5371ea7113e5392b.cdf-ms Handle ID: 0x770 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_syswow64_logfiles_sam_5371e95113e53c10.cdf-ms Handle ID: 0xd00 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_syswow64_migration_bdcfa47e8790e0c4.cdf-ms Handle ID: 0x740 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_syswow64_oobe_1bf24c07bb30ce37.cdf-ms Handle ID: 0xf34 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_syswow64_smi_1bf253f5a7664eed.cdf-ms Handle ID: 0xb18 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_syswow64_smi_manifests_3a5de332226f42b3.cdf-ms Handle ID: 0x95c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_syswow64_smi_store_7b60732feba1c4a2.cdf-ms Handle ID: 0xe5c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_syswow64_smi_store_machine_d77e364e5a797f0d.cdf-ms Handle ID: 0x1084 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_syswow64_wbem_1bf25d11bb30b33f.cdf-ms Handle ID: 0xea4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_syswow64_wbem_autorecover_e1421be265f17780.cdf-ms Handle ID: 0xf18 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_syswow64_wbem_logs_4b44de5c32aadc14.cdf-ms Handle ID: 0xd68 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_syswow64_wbem_repository_a407152b7f5ece07.cdf-ms Handle ID: 0xee0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_syswow64_wbem_xml_3f8ffc24c43a2ff4.cdf-ms Handle ID: 0x784 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_temp_401038c9a18c18c0.cdf-ms Handle ID: 0x7e0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_tracing_bca9e27848ac4cc0.cdf-ms Handle ID: 0x76c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_vss_3f582555a4c8be22.cdf-ms Handle ID: 0x9b8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_vss_writers_08335f148b847d02.cdf-ms Handle ID: 0x1170 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_vss_writers_application_85e0c568acb2deec.cdf-ms Handle ID: 0xd34 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_vss_writers_system_e29eb58bafd8a559.cdf-ms Handle ID: 0x10fc Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_winsxs_installtemp_a7200a27e5239119.cdf-ms Handle ID: 0xcf4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\programdata_microsoft_crypto_dss_machinekeys_43de8c451bf80cb4.cdf-ms Handle ID: 0x860 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\programdata_microsoft_crypto_keys_584b284368b25bef.cdf-ms Handle ID: 0xfb0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\programdata_microsoft_crypto_rsa_machinekeys_aa739417efae0d58.cdf-ms Handle ID: 0xf48 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\programdata_microsoft_network_connections_2e5c3accd04dd407.cdf-ms Handle ID: 0xde0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\programdata_microsoft_windows_devicemetadatastore_2e1ff34936d2e8e5.cdf-ms Handle ID: 0xf80 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\programdata_microsoft_windows_gameexplorer_eb83b477ca9834cc.cdf-ms Handle ID: 0xed0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\programdata_microsoft_windows_onesettings_d58936a49a7f4b26.cdf-ms Handle ID: 0x89c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\programdata_microsoft_windows_start_menu_programs_startup_b13751030220a596.cdf-ms Handle ID: 0x710 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\programdata_microsoft_windows_templates_15e72976404301fc.cdf-ms Handle ID: 0xdec Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\programdata_microsoft_windows_wfp_1409fc168e700932.cdf-ms Handle ID: 0xf8c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\users_default_appdata_local_bc5dd6ae41aaaeeb.cdf-ms Handle ID: 0xa08 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\users_default_appdata_local_microsoft_3433db0fbe07ab7f.cdf-ms Handle ID: 0x704 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\users_default_appdata_local_microsoft_windowsapps_522fbbfd57c17136.cdf-ms Handle ID: 0x880 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\users_default_appdata_local_microsoft_windows_9e28651fd972d480.cdf-ms Handle ID: 0x5d8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\users_default_appdata_local_microsoft_windows_gameexplorer_5a14824a005868dd.cdf-ms Handle ID: 0x7e8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\users_default_appdata_local_microsoft_windows_history_f4337fe0129e212c.cdf-ms Handle ID: 0xd3c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\users_default_appdata_local_microsoft_windows_inetcache_93b6f38324ca2118.cdf-ms Handle ID: 0x958 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\users_default_appdata_local_microsoft_windows_inetcookies_706c818672b5499f.cdf-ms Handle ID: 0x790 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\users_default_appdata_local_temp_3274946c96022019.cdf-ms Handle ID: 0x720 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\users_default_appdata_roaming_microsoft_windows_network_shortcuts_cbcbd4ac7028a985.cdf-ms Handle ID: 0xfa0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\users_default_appdata_roaming_microsoft_windows_recent_ca449f9bba09f987.cdf-ms Handle ID: 0xf88 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\users_default_appdata_roaming_microsoft_windows_sendto_cc2b2363b7303311.cdf-ms Handle ID: 0x9e8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\users_default_appdata_roaming_microsoft_windows_start_menu_programs_system_tools_b726d34a5a5ca66e.cdf-ms Handle ID: 0xe90 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\users_default_appdata_roaming_microsoft_windows_templates_9327e87141b4e78f.cdf-ms Handle ID: 0x7a4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\users_default_desktop_39aa59e1159d1203.cdf-ms Handle ID: 0x8c0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\users_default_documents_a9a4e48ccdf32dcf.cdf-ms Handle ID: 0x870 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\users_default_downloads_d0a063ac92c2c070.cdf-ms Handle ID: 0xca0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\users_default_favorites_d09a481c8ccc2a28.cdf-ms Handle ID: 0xa18 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\users_default_links_4064ed15230be7d0.cdf-ms Handle ID: 0xed4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\users_default_music_4066f7392302d756.cdf-ms Handle ID: 0x99c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\users_default_pictures_209185c2b71537e4.cdf-ms Handle ID: 0x780 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\users_default_saved_games_57aaea1c026aa551.cdf-ms Handle ID: 0x9f8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\users_default_videos_4078dfd58aff2cd5.cdf-ms Handle ID: 0xf04 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\users_public_8c076a3be22985a1.cdf-ms Handle ID: 0xf2c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\users_public_desktop_2377dac7383055bd.cdf-ms Handle ID: 0x8c8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\users_public_documents_70461e22eba239ef.cdf-ms Handle ID: 0xe98 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\users_public_downloads_631cc37cff593fe6.cdf-ms Handle ID: 0x9c0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\users_public_libraries_de6591322faedac0.cdf-ms Handle ID: 0xdf0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\users_public_music_8c1f3dc399e79184.cdf-ms Handle ID: 0x8ac Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\users_public_pictures_f5e7b0c0fda4db8c.cdf-ms Handle ID: 0x1224 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\users_public_videos_20f7329ef941f593.cdf-ms Handle ID: 0x1228 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-bootres.resources_31bf3856ad364e35_10.0.26100.1_en-us_deb910efbf2e106e\bootres.dll.mui Handle ID: 0x818 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-b..se-client.resources_31bf3856ad364e35_10.0.26100.1_en-us_16d23987e6726ad1\basebrd.dll.mui Handle ID: 0xae4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-b..servicing.resources_31bf3856ad364e35_10.0.26100.1_en-us_692234687eb91090\bfsvc.exe.mui Handle ID: 0xc0c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-notepad.resources_31bf3856ad364e35_10.0.26100.1_en-us_1ad980723786ba15\notepad.exe.mui Handle ID: 0x914 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-r..ry-editor.resources_31bf3856ad364e35_10.0.26100.1_en-us_f7c4e55c6b4bdb2d\regedit.exe.mui Handle ID: 0x90c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-t..onmanager.resources_31bf3856ad364e35_10.0.26100.1_en-us_d9857636a5632e01\lagcounterdef.ini Handle ID: 0x1054 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-aero.resources_31bf3856ad364e35_10.0.26100.1_en-us_373a2aedc290ee5f\aero.msstyles.mui Handle ID: 0xd14 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\Fonts-MinConsoleFonts-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.1.mum Handle ID: 0x73c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\HyperV-Guest-DynamicMemory-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.1.mum Handle ID: 0x1150 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\HyperV-Guest-KMCL-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.1.mum Handle ID: 0x6e0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\HyperV-Guest-Networking-Emulated-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.1.mum Handle ID: 0xa60 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\HyperV-Guest-Networking-Synthetic-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.1.mum Handle ID: 0xa7c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\HyperV-Guest-Storage-Filter-merged-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.1.mum Handle ID: 0x10ac Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\HyperV-Guest-Storage-Filter-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.1.mum Handle ID: 0x894 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\HyperV-Guest-Storage-Filter-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.1.cat Handle ID: 0x62c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\HyperV-Guest-Storage-Synthetic-merged-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.1.mum Handle ID: 0xf54 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\HyperV-Guest-Storage-Synthetic-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.1.mum Handle ID: 0x7d8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\HyperV-Guest-VmBus-merged-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.1.mum Handle ID: 0x1244 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\HyperV-Guest-Storage-Synthetic-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.1.cat Handle ID: 0x9b0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\HyperV-Guest-VmBus-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.1.mum Handle ID: 0xbe0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\HyperV-Guest-Vpci-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.1.mum Handle ID: 0x1104 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\HyperV-Guest-VmBus-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.1.cat Handle ID: 0xf98 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\HyperV-HvSocket-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.1.mum Handle ID: 0x1230 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\HyperV-Storage-VHD-Drivers-merged-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.1.mum Handle ID: 0xb44 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\HyperV-Storage-VHD-Drivers-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.1.mum Handle ID: 0xce8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\HyperV-Storage-VHD-VHDMP-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.1.mum Handle ID: 0xee8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\HyperV-Storage-VHD-Drivers-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.1.cat Handle ID: 0xef4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\Microsoft-ClientCore-Pnp-Desktop-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.1.mum Handle ID: 0x8bc Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\Microsoft-ClientCore-Pnp-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.1.mum Handle ID: 0x115c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\Microsoft-ClientCore-Pnp-WOW64-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.1.mum Handle ID: 0x858 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\Microsoft-Hyper-V-WinPE-Drivers-merged-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.1.mum Handle ID: 0x778 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\Microsoft-Hyper-V-WinPE-Drivers-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.1.mum Handle ID: 0xf50 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Hyper-V-WinPE-Drivers-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.1.cat Handle ID: 0x798 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\Microsoft-OneCore-CimFS-UnionFS-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.1.mum Handle ID: 0xfa4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\Microsoft-Onecore-Common-International-KBLayout-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.1.mum Handle ID: 0xb68 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\Microsoft-OneCore-Connectivity-Serial-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.1.mum Handle ID: 0xb10 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\Microsoft-OneCore-Console-Driver-Demand-merged-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.1.mum Handle ID: 0xf24 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\Microsoft-OneCore-Common-DriverClasses-Core-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.1.mum Handle ID: 0x9ec Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\Microsoft-OneCore-Console-Driver-Demand-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.1.mum Handle ID: 0x7b8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\Microsoft-OneCore-Console-Driver-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.1.mum Handle ID: 0xc90 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-OneCore-Console-Driver-Demand-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.1.cat Handle ID: 0xf44 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\Microsoft-OneCore-Console-Host-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.1.mum Handle ID: 0x6c4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\Microsoft-OneCore-CorePrivacySettingsStore-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.1.mum Handle ID: 0x974 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\Microsoft-OneCore-CorePrivacySettingsStore-WOW64-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.1.mum Handle ID: 0xe30 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\Microsoft-OneCore-CoreSystem-Core-merged-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.1.mum Handle ID: 0x116c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\Microsoft-OneCore-CoreSystem-Core-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.1.mum Handle ID: 0x77c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\Microsoft-OneCore-CoreSystem-Core-WOW64-merged-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.1.mum Handle ID: 0x1054 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-OneCore-CoreSystem-Core-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.1.cat Handle ID: 0x90c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\Microsoft-OneCore-CoreSystem-Core-WOW64-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.1.mum Handle ID: 0xa14 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-OneCore-CoreSystem-Core-WOW64-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.1.cat Handle ID: 0xae4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\Microsoft-OneCore-CoreSystem-FAT-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.1.mum Handle ID: 0x818 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\Microsoft-OneCore-CoreSystem-MSVCP110-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.1.mum Handle ID: 0x600 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\Microsoft-OneCore-CoreSystem-MSVCP110-WOW64-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.1.mum Handle ID: 0x9d4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\Microsoft-OneCore-CoreSystem-OLE-Automation-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.1.mum Handle ID: 0xa7c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\Microsoft-OneCore-CoreSystem-OLE-Automation-WOW64-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.1.mum Handle ID: 0x7d8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\Microsoft-OneCore-CoreSystem-OneCoreCommonProxyStub-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.1.mum Handle ID: 0x109c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\Microsoft-OneCore-CoreSystem-OneCoreCommonProxyStub-WOW64-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.1.mum Handle ID: 0x8a4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\Microsoft-OneCore-CoreSystem-UserModePowerService-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.1.mum Handle ID: 0x1100 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\Microsoft-OneCore-CoreSystem-WinHTTPCom-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.1.mum Handle ID: 0x9b0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\Microsoft-OneCore-CoreSystem-WinHTTPCom-WOW64-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.1.mum Handle ID: 0x62c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\Microsoft-OneCore-CoreSystem-WmiClnt-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.1.mum Handle ID: 0x106c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\Microsoft-OneCore-CoreSystem-WmiClnt-WOW64-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.1.mum Handle ID: 0xf98 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\Microsoft-OneCore-DebugCore-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.1.mum Handle ID: 0xb5c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\Microsoft-OneCore-DebugCore-WOW64-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.1.mum Handle ID: 0x1210 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\Microsoft-OneCore-DiskIo-ResourceControls-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.1.mum Handle ID: 0x720 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\Microsoft-OneCore-DriverVerifier-Tools-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.1.mum Handle ID: 0x100c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\Microsoft-OneCore-EnterpriseNetworking-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.1.mum Handle ID: 0x8dc Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\Microsoft-OneCore-EnterpriseNetworking-WOW64-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.1.mum Handle ID: 0x10b4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\Microsoft-OneCore-ETW-Core-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.1.mum Handle ID: 0xdd4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\Microsoft-OneCore-EventLog-Api-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.1.mum Handle ID: 0xf88 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\Microsoft-OneCore-EventLog-CommandLine-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.1.mum Handle ID: 0xf68 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\Microsoft-OneCore-EventLog-RequiredConfiguration-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.1.mum Handle ID: 0xbcc Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\Microsoft-OneCore-EventLog-Service-merged-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.1.mum Handle ID: 0x10a0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\Microsoft-OneCore-EventLog-Service-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.1.mum Handle ID: 0x5d4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-OneCore-EventLog-Service-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.1.cat Handle ID: 0xef0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\Microsoft-OneCore-Flighting-FeatureConfiguration-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.1.mum Handle ID: 0xa04 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\Microsoft-OneCore-Flighting-FeatureConfiguration-WOW64-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.1.mum Handle ID: 0xce8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\Microsoft-OneCore-Flighting-OneSettingsClient-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.1.mum Handle ID: 0xdb0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\Microsoft-OneCore-Http-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.1.mum Handle ID: 0x8ac Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\Microsoft-OneCore-Http-WOW64-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.1.mum Handle ID: 0x1294 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-OneCore-Http-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.1.cat Handle ID: 0xf38 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\Microsoft-Onecore-International-Keyboards-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.1.mum Handle ID: 0xbc8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-OneCore-Http-WOW64-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.1.cat Handle ID: 0x83c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\Microsoft-OneCore-LSA-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.1.mum Handle ID: 0xf48 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\Microsoft-OneCore-LSA-WOW64-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.1.mum Handle ID: 0xb88 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\Microsoft-OneCore-Multimedia-Acx-merged-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.1.mum Handle ID: 0x1220 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\Microsoft-OneCore-Multimedia-Acx-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.1.mum Handle ID: 0x788 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\Microsoft-OneCore-Multimedia-Apx-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.1.mum Handle ID: 0x107c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-OneCore-Multimedia-Acx-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.1.cat Handle ID: 0xf30 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\Microsoft-OneCore-Netloopback-Driver-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.1.mum Handle ID: 0x9dc Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\Microsoft-OneCore-Network-LegacyTdx-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.1.mum Handle ID: 0xa34 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\Microsoft-OneCore-Network-Security-Domain-Clients-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.1.mum Handle ID: 0xd08 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\Microsoft-OneCore-OverlayFilter-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.1.mum Handle ID: 0x1108 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\Microsoft-OneCore-OverlayFilter-WOW64-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.1.mum Handle ID: 0xe7c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\Microsoft-OneCore-PerformanceCounters-V2-DriverOnly-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.1.mum Handle ID: 0xffc Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\Microsoft-OneCore-PerformanceCounters-V2-DriverOnly-WOW64-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.1.mum Handle ID: 0x8a0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\Microsoft-OneCore-PerformanceCounters-V2-merged-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.1.mum Handle ID: 0xb38 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\Microsoft-OneCore-PerformanceCounters-V2-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.1.mum Handle ID: 0xc58 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\Microsoft-OneCore-PerformanceCounters-V2-WOW64-merged-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.1.mum Handle ID: 0x1198 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-OneCore-PerformanceCounters-V2-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.1.cat Handle ID: 0xebc Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\Microsoft-OneCore-PerformanceCounters-V2-WOW64-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.1.mum Handle ID: 0xea8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-OneCore-PerformanceCounters-V2-WOW64-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.1.cat Handle ID: 0xc14 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\Microsoft-OneCore-Pnp-Basic-merged-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.1.mum Handle ID: 0xd60 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\Microsoft-OneCore-Pnp-Basic-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.1.mum Handle ID: 0xbd0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\Microsoft-OneCore-Pnp-Basic-WOW64-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.1.mum Handle ID: 0xd90 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-OneCore-Pnp-Basic-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.1.cat Handle ID: 0x920 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\Microsoft-OneCore-Pnp-Core-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.1.mum Handle ID: 0x848 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-OneCore-Pnp-Basic-WOW64-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.1.cat Handle ID: 0x6f4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\Microsoft-OneCore-Pnp-Core-WOW64-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.1.mum Handle ID: 0x10d0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\Microsoft-OneCore-Pnp-Full-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.1.mum Handle ID: 0x1008 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\Microsoft-OneCore-Pnp-Full-WOW64-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.1.mum Handle ID: 0x944 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-OneCore-Pnp-Full-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.1.cat Handle ID: 0x1298 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-OneCore-Pnp-Full-WOW64-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.1.cat Handle ID: 0xbfc Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\Microsoft-OneCore-Pnp-OnlineDriverStore-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.1.mum Handle ID: 0x122c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\Microsoft-OneCore-Pnp-OnlineDriverStore-WOW64-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.1.mum Handle ID: 0x730 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\Microsoft-OneCore-Pnp-PlatformServices-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.1.mum Handle ID: 0x5d8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\Microsoft-OneCore-Pnp-PlatformServices-WOW64-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.1.mum Handle ID: 0xcf4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\Microsoft-OneCore-Pnp-RuntimeDeviceInstall-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.1.mum Handle ID: 0xc9c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\Microsoft-OneCore-Pnp-RuntimeDeviceInstall-WOW64-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.1.mum Handle ID: 0xe34 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\Microsoft-OneCore-Ramdisk-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.1.mum Handle ID: 0xe44 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\Microsoft-OneCore-ReFS-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.1.mum Handle ID: 0x734 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\Microsoft-OneCore-SystemCounters-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.1.mum Handle ID: 0x10f8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\Microsoft-OneCore-SystemCounters-WOW64-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.1.mum Handle ID: 0x978 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\Microsoft-OneCore-TraceDataHelper-DecodingResources-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.1.mum Handle ID: 0xe6c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\Microsoft-OneCore-TraceDataHelper-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.1.mum Handle ID: 0xe94 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\Microsoft-OneCore-TroubleShooting-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.1.mum Handle ID: 0x97c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\Microsoft-OneCore-TroubleShooting-WOW64-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.1.mum Handle ID: 0x94c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\Microsoft-OneCore-Wer-merged-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.1.mum Handle ID: 0x770 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\Microsoft-OneCore-Wer-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.1.mum Handle ID: 0xb74 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\Microsoft-OneCore-Wer-WOW64-merged-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.1.mum Handle ID: 0xe48 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-OneCore-Wer-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.1.cat Handle ID: 0x778 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\Microsoft-OneCore-Wer-WOW64-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.1.mum Handle ID: 0x1020 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\Microsoft-OneCore-x86-merged-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.1.mum Handle ID: 0x8bc Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-OneCore-Wer-WOW64-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.1.cat Handle ID: 0xb44 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\Microsoft-OneCore-x86-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.1.mum Handle ID: 0xf1c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-OneCore-x86-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.1.cat Handle ID: 0xc38 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\Microsoft-Windows-Basic-Http-Minio-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.1.mum Handle ID: 0x798 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\Microsoft-Windows-Basic-Http-Minio-WOW64-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.1.mum Handle ID: 0xba8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\Microsoft-Windows-BootEnv-Fonts-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.1.mum Handle ID: 0x998 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\Microsoft-Windows-BootEnvironment-BootManagers-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.1.mum Handle ID: 0x115c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\Microsoft-Windows-BootEnvironment-Core-Group-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.1.mum Handle ID: 0xf94 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\Microsoft-Windows-BuildFlighting-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.1.mum Handle ID: 0xb7c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\Microsoft-Windows-CAPI2-test-root-Package-ds-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.1.mum Handle ID: 0x128c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\Microsoft-Windows-CAPI2-test-root-Package-ds-WOW64-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.1.mum Handle ID: 0xe50 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\Microsoft-Windows-Client-Wired-Network-Drivers-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.1.mum Handle ID: 0x73c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\Microsoft-Windows-Common-Drivers-Package-windows-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.1.mum Handle ID: 0xbdc Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\Microsoft-Windows-Common-Drivers-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.1.mum Handle ID: 0xd34 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\Microsoft-Windows-Common-Foundation-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.1.mum Handle ID: 0x1028 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Common-Drivers-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.1.cat Handle ID: 0x11f4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\Microsoft-Windows-Console-Host-Full-merged-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.1.mum Handle ID: 0xbec Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\Microsoft-Windows-Common-Drivers-merged-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.1.mum Handle ID: 0xcb8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\Microsoft-Windows-Console-Host-Full-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.1.mum Handle ID: 0x10fc Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\Microsoft-Windows-Console-Host-Full-WOW64-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.1.mum Handle ID: 0x7ac Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Console-Host-Full-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.1.cat Handle ID: 0x1070 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\Microsoft-Windows-Console-Host-Legacy-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.1.mum Handle ID: 0x1224 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\Microsoft-Windows-CoreSystem-DriverSupport-merged-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.1.mum Handle ID: 0x79c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\Microsoft-Windows-CoreSystem-DriverSupport-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.1.mum Handle ID: 0xaec Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\Microsoft-Windows-CoreSystem-GenericDrivers-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.1.mum Handle ID: 0xac4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-CoreSystem-DriverSupport-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.1.cat Handle ID: 0x690 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\Microsoft-Windows-CoreSystem-merged-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.1.mum Handle ID: 0xb30 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\Microsoft-Windows-CoreSystem-MSXML6-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.1.mum Handle ID: 0xb70 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\Microsoft-Windows-CoreSystem-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.1.mum Handle ID: 0x9ec Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\Microsoft-Windows-CoreSystem-Power-Cmdline-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.1.mum Handle ID: 0xf24 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-CoreSystem-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.1.cat Handle ID: 0x11dc Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\Microsoft-Windows-CoreSystem-RemoteFS-Client-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.1.mum Handle ID: 0xf64 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\Microsoft-Windows-CoreSystem-RemoteFS-Client-WOW64-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.1.mum Handle ID: 0x1010 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\Microsoft-Windows-CoreSystem-RemoteFS-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.1.mum Handle ID: 0x10c0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\Microsoft-Windows-CoreSystem-RemoteFS-Server-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.1.mum Handle ID: 0xf44 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-CoreSystem-RemoteFS-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.1.cat Handle ID: 0xb98 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\Microsoft-Windows-CoreSystem-RemoteFS-WOW64-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.1.mum Handle ID: 0x724 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-CoreSystem-RemoteFS-WOW64-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.1.cat Handle ID: 0x93c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\Microsoft-Windows-CoreSystem-UnifiedBPM-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.1.mum Handle ID: 0x10a8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\Microsoft-Windows-CoreSystem-UnifiedBPM-WOW64-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.1.mum Handle ID: 0xb54 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\Microsoft-Windows-CoreSystem-WINNLS-Core-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.1.mum Handle ID: 0x974 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\Microsoft-Windows-CoreSystem-WINNLS-Core-WOW64-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.1.mum Handle ID: 0xfc4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\Microsoft-Windows-CoreSystem-WinTrust-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.1.mum Handle ID: 0x1054 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\Microsoft-Windows-CoreSystem-WinTrust-WOW64-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.1.mum Handle ID: 0xa60 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\Microsoft-Windows-CoreSystem-WOW64-merged-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.1.mum Handle ID: 0x6e0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\Microsoft-Windows-CoreSystem-WOW64-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.1.mum Handle ID: 0xc0c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\Microsoft-Windows-CredentialProviderFramework-merged-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.1.mum Handle ID: 0xc84 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-CoreSystem-WOW64-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.1.cat Handle ID: 0x90c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\Microsoft-Windows-CredentialProviderFramework-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.1.mum Handle ID: 0x116c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\Microsoft-Windows-CredentialProviderFramework-UAP-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.1.mum Handle ID: 0x1290 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-CredentialProviderFramework-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.1.cat Handle ID: 0xc50 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\Microsoft-Windows-CredentialProviderFramework-UAP-WOW64-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.1.mum Handle ID: 0x2bc Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\Microsoft-Windows-CredentialProviderFramework-WOW64-merged-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.1.mum Handle ID: 0x124c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\Microsoft-Windows-CredentialProviderFramework-WOW64-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.1.mum Handle ID: 0xa40 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\Microsoft-Windows-DesktopAuthBase-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.1.mum Handle ID: 0xb90 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-CredentialProviderFramework-WOW64-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.1.cat Handle ID: 0x708 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\Microsoft-Windows-DesktopAuthBase-WOW64-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.1.mum Handle ID: 0xec8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\Microsoft-Windows-ErrorReportingCore-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.1.mum Handle ID: 0x864 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\Microsoft-Windows-ErrorReportingCore-WOW64-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.1.mum Handle ID: 0x710 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\Microsoft-Windows-ErrorReportingFaults-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.1.mum Handle ID: 0x1154 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\Microsoft-Windows-ErrorReportingFaults-WOW64-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.1.mum Handle ID: 0x9cc Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\Microsoft-Windows-ErrorReportingKernel-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.1.mum Handle ID: 0x9d0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\Microsoft-Windows-FlightSettings-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.1.mum Handle ID: 0xd9c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\Microsoft-Windows-FlightSettings-WOW64-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.1.mum Handle ID: 0x1200 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\Microsoft-Windows-FlightSigning-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.1.mum Handle ID: 0xa14 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\Microsoft-Windows-FlightSigning-WOW64-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.1.mum Handle ID: 0x600 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\Microsoft-Windows-Foundation-Group-merged-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.1.mum Handle ID: 0x7a0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\Microsoft-Windows-Foundation-Group-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.1.mum Handle ID: 0xf10 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\Microsoft-Windows-Foundation-Group-WOW64-merged-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.1.mum Handle ID: 0xe70 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Foundation-Group-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.1.cat Handle ID: 0x818 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\Microsoft-Windows-Foundation-Group-WOW64-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.1.mum Handle ID: 0x7d8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Foundation-Group-WOW64-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.1.cat Handle ID: 0xa7c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\Microsoft-Windows-Foundation-Group-x86-merged-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.1.mum Handle ID: 0xb58 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\Microsoft-Windows-Foundation-Group-x86-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.1.mum Handle ID: 0xaa4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\Microsoft-Windows-Foundation-Win0-merged-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.1.mum Handle ID: 0xefc Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Foundation-Group-x86-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.1.cat Handle ID: 0x9c4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\Microsoft-Windows-Foundation-Win0-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.1.mum Handle ID: 0x8a4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\Microsoft-Windows-Foundation-Win0-WOW64-merged-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.1.mum Handle ID: 0x1180 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Foundation-Win0-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.1.cat Handle ID: 0x9c8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\Microsoft-Windows-Foundation-Win0-WOW64-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.1.mum Handle ID: 0x750 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\Microsoft-Windows-Foundation-Win1-merged-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.1.mum Handle ID: 0x109c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Foundation-Win0-WOW64-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.1.cat Handle ID: 0x960 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\Microsoft-Windows-Foundation-Win1-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.1.mum Handle ID: 0xed8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\Microsoft-Windows-Foundation-Win1-WOW64-merged-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.1.mum Handle ID: 0xedc Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Foundation-Win1-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.1.cat Handle ID: 0x6b0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\Microsoft-Windows-Foundation-Win1-WOW64-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.1.mum Handle ID: 0x6f0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\Microsoft-Windows-Foundation-x86-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.1.mum Handle ID: 0xc78 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Foundation-Win1-WOW64-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.1.cat Handle ID: 0x930 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\Microsoft-Windows-International-KBLayout-Desktop-merged-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.1.mum Handle ID: 0xd6c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\Microsoft-Windows-International-KBLayout-Desktop-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.1.mum Handle ID: 0xd64 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-International-KBLayout-Desktop-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.1.cat Handle ID: 0xcf8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\Microsoft-Windows-International-KBLayout-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.1.mum Handle ID: 0xc60 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-International-KBLayout-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.1.cat Handle ID: 0xb48 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\Microsoft-Windows-Kernel-Feature-merged-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.1.mum Handle ID: 0x105c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\Microsoft-Windows-Kernel-Feature-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.1.mum Handle ID: 0xa88 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Kernel-Feature-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.1.cat Handle ID: 0xaa8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\Microsoft-Windows-Kernel-Package-Acpi-Pci-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.1.mum Handle ID: 0xa90 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\Microsoft-Windows-Kernel-Package-AcpiEx-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.1.mum Handle ID: 0x6d8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\Microsoft-Windows-Kernel-Package-BootEnvironment-OS-Loader-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.1.mum Handle ID: 0xa64 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\Microsoft-Windows-Kernel-Package-BootEnvironment-Strings-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.1.mum Handle ID: 0x8e8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\Microsoft-Windows-Kernel-Package-BootRes-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.1.mum Handle ID: 0x898 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\Microsoft-Windows-Kernel-Package-BootVid-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.1.mum Handle ID: 0x10e0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\Microsoft-Windows-Kernel-Package-CodeIntegrity-DriverPolicy-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.1.mum Handle ID: 0xf54 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\Microsoft-Windows-Kernel-Package-CodeIntegrity-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.1.mum Handle ID: 0xbe0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\Microsoft-Windows-Kernel-Package-CrashDump-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.1.mum Handle ID: 0x1168 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\Microsoft-Windows-Kernel-Package-DriverVerifier-Xdv-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.1.mum Handle ID: 0x10f0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\Microsoft-Windows-Kernel-Package-GlobMerger-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.1.mum Handle ID: 0xa28 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\Microsoft-Windows-Kernel-Package-HardwareAccelerators-Core-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.1.mum Handle ID: 0xff0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\Microsoft-Windows-Kernel-Package-Ntdll-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.1.mum Handle ID: 0x1148 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\Microsoft-Windows-Kernel-Package-Ntdll-WOW64-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.1.mum Handle ID: 0x110c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\Microsoft-Windows-Kernel-Package-OS-Kernel-HAL-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.1.mum Handle ID: 0x614 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\Microsoft-Windows-Kernel-Package-PDC-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.1.mum Handle ID: 0x934 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\Microsoft-Windows-KernelMode-Minimal-Feature-merged-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.1.mum Handle ID: 0xf5c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\Microsoft-Windows-KernelMode-Minimal-Feature-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.1.mum Handle ID: 0x1170 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\Microsoft-Windows-MCUpdate-UpdateDLLs-IntelAMD-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.1.mum Handle ID: 0xa5c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-KernelMode-Minimal-Feature-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.1.cat Handle ID: 0x7fc Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\Microsoft-Windows-NetAdapterCx-UMDF-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.1.mum Handle ID: 0xa4c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\Microsoft-Windows-NetBIOS-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.1.mum Handle ID: 0xb1c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\Microsoft-Windows-Network-Foundation-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.1.mum Handle ID: 0x9e4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\Microsoft-Windows-Network-Foundation-WOW64-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.1.mum Handle ID: 0x704 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\Microsoft-Windows-OneCoreUAPCOM-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.1.mum Handle ID: 0x123c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\Microsoft-Windows-OneCoreUAPCOM-WOW64-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.1.mum Handle ID: 0xbf4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\Microsoft-Windows-PDC-merged-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.1.mum Handle ID: 0x11c8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\Microsoft-Windows-PDC-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.1.mum Handle ID: 0x119c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\Microsoft-Windows-PerfHost-Service-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.1.mum Handle ID: 0xc40 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-PDC-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.1.cat Handle ID: 0x10b8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\Microsoft-Windows-PerformanceBaseCounters-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.1.mum Handle ID: 0x790 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\Microsoft-Windows-PerformanceCounters-InfrastructureExecutable-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.1.mum Handle ID: 0xf20 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\Microsoft-Windows-PerformanceCounters-InfrastructureMigration-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.1.mum Handle ID: 0xf58 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\Microsoft-Windows-PerformanceCounters-InfrastructureNonExecutable-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.1.mum Handle ID: 0x1244 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\Microsoft-Windows-Platformrecords-PlutonFirmware-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.1.mum Handle ID: 0x8e4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\Microsoft-Windows-Pnp-merged-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.1.mum Handle ID: 0xf9c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\Microsoft-Windows-Pnp-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.1.mum Handle ID: 0x910 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\Microsoft-Windows-Pnp-WOW64-merged-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.1.mum Handle ID: 0x91c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Pnp-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.1.cat Handle ID: 0x1210 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\Microsoft-Windows-Pnp-WOW64-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.1.mum Handle ID: 0x1104 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\Microsoft-Windows-Product-Data-BaseBuildRevisionNumber-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.1.mum Handle ID: 0xf98 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Pnp-WOW64-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.1.cat Handle ID: 0x1230 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\Microsoft-Windows-Product-Data-BuildLayers-OneCoreUAP-BuildInfo-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.1.mum Handle ID: 0x106c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\Microsoft-Windows-Product-Data-BuildLayers-OneCoreUAP-VersionInfo-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.1.mum Handle ID: 0x10cc Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\Microsoft-Windows-Product-Data-ControlsFolder-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.1.mum Handle ID: 0xcb4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\Microsoft-Windows-Product-Data-DisplayVersion-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.1.mum Handle ID: 0x7f0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\Microsoft-Windows-Product-Data-Legacy-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.1.mum Handle ID: 0xd44 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\Microsoft-Windows-Product-Data-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.1.mum Handle ID: 0x98c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\Microsoft-Windows-Product-Data-SoftwareType-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.1.mum Handle ID: 0xb6c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\Microsoft-Windows-Product-Data-VersionInfo-Dynamic-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.1.mum Handle ID: 0x10b0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\Microsoft-Windows-Product-Data-VersionInfo-Static-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.1.mum Handle ID: 0x8c4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\Microsoft-Windows-Rasppp-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.1.mum Handle ID: 0x7e4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\Microsoft-Windows-RemoteFS-Legacy-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.1.mum Handle ID: 0x9ac Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\Microsoft-Windows-RemoteFS-Legacy-WOW64-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.1.mum Handle ID: 0x121c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\Microsoft-Windows-Server-Wired-Network-Drivers-merged-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.1.mum Handle ID: 0xfb8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\Microsoft-Windows-Server-Wired-Network-Drivers-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.1.mum Handle ID: 0xce0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\Microsoft-Windows-Server-Wired-Network-Dual-Drivers-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.1.mum Handle ID: 0x118c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Server-Wired-Network-Drivers-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.1.cat Handle ID: 0x850 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\Microsoft-Windows-ServicingStack-Base-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.1.mum Handle ID: 0x754 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\Microsoft-Windows-Shell32-KF-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.1.mum Handle ID: 0xc24 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\Microsoft-Windows-ShellAPI-merged-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.1.mum Handle ID: 0x6e4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\Microsoft-Windows-ShellAPI-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.1.mum Handle ID: 0xea0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-ShellAPI-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.1.cat Handle ID: 0xc94 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\Microsoft-Windows-SMB1-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.1.mum Handle ID: 0xe40 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\Microsoft-Windows-SMB1Client-D-Opt-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.1.mum Handle ID: 0x11d8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SMB1-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.1.cat Handle ID: 0xda8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\Microsoft-Windows-SMB1Server-D-Opt-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.1.mum Handle ID: 0xcec Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\Catalogs\89c45b1233dadd45e88895cdd2a6367b67dc8f5cdcccbf855113234cf07c100d.cat Handle ID: 0x10c4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\Microsoft-Windows-SXS-Runtime-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.1.mum Handle ID: 0xd1c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\Catalogs\473321c0e5f0064fc2216f5d84d9e9f5203f7173923aa98783bf03a4de673938.cat Handle ID: 0xd24 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\Microsoft-Windows-UserSessionManagement-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.1.mum Handle ID: 0xfd4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\Microsoft-Windows-UserSessionManagement-WOW64-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.1.mum Handle ID: 0xdcc Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\Microsoft-Windows-VssApi-Group-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.1.mum Handle ID: 0xe1c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\Microsoft-Windows-VssApi-Group-WOW64-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.1.mum Handle ID: 0x1094 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\Microsoft-Windows-Winpe-Drivers-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.1.mum Handle ID: 0xb14 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Winpe-Drivers-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.1.cat Handle ID: 0xeb0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\Microsoft-Windows-Winpe-Drivers-merged-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.1.mum Handle ID: 0x8a8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\Microsoft-Windows-Winpe-Dual-Drivers-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.1.mum Handle ID: 0xbc0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-WinPE-LanguagePack-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.1.cat Handle ID: 0x8d4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\Microsoft-Windows-WinPE-Shell-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.1.mum Handle ID: 0xe20 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\Microsoft-Windows-WinPE-LanguagePack-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.1.mum Handle ID: 0xe0c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\Microsoft-Windows-WinPE-SKU-Foundation-merged-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.1.mum Handle ID: 0xdb8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\Microsoft-Windows-WinPE-SKU-Foundation-WOW64-merged-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.1.mum Handle ID: 0xbe8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-WinPE-SKU-Foundation-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.1.cat Handle ID: 0xcd0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\Microsoft-Windows-WinPE-UserDeviceRegistration-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.1.mum Handle ID: 0xd84 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-WinPE-SKU-Foundation-WOW64-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.1.cat Handle ID: 0x10a4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\Microsoft-Windows-WinPEFoundation-LanguagePack-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.1.mum Handle ID: 0xb20 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\Microsoft-Windows-WinPE-SKU-Foundation-WOW64-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.1.mum Handle ID: 0x92c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\Microsoft-WindowsCore-HardwareAccelerators-merged-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.1.mum Handle ID: 0x80c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-WinPEFoundation-LanguagePack-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.1.cat Handle ID: 0x1068 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\Microsoft-WindowsCore-HardwareAccelerators-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.1.mum Handle ID: 0x1098 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\Microsoft-Windows-WinPE-SKU-Foundation-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.1.mum Handle ID: 0xb08 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\Microsoft-Winpe-Common-DriverClasses-merged-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.1.mum Handle ID: 0xc2c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-WindowsCore-HardwareAccelerators-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.1.cat Handle ID: 0xc70 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\Microsoft-Winpe-Common-DriverClasses-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.1.mum Handle ID: 0xd38 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\Microsoft-WinPE-Multilingual-Package-admin~31bf3856ad364e35~amd64~en-US~10.0.26100.1.mum Handle ID: 0x11b0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Winpe-Common-DriverClasses-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.1.cat Handle ID: 0xcb0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\Microsoft-WinPE-Multilingual-Package-base~31bf3856ad364e35~amd64~en-US~10.0.26100.1.mum Handle ID: 0xc88 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\Microsoft-WinPE-Multilingual-Package-enduser~31bf3856ad364e35~amd64~en-US~10.0.26100.1.mum Handle ID: 0xd4c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\Microsoft-WinPE-Multilingual-Package-minkernel~31bf3856ad364e35~amd64~en-US~10.0.26100.1.mum Handle ID: 0xa50 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\Microsoft-WinPE-Multilingual-Package-onecore~31bf3856ad364e35~amd64~en-US~10.0.26100.1.mum Handle ID: 0xfdc Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\Microsoft-WinPE-Multilingual-Package-shell~31bf3856ad364e35~amd64~en-US~10.0.26100.1.mum Handle ID: 0xd88 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\Microsoft-WinPE-Multilingual-Package-windows~31bf3856ad364e35~amd64~en-US~10.0.26100.1.mum Handle ID: 0x1208 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\Multimedia-AudioDriversCore-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.1.mum Handle ID: 0x1270 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\Multimedia-MMECoreBase-Full-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.1.mum Handle ID: 0xe2c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\Multimedia-MMECoreBase-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.1.mum Handle ID: 0xcbc Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\VPN-Common-Drivers-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.1.mum Handle ID: 0x7dc Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-b..os-loader.resources_31bf3856ad364e35_10.0.26100.1_en-us_738c62664c9070f8\winload.efi.mui Handle ID: 0xd58 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-b..os-loader.resources_31bf3856ad364e35_10.0.26100.1_en-us_738c62664c9070f8\winload.exe.mui Handle ID: 0xd04 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\x86_microsoft-windows-d..ers-winpe.resources_31bf3856ad364e35_10.0.26100.1_en-us_de6264b20ad1ae85\PEProvider.dll.mui Handle ID: 0x954 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-d..ers-winpe.resources_31bf3856ad364e35_10.0.26100.1_en-us_3a810035c32f1fbb\PEProvider.dll.mui Handle ID: 0x11ec Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-r..-agilevpn.resources_31bf3856ad364e35_10.0.26100.1_en-us_1c3ec53449ef6954\agilevpn.sys.mui Handle ID: 0x1240 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_cdrom.inf.resources_31bf3856ad364e35_10.0.26100.1_en-us_35ae75e2c01d5cef\cdrom.sys.mui Handle ID: 0xa58 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_acpi.inf.resources_31bf3856ad364e35_10.0.26100.1_en-us_b0a6872a31719f53\acpi.sys.mui Handle ID: 0xd94 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-c..ineconfig.resources_31bf3856ad364e35_10.0.26100.1_en-us_0bedd08339196f96\cmimcext.sys.mui Handle ID: 0x694 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_mshdc.inf.resources_31bf3856ad364e35_10.0.26100.1_en-us_6b6606c175f3a2ff\ataport.sys.mui Handle ID: 0xa54 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_disk.inf.resources_31bf3856ad364e35_10.0.26100.1_en-us_036a4b024c3f5d7f\disk.sys.mui Handle ID: 0x764 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-f..itefilter.resources_31bf3856ad364e35_10.0.26100.1_en-us_992369bc3e45452e\fbwf.sys.mui Handle ID: 0xf4c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_wdmvsc.inf.resources_31bf3856ad364e35_10.0.26100.1_en-us_19184e66d4d4edfe\dmvsc.sys.mui Handle ID: 0xb64 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_sdbus.inf.resources_31bf3856ad364e35_10.0.26100.1_en-us_27aef6a147741a5f\dumpsd.sys.mui Handle ID: 0xb34 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_hidbatt.inf.resources_31bf3856ad364e35_10.0.26100.1_en-us_64a178fe7958fe8e\hidbatt.sys.mui Handle ID: 0xe8c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-f..ager-core.resources_31bf3856ad364e35_10.0.26100.1_en-us_51109a3470a174c5\fltmgr.sys.mui Handle ID: 0x8e0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_input.inf.resources_31bf3856ad364e35_10.0.26100.1_en-us_1e935b822542a5c8\hidclass.sys.mui Handle ID: 0x1038 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-winsock-core.resources_31bf3856ad364e35_10.0.26100.1_en-us_48dc68bbe6f3356c\afd.sys.mui Handle ID: 0xef8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_machine.inf.resources_31bf3856ad364e35_10.0.26100.1_en-us_4200b9d5569240fb\isapnp.sys.mui Handle ID: 0xfbc Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_ipmidrv.inf.resources_31bf3856ad364e35_10.0.26100.1_en-us_4506c20c24280d07\IPMIDRV.sys.mui Handle ID: 0x11a8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_keyboard.inf.resources_31bf3856ad364e35_10.0.26100.1_en-us_2b9c79e9d4eacf2d\i8042prt.sys.mui Handle ID: 0xaac Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_keyboard.inf.resources_31bf3856ad364e35_10.0.26100.1_en-us_2b9c79e9d4eacf2d\kbdhid.sys.mui Handle ID: 0x100c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-k..streaming.resources_31bf3856ad364e35_10.0.26100.1_en-us_3e2b7616561ccb11\ks.sys.mui Handle ID: 0x830 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_keyboard.inf.resources_31bf3856ad364e35_10.0.26100.1_en-us_2b9c79e9d4eacf2d\kbdclass.sys.mui Handle ID: 0x928 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_msmouse.inf.resources_31bf3856ad364e35_10.0.26100.1_en-us_ce635d43fea450ed\mouhid.sys.mui Handle ID: 0xe88 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-m..ntmanager.resources_31bf3856ad364e35_10.0.26100.1_en-us_3a00d929a7d3a410\mountmgr.sys.mui Handle ID: 0x1034 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_msmouse.inf.resources_31bf3856ad364e35_10.0.26100.1_en-us_ce635d43fea450ed\mouclass.sys.mui Handle ID: 0x7d4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_mtconfig.inf.resources_31bf3856ad364e35_10.0.26100.1_en-us_77ad38a62d6b860d\MTConfig.sys.mui Handle ID: 0xfe4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-s..terdriver.resources_31bf3856ad364e35_10.0.26100.1_en-us_c736c16daf67bc9b\fvevol.sys.mui Handle ID: 0x8ec Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-ndisuio.resources_31bf3856ad364e35_10.0.26100.1_en-us_9946969da7ffd9c9\ndisuio.sys.mui Handle ID: 0x904 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-http.resources_31bf3856ad364e35_10.0.26100.1_en-us_0fe901263ed23138\http.sys.mui Handle ID: 0xa94 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-mup.resources_31bf3856ad364e35_10.0.26100.1_en-us_dd47f4d33f9f7b78\mup.sys.mui Handle ID: 0x126c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-n..irtualbus.resources_31bf3856ad364e35_10.0.26100.1_en-us_f30dd759d3aa66a4\NdisVirtualBus.sys.mui Handle ID: 0xa9c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_wnetvsc.inf.resources_31bf3856ad364e35_10.0.26100.1_en-us_5d740456342cfa0e\netvsc.sys.mui Handle ID: 0x700 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_nvdimm.inf.resources_31bf3856ad364e35_10.0.26100.1_en-us_6c53d6b617d1a68f\nvdimm.sys.mui Handle ID: 0x10a0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_nvmedisk.inf.resources_31bf3856ad364e35_10.0.26100.1_en-us_6f2bcd824e1cf047\nvmedisk.sys.mui Handle ID: 0xd54 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_msports.inf.resources_31bf3856ad364e35_10.0.26100.1_en-us_050016429bc35b08\parport.sys.mui Handle ID: 0x9e0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-p..onmanager.resources_31bf3856ad364e35_10.0.26100.1_en-us_fb1f6e03b332ebd7\partmgr.sys.mui Handle ID: 0x968 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-ndis.resources_31bf3856ad364e35_10.0.26100.1_en-us_730e3e8e5c3e304c\ndis.sys.mui Handle ID: 0xbcc Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_pcmcia.inf.resources_31bf3856ad364e35_10.0.26100.1_en-us_2580d68e1d5a87d3\pcmcia.sys.mui Handle ID: 0x718 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_pci.inf.resources_31bf3856ad364e35_10.0.26100.1_en-us_81cbe5565c2877c6\pci.sys.mui Handle ID: 0xe18 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-pdc.resources_31bf3856ad364e35_10.0.26100.1_en-us_1c3836b05b2d22d1\pdc.sys.mui Handle ID: 0xadc Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_cpu.inf.resources_31bf3856ad364e35_10.0.26100.1_en-us_f44621ceadc7b992\processr.sys.mui Handle ID: 0x9a8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-rdbss.resources_31bf3856ad364e35_10.0.26100.1_en-us_21eab2e6cff59f14\rdbss.sys.mui Handle ID: 0x908 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-smbminirdr.resources_31bf3856ad364e35_10.0.26100.1_en-us_3c2c146e5c40c3df\mrxsmb.sys.mui Handle ID: 0xa04 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-refs-v1.resources_31bf3856ad364e35_10.0.26100.1_en-us_485ddde9c05a07ee\refsv1.sys.mui Handle ID: 0xef0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_pmem.inf.resources_31bf3856ad364e35_10.0.26100.1_en-us_5f21927836575327\pmem.sys.mui Handle ID: 0x5d4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft.windows.s..rt_driver.resources_31bf3856ad364e35_10.0.26100.1_en-us_4df2e117592a1c6c\scsiport.sys.mui Handle ID: 0x87c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_scmbus.inf.resources_31bf3856ad364e35_10.0.26100.1_en-us_856abb806fac2735\scmbus.sys.mui Handle ID: 0xf68 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_sdstor.inf.resources_31bf3856ad364e35_10.0.26100.1_en-us_dc6a48606a06e6cd\sdstor.sys.mui Handle ID: 0xf88 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_sdbus.inf.resources_31bf3856ad364e35_10.0.26100.1_en-us_27aef6a147741a5f\sdbus.sys.mui Handle ID: 0xdd4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_msmouse.inf.resources_31bf3856ad364e35_10.0.26100.1_en-us_ce635d43fea450ed\sermouse.sys.mui Handle ID: 0x10b4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-e..tservices.resources_31bf3856ad364e35_10.0.26100.1_en-us_bf9a911deef0180c\sacdrv.sys.mui Handle ID: 0x8dc Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_msports.inf.resources_31bf3856ad364e35_10.0.26100.1_en-us_050016429bc35b08\serial.sys.mui Handle ID: 0x980 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-s..os-filter.resources_31bf3856ad364e35_10.0.26100.1_en-us_52f6a8a1dac04eec\storqosflt.sys.mui Handle ID: 0xad4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-refs.resources_31bf3856ad364e35_10.0.26100.1_en-us_afc2b51c8487972e\refs.sys.mui Handle ID: 0xa0c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_tpm.inf.resources_31bf3856ad364e35_10.0.26100.1_en-us_fdf75b09e1cfcd6b\tpm.sys.mui Handle ID: 0xf38 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_spaceport.inf.resources_31bf3856ad364e35_10.0.26100.1_en-us_02d6c7ac97677237\spaceport.sys.mui Handle ID: 0x83c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-ntfs.resources_31bf3856ad364e35_10.0.26100.1_en-us_e1a5e4ddc6c1da99\ntfs.sys.mui Handle ID: 0xbc8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_usbport.inf.resources_31bf3856ad364e35_10.0.26100.1_en-us_eb006c0a0f6398c3\usbhub.sys.mui Handle ID: 0xa84 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_usbstor.inf.resources_31bf3856ad364e35_10.0.26100.1_en-us_f43a0dff0d8f0b44\usbstor.sys.mui Handle ID: 0xdd0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-smbserver-v2.resources_31bf3856ad364e35_10.0.26100.1_en-us_2deee217990a4a12\srv2.sys.mui Handle ID: 0x70c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_usbhub3.inf.resources_31bf3856ad364e35_10.0.26100.1_en-us_77a41ed6cff26372\USBHUB3.SYS.mui Handle ID: 0x1294 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-d..ifier-xdv.resources_31bf3856ad364e35_10.0.26100.1_en-us_f949c57d5471c989\VerifierExt.sys.mui Handle ID: 0xcc4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_usbport.inf.resources_31bf3856ad364e35_10.0.26100.1_en-us_eb006c0a0f6398c3\usbport.sys.mui Handle ID: 0x8ac Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_wvmbus.inf.resources_31bf3856ad364e35_10.0.26100.1_en-us_778ae6f24641313e\vmbus.sys.mui Handle ID: 0xcd4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_product-onecore__usbxhci.inf.resources_31bf3856ad364e35_10.0.26100.1_en-us_b3b243f8dac5d5d9\USBXHCI.SYS.mui Handle ID: 0xdb0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_wstorflt.inf.resources_31bf3856ad364e35_10.0.26100.1_en-us_9ac07e565b0f0a11\vmstorfl.sys.mui Handle ID: 0xce8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-d..memanager.resources_31bf3856ad364e35_10.0.26100.1_en-us_a18734abf077f9b4\volmgrx.sys.mui Handle ID: 0xf30 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_hiddigi.inf.resources_31bf3856ad364e35_10.0.26100.1_en-us_33e05db23eff5afa\wacompen.sys.mui Handle ID: 0x107c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_vhdmp.inf.resources_31bf3856ad364e35_10.0.26100.1_en-us_e75c2b9321808d5b\vhdmp.sys.mui Handle ID: 0x10e8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_vdrvroot.inf.resources_31bf3856ad364e35_10.0.26100.1_en-us_4e1f43e7b8b90f66\vdrvroot.sys.mui Handle ID: 0x788 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-w..ellibrary.resources_31bf3856ad364e35_10.0.26100.1_en-us_1a7a1dd063cf0d04\wdf01000.sys.mui Handle ID: 0xb40 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-n..-security.resources_31bf3856ad364e35_10.0.26100.1_en-us_4b297241ad2021d1\wfplwfs.sys.mui Handle ID: 0xa34 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-w..e-ws2ifsl.resources_31bf3856ad364e35_10.0.26100.1_en-us_26a8fcd7374bfc5b\ws2ifsl.sys.mui Handle ID: 0x9dc Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-o..layfilter.resources_31bf3856ad364e35_10.0.26100.1_en-us_424d47c9e7c47822\wof.sys.mui Handle ID: 0xc04 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_3ware.inf.resources_31bf3856ad364e35_10.0.26100.1_en-us_42765d575363a386\3ware.inf_loc Handle ID: 0x1220 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_acpi.inf.resources_31bf3856ad364e35_10.0.26100.1_en-us_b0a6872a31719f53\acpi.inf_loc Handle ID: 0xb88 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_1394.inf.resources_31bf3856ad364e35_10.0.26100.1_en-us_5fae96118a6c321d\1394.inf_loc Handle ID: 0x1108 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_acpidev.inf.resources_31bf3856ad364e35_10.0.26100.1_en-us_e8192aa6e93f84a2\AcpiDev.inf_loc Handle ID: 0x1188 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_acpipagr.inf.resources_31bf3856ad364e35_10.0.26100.1_en-us_c8efecc8102114c7\acpipagr.inf_loc Handle ID: 0xd08 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_acpitime.inf.resources_31bf3856ad364e35_10.0.26100.1_en-us_47efc48d6ade1808\acpitime.inf_loc Handle ID: 0xe7c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_amdi2c.inf.resources_31bf3856ad364e35_10.0.26100.1_en-us_824762916c902404\AMDI2C.inf_loc Handle ID: 0xffc Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_amdgpio2.inf.resources_31bf3856ad364e35_10.0.26100.1_en-us_4e19c201467aaf77\AMDGPIO2.inf_loc Handle ID: 0xa10 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_amdsata.inf.resources_31bf3856ad364e35_10.0.26100.1_en-us_3d20910db43b3f1b\amdsata.inf_loc Handle ID: 0xee8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_adp80xx.inf.resources_31bf3856ad364e35_10.0.26100.1_en-us_2688afced33059a7\adp80xx.inf_loc Handle ID: 0xa38 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_amdsbs.inf.resources_31bf3856ad364e35_10.0.26100.1_en-us_c77b6579cdfcceca\AMDSBS.inf_loc Handle ID: 0x8a0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_applessd.inf.resources_31bf3856ad364e35_10.0.26100.1_en-us_8a904d32830ecc5a\AppleSSD.inf_loc Handle ID: 0x890 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_basicdisplay.inf.resources_31bf3856ad364e35_10.0.26100.1_en-us_362300483a35cc36\basicdisplay.inf_loc Handle ID: 0x1238 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_basicrender.inf.resources_31bf3856ad364e35_10.0.26100.1_en-us_89876e1428a0cdae\BasicRender.inf_loc Handle ID: 0xc58 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_battery.inf.resources_31bf3856ad364e35_10.0.26100.1_en-us_61e56516a2811327\battery.inf_loc Handle ID: 0xb38 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_arcsas.inf.resources_31bf3856ad364e35_10.0.26100.1_en-us_4f7e5dd01eac6dfd\arcsas.inf_loc Handle ID: 0xc18 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_buttonconverter.inf.resources_31bf3856ad364e35_10.0.26100.1_en-us_40d7a6778ff79ed4\buttonconverter.inf_loc Handle ID: 0xdd8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_cdrom.inf.resources_31bf3856ad364e35_10.0.26100.1_en-us_35ae75e2c01d5cef\cdrom.inf_loc Handle ID: 0xebc Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-volsnap.resources_31bf3856ad364e35_10.0.26100.1_en-us_2aca12069c02af31\volsnap.sys.mui Handle ID: 0x1198 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-tcpip-driver.resources_31bf3856ad364e35_10.0.26100.1_en-us_85f7b2b52adaa007\tcpip.sys.mui Handle ID: 0xec0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_cht4sx64.inf.resources_31bf3856ad364e35_10.0.26100.1_en-us_ff455fa77038dd7a\cht4sx64.inf_loc Handle ID: 0xea8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_cmbatt.inf.resources_31bf3856ad364e35_10.0.26100.1_en-us_4cd2b5546c4a36f3\cmbatt.inf_loc Handle ID: 0xc14 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_compdev.inf.resources_31bf3856ad364e35_10.0.26100.1_en-us_c735686432af2a82\compdev.inf_loc Handle ID: 0xd60 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_b57nd60a.inf.resources_31bf3856ad364e35_10.0.26100.1_en-us_ba12e94abea68ce7\b57nd60a.inf_loc Handle ID: 0xbd0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_product-winpe__c_ports.inf.resources_31bf3856ad364e35_10.0.26100.1_en-us_03eb0f3b34dafc11\c_ports.inf_loc Handle ID: 0x1050 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_product-winpe__c_nettrans.inf.resources_31bf3856ad364e35_10.0.26100.1_en-us_2ae416d0a3c677de\c_nettrans.inf_loc Handle ID: 0xf48 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_product-winpe__c_netclient.inf.resources_31bf3856ad364e35_10.0.26100.1_en-us_7284890747ca7c81\c_netclient.inf_loc Handle ID: 0x1048 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_product-winpe__c_ne..rvice.inf.resources_31bf3856ad364e35_10.0.26100.1_en-us_56000a92b0f2c6f3\c_netservice.inf_loc Handle ID: 0x920 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_c_wceusbs.inf.resources_31bf3856ad364e35_10.0.26100.1_en-us_02c7fd2de9715ea0\c_wceusbs.inf_loc Handle ID: 0xd90 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_c_volsnap.inf.resources_31bf3856ad364e35_10.0.26100.1_en-us_3803c4cd4248bf03\c_volsnap.inf_loc Handle ID: 0xeb8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_c_usbfn.inf.resources_31bf3856ad364e35_10.0.26100.1_en-us_178b3479f073ae5e\c_usbfn.inf_loc Handle ID: 0x1160 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_c_usb.inf.resources_31bf3856ad364e35_10.0.26100.1_en-us_677b1fe9609c414e\c_usb.inf_loc Handle ID: 0x848 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_c_unknown.inf.resources_31bf3856ad364e35_10.0.26100.1_en-us_45bc967e0fb26772\c_unknown.inf_loc Handle ID: 0xe98 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_c_system.inf.resources_31bf3856ad364e35_10.0.26100.1_en-us_3fc7e5be9d8dc8c1\c_system.inf_loc Handle ID: 0x1008 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_c_smartcardfilter.inf.resources_31bf3856ad364e35_10.0.26100.1_en-us_b909f22e83ee71d1\c_smartcardfilter.inf_loc Handle ID: 0x774 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_c_smartcard.inf.resources_31bf3856ad364e35_10.0.26100.1_en-us_189c6ddc64e06a55\c_smartcard.inf_loc Handle ID: 0x1140 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_c_securitydevices.inf.resources_31bf3856ad364e35_10.0.26100.1_en-us_97106bca95bc959f\c_securitydevices.inf_loc Handle ID: 0x768 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_c_sdhost.inf.resources_31bf3856ad364e35_10.0.26100.1_en-us_1b1318de3e69f1e1\c_sdhost.inf_loc Handle ID: 0x1298 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_c_sbp2.inf.resources_31bf3856ad364e35_10.0.26100.1_en-us_b00fbacf2206403b\c_sbp2.inf_loc Handle ID: 0x944 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_c_pnpprinters.inf.resources_31bf3856ad364e35_10.0.26100.1_en-us_cd738c9be05c7ac9\c_pnpprinters.inf_loc Handle ID: 0x114c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_c_pcmcia.inf.resources_31bf3856ad364e35_10.0.26100.1_en-us_3f53cf4168167d47\c_pcmcia.inf_loc Handle ID: 0x10d0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_c_multiportserial.inf.resources_31bf3856ad364e35_10.0.26100.1_en-us_4220343c17d8e8fc\c_multiportserial.inf_loc Handle ID: 0x122c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_c_multifunction.inf.resources_31bf3856ad364e35_10.0.26100.1_en-us_44a910ea25362b75\c_multifunction.inf_loc Handle ID: 0xbfc Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_c_mtd.inf.resources_31bf3856ad364e35_10.0.26100.1_en-us_0ebd465ab37354ad\c_mtd.inf_loc Handle ID: 0xb50 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_c_modem.inf.resources_31bf3856ad364e35_10.0.26100.1_en-us_a8427d97c7670074\c_modem.inf_loc Handle ID: 0x730 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_c_memory.inf.resources_31bf3856ad364e35_10.0.26100.1_en-us_eecaee774bcb3095\c_memory.inf_loc Handle ID: 0xcf4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_c_legacydriver.inf.resources_31bf3856ad364e35_10.0.26100.1_en-us_136d2a79151aa8c9\c_legacydriver.inf_loc Handle ID: 0x7f8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_c_hidclass.inf.resources_31bf3856ad364e35_10.0.26100.1_en-us_f3b9fd2cafd4f60d\c_hidclass.inf_loc Handle ID: 0x5d8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_c_dot4print.inf.resources_31bf3856ad364e35_10.0.26100.1_en-us_9b41b571999ac82a\c_dot4print.inf_loc Handle ID: 0x6f4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_c_dot4.inf.resources_31bf3856ad364e35_10.0.26100.1_en-us_423d2246defce1f5\c_dot4.inf_loc Handle ID: 0xff8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_c_computer.inf.resources_31bf3856ad364e35_10.0.26100.1_en-us_7a43348e4b1ab55f\c_computer.inf_loc Handle ID: 0x1174 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_c_bluetooth.inf.resources_31bf3856ad364e35_10.0.26100.1_en-us_853eec301abf510e\c_bluetooth.inf_loc Handle ID: 0xdc0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_c_biometric.inf.resources_31bf3856ad364e35_10.0.26100.1_en-us_4c8fa85d687ead6a\c_biometric.inf_loc Handle ID: 0x7bc Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_c_battery.inf.resources_31bf3856ad364e35_10.0.26100.1_en-us_c5b8be680df63d1b\c_battery.inf_loc Handle ID: 0x984 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_c_avc.inf.resources_31bf3856ad364e35_10.0.26100.1_en-us_309a6611f88297b4\c_avc.inf_loc Handle ID: 0x6e8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_c_61883.inf.resources_31bf3856ad364e35_10.0.26100.1_en-us_4ef8f1204207d304\c_61883.inf_loc Handle ID: 0xe34 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_c_1394.inf.resources_31bf3856ad364e35_10.0.26100.1_en-us_fd1241dd34aad749\c_1394.inf_loc Handle ID: 0x1044 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_cpu.inf.resources_31bf3856ad364e35_10.0.26100.1_en-us_f44621ceadc7b992\cpu.inf_loc Handle ID: 0x734 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_cht4nulx64.inf.resources_31bf3856ad364e35_10.0.26100.1_en-us_a60d505479a54e14\cht4nulx64.inf_loc Handle ID: 0x82c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_c_apo.inf.resources_31bf3856ad364e35_10.0.26100.1_en-us_05d1d2f1638ffa32\c_apo.inf_loc Handle ID: 0x7ec Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_c_camera.inf.resources_31bf3856ad364e35_10.0.26100.1_en-us_3bf1963a983ed4b1\c_camera.inf_loc Handle ID: 0x1058 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_c_usbdevice.inf.resources_31bf3856ad364e35_10.0.26100.1_en-us_e617fb70a7bb865c\c_usbdevice.inf_loc Handle ID: 0x10f8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_c_tapedrive.inf.resources_31bf3856ad364e35_10.0.26100.1_en-us_551bb9e732cf6a92\c_tapedrive.inf_loc Handle ID: 0x824 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_c_scsiadapter.inf.resources_31bf3856ad364e35_10.0.26100.1_en-us_2faf81e3185b7777\c_scsiadapter.inf_loc Handle ID: 0x81c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_c_mediumchanger.inf.resources_31bf3856ad364e35_10.0.26100.1_en-us_27e0ba7bda2e7f99\c_mediumchanger.inf_loc Handle ID: 0xb0c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_c_hdc.inf.resources_31bf3856ad364e35_10.0.26100.1_en-us_3c65bb14f351b5e9\c_hdc.inf_loc Handle ID: 0xae8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_c_floppydisk.inf.resources_31bf3856ad364e35_10.0.26100.1_en-us_950ea3f6cb4c6891\c_floppydisk.inf_loc Handle ID: 0x11fc Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_c_fdc.inf.resources_31bf3856ad364e35_10.0.26100.1_en-us_25e83553442ca007\c_fdc.inf_loc Handle ID: 0x924 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_c_cdrom.inf.resources_31bf3856ad364e35_10.0.26100.1_en-us_7caded2bb2177815\c_cdrom.inf_loc Handle ID: 0x1014 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_cht4vx64.inf.resources_31bf3856ad364e35_10.0.26100.1_en-us_3774e6271052c03d\cht4vx64.inf_loc Handle ID: 0xb04 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_c_computeaccelerator.inf.resources_31bf3856ad364e35_10.0.26100.1_en-us_c95acc03a838447e\c_computeaccelerator.inf_loc Handle ID: 0xe94 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_c_diskdrive.inf.resources_31bf3856ad364e35_10.0.26100.1_en-us_e0ad3e966d9e7011\c_diskdrive.inf_loc Handle ID: 0x8f0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_c_display.inf.resources_31bf3856ad364e35_10.0.26100.1_en-us_f98ae99eda4cfc32\c_display.inf_loc Handle ID: 0x8d0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_product-winpe__c_extension.inf.resources_31bf3856ad364e35_10.0.26100.1_en-us_132b9b54c475e2dc\c_extension.inf_loc Handle ID: 0x1184 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_c_firmware.inf.resources_31bf3856ad364e35_10.0.26100.1_en-us_3bf77b154f48d701\c_firmware.inf_loc Handle ID: 0x97c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_c_fsactivitymonitor.inf.resources_31bf3856ad364e35_10.0.26100.1_en-us_6175075428143d00\c_fsactivitymonitor.inf_loc Handle ID: 0x7b0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_c_fsantivirus.inf.resources_31bf3856ad364e35_10.0.26100.1_en-us_2fa648703cda3ada\c_fsantivirus.inf_loc Handle ID: 0xc3c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_c_fscfsmetadataserver.inf.resources_31bf3856ad364e35_10.0.26100.1_en-us_ebc435c8a629e5dd\c_fscfsmetadataserver.inf_loc Handle ID: 0x6c0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_c_fscompression.inf.resources_31bf3856ad364e35_10.0.26100.1_en-us_66a581280aaac01d\c_fscompression.inf_loc Handle ID: 0xff4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_c_fscontentscreener.inf.resources_31bf3856ad364e35_10.0.26100.1_en-us_a3721573fcd381c9\c_fscontentscreener.inf_loc Handle ID: 0x770 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_c_fscontinuousbackup.inf.resources_31bf3856ad364e35_10.0.26100.1_en-us_c65a7d4b7bf89252\c_fscontinuousbackup.inf_loc Handle ID: 0x874 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_c_fscopyprotection.inf.resources_31bf3856ad364e35_10.0.26100.1_en-us_da3183fb83922573\c_fscopyprotection.inf_loc Handle ID: 0x94c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_c_fsencryption.inf.resources_31bf3856ad364e35_10.0.26100.1_en-us_59c7299a7fdfa336\c_fsencryption.inf_loc Handle ID: 0x8d8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_c_fshsm.inf.resources_31bf3856ad364e35_10.0.26100.1_en-us_2e0f345d88bf805b\c_fshsm.inf_loc Handle ID: 0x1018 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_c_fsinfrastructure.inf.resources_31bf3856ad364e35_10.0.26100.1_en-us_a0f87d1319a249c8\c_fsinfrastructure.inf_loc Handle ID: 0xfc8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_c_fsopenfilebackup.inf.resources_31bf3856ad364e35_10.0.26100.1_en-us_71a9ba2afc8e14ab\c_fsopenfilebackup.inf_loc Handle ID: 0x11a4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_c_fsphysicalquotamgmt.inf.resources_31bf3856ad364e35_10.0.26100.1_en-us_77874ee05581e3cd\c_fsphysicalquotamgmt.inf_loc Handle ID: 0x1248 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_c_fsquotamgmt.inf.resources_31bf3856ad364e35_10.0.26100.1_en-us_63d4e0d7d4eef02e\c_fsquotamgmt.inf_loc Handle ID: 0xfec Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_c_fsreplication.inf.resources_31bf3856ad364e35_10.0.26100.1_en-us_e17f1f7440834adb\c_fsreplication.inf_loc Handle ID: 0x8f8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_c_fssecurityenhancer.inf.resources_31bf3856ad364e35_10.0.26100.1_en-us_e7de5e496e54c383\c_fssecurityenhancer.inf_loc Handle ID: 0xb44 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_c_fssystem.inf.resources_31bf3856ad364e35_10.0.26100.1_en-us_be3c4904ceaf7cb6\c_fssystem.inf_loc Handle ID: 0x8bc Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_c_fssystemrecovery.inf.resources_31bf3856ad364e35_10.0.26100.1_en-us_cc794a83159c1f65\c_fssystemrecovery.inf_loc Handle ID: 0x1020 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_c_fsundelete.inf.resources_31bf3856ad364e35_10.0.26100.1_en-us_f4cd71ef05c20725\c_fsundelete.inf_loc Handle ID: 0x1190 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_c_fsvirtualization.inf.resources_31bf3856ad364e35_10.0.26100.1_en-us_883b32cafef32254\c_fsvirtualization.inf_loc Handle ID: 0x778 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_c_i3c.inf.resources_31bf3856ad364e35_10.0.26100.1_en-us_d1849ae1db932d41\c_i3c.inf_loc Handle ID: 0xe48 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_product-winpe__c_image.inf.resources_31bf3856ad364e35_10.0.26100.1_en-us_ae01375e14484a26\c_image.inf_loc Handle ID: 0x11e8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_c_infrared.inf.resources_31bf3856ad364e35_10.0.26100.1_en-us_199381a0aecc9f77\c_infrared.inf_loc Handle ID: 0x11e4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_c_smartcardreader.inf.resources_31bf3856ad364e35_10.0.26100.1_en-us_709e84f51e364104\c_smartcardreader.inf_loc Handle ID: 0x868 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_c_mouse.inf.resources_31bf3856ad364e35_10.0.26100.1_en-us_0d3f0c4a9de7fe6b\c_mouse.inf_loc Handle ID: 0x998 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_c_keyboard.inf.resources_31bf3856ad364e35_10.0.26100.1_en-us_0199b66c4abf0ea1\c_keyboard.inf_loc Handle ID: 0x115c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_c_mcx.inf.resources_31bf3856ad364e35_10.0.26100.1_en-us_ebb5a665ee597c20\c_mcx.inf_loc Handle ID: 0xf50 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_c_media.inf.resources_31bf3856ad364e35_10.0.26100.1_en-us_abe864fac81f823e\c_media.inf_loc Handle ID: 0x798 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_c_monitor.inf.resources_31bf3856ad364e35_10.0.26100.1_en-us_a2a5744a56452bda\c_monitor.inf_loc Handle ID: 0xc38 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_c_net.inf.resources_31bf3856ad364e35_10.0.26100.1_en-us_8611ea844ce790e7\c_net.inf_loc Handle ID: 0xfa4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_c_netdriver.inf.resources_31bf3856ad364e35_10.0.26100.1_en-us_c2b36e5ef6b37677\c_netdriver.inf_loc Handle ID: 0x1254 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_c_nvmedisk.inf.resources_31bf3856ad364e35_10.0.26100.1_en-us_a1a1dbc1064dd2fb\c_nvmedisk.inf_loc Handle ID: 0xf1c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_c_printer.inf.resources_31bf3856ad364e35_10.0.26100.1_en-us_dec12c8cf2f1bc10\c_printer.inf_loc Handle ID: 0x834 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_c_processor.inf.resources_31bf3856ad364e35_10.0.26100.1_en-us_36e58e782ab2e388\c_processor.inf_loc Handle ID: 0xb7c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_c_proximity.inf.resources_31bf3856ad364e35_10.0.26100.1_en-us_1cd73dffe8458011\c_proximity.inf_loc Handle ID: 0xfc0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_c_ramdisk.inf.resources_31bf3856ad364e35_10.0.26100.1_en-us_3e8959b098e4bc8f\c_ramdisk.inf_loc Handle ID: 0xf94 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_c_scmdisk.inf.resources_31bf3856ad364e35_10.0.26100.1_en-us_2131cf41c81ab28c\c_scmdisk.inf_loc Handle ID: 0xef4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_c_scmvolume.inf.resources_31bf3856ad364e35_10.0.26100.1_en-us_6e5063c566d266eb\c_scmvolume.inf_loc Handle ID: 0x858 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_c_smrdisk.inf.resources_31bf3856ad364e35_10.0.26100.1_en-us_e32e8320c6f85937\c_smrdisk.inf_loc Handle ID: 0xba8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_c_smrvolume.inf.resources_31bf3856ad364e35_10.0.26100.1_en-us_ce408d26c6096b00\c_smrvolume.inf_loc Handle ID: 0xb74 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_c_sslaccel.inf.resources_31bf3856ad364e35_10.0.26100.1_en-us_9c0cf4b7d88535ba\c_sslaccel.inf_loc Handle ID: 0xd00 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_c_swcomponent.inf.resources_31bf3856ad364e35_10.0.26100.1_en-us_32c14cc7c4efa369\c_swcomponent.inf_loc Handle ID: 0xe6c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_c_swdevice.inf.resources_31bf3856ad364e35_10.0.26100.1_en-us_73552ab3e09a1d52\c_swdevice.inf_loc Handle ID: 0x978 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_c_ucm.inf.resources_31bf3856ad364e35_10.0.26100.1_en-us_b8d08e6b3a204b33\c_ucm.inf_loc Handle ID: 0xbf8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_c_volume.inf.resources_31bf3856ad364e35_10.0.26100.1_en-us_dd82881532157b1e\c_volume.inf_loc Handle ID: 0xad8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_devmap.inf.resources_31bf3856ad364e35_10.0.26100.1_en-us_c92cb1642555a093\devmap.inf_loc Handle ID: 0x72c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_disk.inf.resources_31bf3856ad364e35_10.0.26100.1_en-us_036a4b024c3f5d7f\disk.inf_loc Handle ID: 0xd34 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_fdc.inf.resources_31bf3856ad364e35_10.0.26100.1_en-us_0ac1b4f422f8f51b\fdc.inf_loc Handle ID: 0x748 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_errdev.inf.resources_31bf3856ad364e35_10.0.26100.1_en-us_9c88cc6ecd48802e\errdev.inf_loc Handle ID: 0xbdc Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_dc21x4vm.inf.resources_31bf3856ad364e35_10.0.26100.1_en-us_8211b7f6a402273f\dc21x4vm.inf_loc Handle ID: 0xb68 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_flpydisk.inf.resources_31bf3856ad364e35_10.0.26100.1_en-us_10f7e8fe6a4ac5b4\flpydisk.inf_loc Handle ID: 0x73c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_genericusbfn.inf.resources_31bf3856ad364e35_10.0.26100.1_en-us_2cb5d7914b5d0b83\genericusbfn.inf_loc Handle ID: 0xe80 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_genpass.inf.resources_31bf3856ad364e35_10.0.26100.1_en-us_b843b46496f40317\genpass.inf_loc Handle ID: 0xe50 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_hal.inf.resources_31bf3856ad364e35_10.0.26100.1_en-us_3a7e4edc16249eb9\hal.inf_loc Handle ID: 0x11e0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_e2xw10x64.inf.resources_31bf3856ad364e35_10.0.26100.1_en-us_570c7ac4757f1e85\e2xw10x64.inf_loc Handle ID: 0xf3c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_halextintclpiodma.inf.resources_31bf3856ad364e35_10.0.26100.1_en-us_3c2e467ae6b9353c\HalExtIntcLpioDma.inf_loc Handle ID: 0xac0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_halextintcpsedma.inf.resources_31bf3856ad364e35_10.0.26100.1_en-us_84e981e606a2c59e\HalExtIntcPseDma.inf_loc Handle ID: 0x7ac Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_halextpl080.inf.resources_31bf3856ad364e35_10.0.26100.1_en-us_41ff155b41f29ef6\HalExtPL080.inf_loc Handle ID: 0x7c4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_hidbatt.inf.resources_31bf3856ad364e35_10.0.26100.1_en-us_64a178fe7958fe8e\hidbatt.inf_loc Handle ID: 0x1224 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_hdaudbus.inf.resources_31bf3856ad364e35_10.0.26100.1_en-us_dc1827d3f9e46ca4\hdaudbus.inf_loc Handle ID: 0x10fc Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_hiddigi.inf.resources_31bf3856ad364e35_10.0.26100.1_en-us_33e05db23eff5afa\hiddigi.inf_loc Handle ID: 0x794 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_hidi2c.inf.resources_31bf3856ad364e35_10.0.26100.1_en-us_8b6d7aaf32bd69af\hidi2c.inf_loc Handle ID: 0xcb8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_hidinterrupt.inf.resources_31bf3856ad364e35_10.0.26100.1_en-us_945e7dbea498d192\hidinterrupt.inf_loc Handle ID: 0xbec Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_bnxtnd.inf.resources_31bf3856ad364e35_10.0.26100.1_en-us_a95f8879b5ad16da\bnxtnd.inf_loc Handle ID: 0x11f4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_hidspi_km.inf.resources_31bf3856ad364e35_10.0.26100.1_en-us_0e85d83f8d16bd42\hidspi_km.inf_loc Handle ID: 0x1028 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_hidvhf.inf.resources_31bf3856ad364e35_10.0.26100.1_en-us_47a563632448db0f\hidvhf.inf_loc Handle ID: 0xe44 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_hidserv.inf.resources_31bf3856ad364e35_10.0.26100.1_en-us_232cad82ae168f85\hidserv.inf_loc Handle ID: 0xc9c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_iagpio.inf.resources_31bf3856ad364e35_10.0.26100.1_en-us_8954dc80bbf737e1\iagpio.inf_loc Handle ID: 0x1088 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_i3chost.inf.resources_31bf3856ad364e35_10.0.26100.1_en-us_8b36d7098d388801\I3CHost.inf_loc Handle ID: 0xe4c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_iai2c.inf.resources_31bf3856ad364e35_10.0.26100.1_en-us_9255ee04ca0495ec\iai2c.inf_loc Handle ID: 0xc28 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_ialpss2i_gpio2_bxt_p.inf.resources_31bf3856ad364e35_10.0.26100.1_en-us_9b3609234c9c59bf\iaLPSS2i_GPIO2_BXT_P.inf_loc Handle ID: 0x79c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_ialpss2i_gpio2_cnl.inf.resources_31bf3856ad364e35_10.0.26100.1_en-us_62019f0ca5d5cdb9\iaLPSS2i_GPIO2_CNL.inf_loc Handle ID: 0xf70 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_hpsamd.inf.resources_31bf3856ad364e35_10.0.26100.1_en-us_00521f818845aac5\hpsamd.inf_loc Handle ID: 0xb30 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_ialpss2i_gpio2_glk.inf.resources_31bf3856ad364e35_10.0.26100.1_en-us_11099e98d064735e\iaLPSS2i_GPIO2_GLK.inf_loc Handle ID: 0x690 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_ialpss2i_gpio2_skl.inf.resources_31bf3856ad364e35_10.0.26100.1_en-us_db206d548689b6ac\iaLPSS2i_GPIO2_SKL.inf_loc Handle ID: 0xac4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_ialpss2i_i2c_bxt_p.inf.resources_31bf3856ad364e35_10.0.26100.1_en-us_171c11fde5b28396\iaLPSS2i_I2C_BXT_P.inf_loc Handle ID: 0xaec Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_ialpss2i_i2c_glk.inf.resources_31bf3856ad364e35_10.0.26100.1_en-us_e522ae50a354a07f\iaLPSS2i_I2C_GLK.inf_loc Handle ID: 0x914 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_ialpssi_gpio.inf.resources_31bf3856ad364e35_10.0.26100.1_en-us_bdbd1a2eb0fb38df\ialpssi_gpio.INF_loc Handle ID: 0x728 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_ialpss2i_i2c_cnl.inf.resources_31bf3856ad364e35_10.0.26100.1_en-us_e3b904b4333213ea\iaLPSS2i_I2C_CNL.inf_loc Handle ID: 0x1070 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_ialpss2i_i2c_skl.inf.resources_31bf3856ad364e35_10.0.26100.1_en-us_af7f058c500ff1ed\iaLPSS2i_I2C_SKL.inf_loc Handle ID: 0x128c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_ialpssi_i2c.inf.resources_31bf3856ad364e35_10.0.26100.1_en-us_21778956f752e116\iaLPSSi_I2C.INF_loc Handle ID: 0x1078 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_iastorv.inf.resources_31bf3856ad364e35_10.0.26100.1_en-us_e5e7a3d3ea8a624c\iastorv.inf_loc Handle ID: 0xc48 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_ipmidrv.inf.resources_31bf3856ad364e35_10.0.26100.1_en-us_4506c20c24280d07\ipmidrv.inf_loc Handle ID: 0xc64 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_iastorav.inf.resources_31bf3856ad364e35_10.0.26100.1_en-us_e783b183220ca15d\iastorav.inf_loc Handle ID: 0xbb4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_iscsi.inf.resources_31bf3856ad364e35_10.0.26100.1_en-us_ea44bb848a5872e7\iscsi.inf_loc Handle ID: 0x10c0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_kdnic.inf.resources_31bf3856ad364e35_10.0.26100.1_en-us_b13c5070963534c7\kdnic.inf_loc Handle ID: 0x6c4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_kdnic_legacy.inf.resources_31bf3856ad364e35_10.0.26100.1_en-us_f6dfef6d26819705\kdnic_legacy.inf_loc Handle ID: 0xc5c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_lltdio.inf.resources_31bf3856ad364e35_10.0.26100.1_en-us_745bee606599d19a\lltdio.inf_loc Handle ID: 0xc20 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_lsi_sas.inf.resources_31bf3856ad364e35_10.0.26100.1_en-us_09a99948e22b8788\lsi_sas.inf_loc Handle ID: 0xb98 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_itsas35i.inf.resources_31bf3856ad364e35_10.0.26100.1_en-us_0bb50074cd443f85\itSAS35i.inf_loc Handle ID: 0xf44 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_lsi_sas2i.inf.resources_31bf3856ad364e35_10.0.26100.1_en-us_acf37acba0046fb9\lsi_sas2i.inf_loc Handle ID: 0xd14 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_ipoib6x.inf.resources_31bf3856ad364e35_10.0.26100.1_en-us_fd0c419b7cea9ca9\ipoib6x.inf_loc Handle ID: 0x1010 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_lsi_sas3i.inf.resources_31bf3856ad364e35_10.0.26100.1_en-us_f0aaa815c97907a2\lsi_sas3i.inf_loc Handle ID: 0xf64 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_mausbhost.inf.resources_31bf3856ad364e35_10.0.26100.1_en-us_a7d531bcf2149f70\mausbhost.inf_loc Handle ID: 0xb10 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_megasas2i.inf.resources_31bf3856ad364e35_10.0.26100.1_en-us_0e088a5bf02db0aa\megasas2i.inf_loc Handle ID: 0xd10 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_megasas35i.inf.resources_31bf3856ad364e35_10.0.26100.1_en-us_ed611835a4f6e67c\megasas35i.inf_loc Handle ID: 0x10a8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_machine.inf.resources_31bf3856ad364e35_10.0.26100.1_en-us_4200b9d5569240fb\machine.inf_loc Handle ID: 0xc7c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_mf.inf.resources_31bf3856ad364e35_10.0.26100.1_en-us_bdc5075fea912985\mf.inf_loc Handle ID: 0xc10 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_keyboard.inf.resources_31bf3856ad364e35_10.0.26100.1_en-us_2b9c79e9d4eacf2d\keyboard.inf_loc Handle ID: 0x6ec Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_mchgr.inf.resources_31bf3856ad364e35_10.0.26100.1_en-us_9e1088cc717ac0bb\mchgr.inf_loc Handle ID: 0xcdc Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_mpi3drvi.inf.resources_31bf3856ad364e35_10.0.26100.1_en-us_06ed32c73bf8308a\mpi3drvi.inf_loc Handle ID: 0xb90 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_input.inf.resources_31bf3856ad364e35_10.0.26100.1_en-us_1e935b822542a5c8\input.inf_loc Handle ID: 0x708 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_msports.inf.resources_31bf3856ad364e35_10.0.26100.1_en-us_050016429bc35b08\msports.inf_loc Handle ID: 0x93c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_mlx4_bus.inf.resources_31bf3856ad364e35_10.0.26100.1_en-us_4f357309549344b2\mlx4_bus.inf_loc Handle ID: 0xd78 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_mssmbios.inf.resources_31bf3856ad364e35_10.0.26100.1_en-us_2b851c3f5d6d0d85\mssmbios.inf_loc Handle ID: 0x9d0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_mtconfig.inf.resources_31bf3856ad364e35_10.0.26100.1_en-us_77ad38a62d6b860d\MTConfig.inf_loc Handle ID: 0x1130 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_mshdc.inf.resources_31bf3856ad364e35_10.0.26100.1_en-us_6b6606c175f3a2ff\mshdc.inf_loc Handle ID: 0x129c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_ndisimplatform.inf.resources_31bf3856ad364e35_10.0.26100.1_en-us_ab986352cee78ceb\NdisImPlatform.inf_loc Handle ID: 0xdbc Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_mvumis.inf.resources_31bf3856ad364e35_10.0.26100.1_en-us_0dbfd80849033205\mvumis.inf_loc Handle ID: 0xbb0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_ndisuio.inf.resources_31bf3856ad364e35_10.0.26100.1_en-us_c88c0561d7857e77\ndisuio.inf_loc Handle ID: 0x1200 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_ndisvirtualbus.inf.resources_31bf3856ad364e35_10.0.26100.1_en-us_24f48018f3c33bfd\NdisVirtualBus.inf_loc Handle ID: 0xecc Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_ndisimplatformmp.inf.resources_31bf3856ad364e35_10.0.26100.1_en-us_eaf89f96ad476ed2\NdisImPlatformMp.inf_loc Handle ID: 0x724 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_msux64w10.inf.resources_31bf3856ad364e35_10.0.26100.1_en-us_8d29597928d42c47\msux64w10.INF_loc Handle ID: 0xc6c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_net44amd.inf.resources_31bf3856ad364e35_10.0.26100.1_en-us_4de0ac514f492dcd\net44amd.inf_loc Handle ID: 0xdc8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_msmouse.inf.resources_31bf3856ad364e35_10.0.26100.1_en-us_ce635d43fea450ed\msmouse.inf_loc Handle ID: 0xccc Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_net1yx64.inf.resources_31bf3856ad364e35_10.0.26100.1_en-us_f3be9f0e61e44d45\net1yx64.inf_loc Handle ID: 0xd20 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_megasr.inf.resources_31bf3856ad364e35_10.0.26100.1_en-us_0b9decbc2a461509\megasr.inf_loc Handle ID: 0xd70 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_net7500-x64-n650f.inf.resources_31bf3856ad364e35_10.0.26100.1_en-us_5b561919af9c1d96\net7500-x64-n650f.inf_loc Handle ID: 0x7a0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_netavpna.inf.resources_31bf3856ad364e35_10.0.26100.1_en-us_649c0c7a3be78fd7\netavpna.inf_loc Handle ID: 0x894 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_net7400-x64-n650.inf.resources_31bf3856ad364e35_10.0.26100.1_en-us_0927b6c8158b91d9\net7400-x64-n650.inf_loc Handle ID: 0x600 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_net9500-x64-n650f.inf.resources_31bf3856ad364e35_10.0.26100.1_en-us_092a470fc65d6b44\net9500-x64-n650f.inf_loc Handle ID: 0xc30 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_net7800-x64-n650f.inf.resources_31bf3856ad364e35_10.0.26100.1_en-us_25f9faed7ceaced9\net7800-x64-n650f.inf_loc Handle ID: 0xa14 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_netbvbda.inf.resources_31bf3856ad364e35_10.0.26100.1_en-us_eb443543b49fbcb6\netbvbda.inf_loc Handle ID: 0x818 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_netax88179_178a.inf.resources_31bf3856ad364e35_10.0.26100.1_en-us_efb2564f336fe201\NETAX88179_178a.inf_loc Handle ID: 0xae4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_netax88772.inf.resources_31bf3856ad364e35_10.0.26100.1_en-us_065a70853411d534\NETAX88772.inf_loc Handle ID: 0xd9c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_net1ix64.inf.resources_31bf3856ad364e35_10.0.26100.1_en-us_1c90df500c04e935\net1ix64.inf_loc Handle ID: 0x1134 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_nete1e3e.inf.resources_31bf3856ad364e35_10.0.26100.1_en-us_0d9b7d7f0852ecd0\nete1e3e.inf_loc Handle ID: 0x9cc Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_netbxnd0a.inf.resources_31bf3856ad364e35_10.0.26100.1_en-us_42ae3cf084b9dd3a\netbxnd0a.inf_loc Handle ID: 0x11d0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_nete1g3e.inf.resources_31bf3856ad364e35_10.0.26100.1_en-us_a1c4f0ece00527de\nete1g3e.inf_loc Handle ID: 0x7d8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_netbxnda.inf.resources_31bf3856ad364e35_10.0.26100.1_en-us_dfe235ec2d890b8c\netbxnda.inf_loc Handle ID: 0x10ac Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_netefe3e.inf.resources_31bf3856ad364e35_10.0.26100.1_en-us_4a6558fb14c6e845\neteFE3e.inf_loc Handle ID: 0xe70 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_netimm.inf.resources_31bf3856ad364e35_10.0.26100.1_en-us_b5b69410678f5fa8\netimm.inf_loc Handle ID: 0xaa4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_netip6.inf.resources_31bf3856ad364e35_10.0.26100.1_en-us_8817ce4cd4820466\netip6.inf_loc Handle ID: 0xb58 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_netg664.inf.resources_31bf3856ad364e35_10.0.26100.1_en-us_c7b59e41e1b621b6\netg664.inf_loc Handle ID: 0xf10 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_netevbd0a.inf.resources_31bf3856ad364e35_10.0.26100.1_en-us_549ea5766e9fb569\netevbd0a.inf_loc Handle ID: 0xfd8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_netevbda.inf.resources_31bf3856ad364e35_10.0.26100.1_en-us_ef41c731176ee3bb\netevbda.inf_loc Handle ID: 0x9d4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_netl160a.inf.resources_31bf3856ad364e35_10.0.26100.1_en-us_1d24c5468628d757\netl160a.inf_loc Handle ID: 0xd40 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_netjme.inf.resources_31bf3856ad364e35_10.0.26100.1_en-us_f242141544093c37\netjme.inf_loc Handle ID: 0x878 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_netk57a.inf.resources_31bf3856ad364e35_10.0.26100.1_en-us_1c22f681633171ed\netk57a.inf_loc Handle ID: 0x990 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_netl1c63x64.inf.resources_31bf3856ad364e35_10.0.26100.1_en-us_f41591968339bd20\netl1c63x64.inf_loc Handle ID: 0xaf8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_netl1e64.inf.resources_31bf3856ad364e35_10.0.26100.1_en-us_f53cdbf14aee8405\netl1e64.inf_loc Handle ID: 0x1180 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_netl260a.inf.resources_31bf3856ad364e35_10.0.26100.1_en-us_d8d40d45bb86cd98\netl260a.inf_loc Handle ID: 0x8a4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_netloop.inf.resources_31bf3856ad364e35_10.0.26100.1_en-us_97425004f37d2b97\netloop.inf_loc Handle ID: 0x9c4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_netmscli.inf.resources_31bf3856ad364e35_10.0.26100.1_en-us_351df01ae2db36f7\netmscli.inf_loc Handle ID: 0xefc Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_netnb.inf.resources_31bf3856ad364e35_10.0.26100.1_en-us_6ae9c4bc8be304c5\netnb.inf_loc Handle ID: 0x750 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_netnvm64.inf.resources_31bf3856ad364e35_10.0.26100.1_en-us_5e81975fa33f9470\netnvm64.inf_loc Handle ID: 0x9c8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_netmlx4eth63.inf.resources_31bf3856ad364e35_10.0.26100.1_en-us_979d088f1553d082\netmlx4eth63.inf_loc Handle ID: 0x960 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_netmyk64.inf.resources_31bf3856ad364e35_10.0.26100.1_en-us_017c6cd3a00cd9ce\netmyk64.inf_loc Handle ID: 0x109c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_netnvma.inf.resources_31bf3856ad364e35_10.0.26100.1_en-us_71286c33a0f7a679\netnvma.inf_loc Handle ID: 0xa7c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_netrasa.inf.resources_31bf3856ad364e35_10.0.26100.1_en-us_7e457c25220460d6\netrasa.inf_loc Handle ID: 0x884 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_netrass.inf.resources_31bf3856ad364e35_10.0.26100.1_en-us_78a7dc27e63c3f64\netrass.inf_loc Handle ID: 0xed8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_netrast.inf.resources_31bf3856ad364e35_10.0.26100.1_en-us_6a18586d7122e833\netrast.inf_loc Handle ID: 0x7f4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_netmlx5.inf.resources_31bf3856ad364e35_10.0.26100.1_en-us_174dd22a28d959f7\netmlx5.inf_loc Handle ID: 0xacc Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_netserv.inf.resources_31bf3856ad364e35_10.0.26100.1_en-us_ac3d6ffe0a1e6473\Netserv.inf_loc Handle ID: 0xa48 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_netsstpa.inf.resources_31bf3856ad364e35_10.0.26100.1_en-us_4f500ac0b1da5eec\netsstpa.inf_loc Handle ID: 0x113c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_netrtl64.inf.resources_31bf3856ad364e35_10.0.26100.1_en-us_1ff3bf29fb1413c3\netrtl64.inf_loc Handle ID: 0x950 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_nettcpip.inf.resources_31bf3856ad364e35_10.0.26100.1_en-us_ac560f3c19b73015\nettcpip.inf_loc Handle ID: 0x11b4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_nett4x64.inf.resources_31bf3856ad364e35_10.0.26100.1_en-us_3651556c48f8aa85\nett4x64.inf_loc Handle ID: 0xd6c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_netelx.inf.resources_31bf3856ad364e35_10.0.26100.1_en-us_606df88a8ef724c0\netelx.inf_loc Handle ID: 0x930 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_netvg63a.inf.resources_31bf3856ad364e35_10.0.26100.1_en-us_f9dd5b945cb69ae0\netvg63a.inf_loc Handle ID: 0x9bc Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_netvf63a.inf.resources_31bf3856ad364e35_10.0.26100.1_en-us_3b9d3c542758a49f\netvf63a.inf_loc Handle ID: 0x940 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_nvdimm.inf.resources_31bf3856ad364e35_10.0.26100.1_en-us_6c53d6b617d1a68f\nvdimm.inf_loc Handle ID: 0xc78 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_nvmedisk.inf.resources_31bf3856ad364e35_10.0.26100.1_en-us_6f2bcd824e1cf047\nvmedisk.inf_loc Handle ID: 0x6f0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_netqenda.inf.resources_31bf3856ad364e35_10.0.26100.1_en-us_e1e70b67259b87d2\netqenda.inf_loc Handle ID: 0x6b0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_nvraid.inf.resources_31bf3856ad364e35_10.0.26100.1_en-us_290bf3a0ac0ff088\nvraid.inf_loc Handle ID: 0xedc Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_netqevbda.inf.resources_31bf3856ad364e35_10.0.26100.1_en-us_3f879919981f0b2a\netqevbda.inf_loc Handle ID: 0xd28 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_pci.inf.resources_31bf3856ad364e35_10.0.26100.1_en-us_81cbe5565c2877c6\pci.inf_loc Handle ID: 0x1154 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_netxex64.inf.resources_31bf3856ad364e35_10.0.26100.1_en-us_848e2d6dae5e5652\netxex64.inf_loc Handle ID: 0xfa0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_pmem.inf.resources_31bf3856ad364e35_10.0.26100.1_en-us_5f21927836575327\pmem.inf_loc Handle ID: 0x804 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_percsas3i.inf.resources_31bf3856ad364e35_10.0.26100.1_en-us_72fdc1b18205f9a3\percsas3i.inf_loc Handle ID: 0xa8c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_prm.inf.resources_31bf3856ad364e35_10.0.26100.1_en-us_38a7a4b0482015d9\prm.inf_loc Handle ID: 0xa88 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_percsas2i.inf.resources_31bf3856ad364e35_10.0.26100.1_en-us_2f469467589161ba\percsas2i.inf_loc Handle ID: 0xa90 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_rspndr.inf.resources_31bf3856ad364e35_10.0.26100.1_en-us_bddf3713c93e3423\rspndr.inf_loc Handle ID: 0x664 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_ramdisk.inf.resources_31bf3856ad364e35_10.0.26100.1_en-us_cc1e88d1e4a16f7b\ramdisk.inf_loc Handle ID: 0x105c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_qd3x64.inf.resources_31bf3856ad364e35_10.0.26100.1_en-us_22ac8031f1db3d52\qd3x64.inf_loc Handle ID: 0xd64 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_pcmcia.inf.resources_31bf3856ad364e35_10.0.26100.1_en-us_2580d68e1d5a87d3\pcmcia.inf_loc Handle ID: 0xb48 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_sbp2.inf.resources_31bf3856ad364e35_10.0.26100.1_en-us_b09163269e272f4f\sbp2.inf_loc Handle ID: 0x5cc Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_scmbus.inf.resources_31bf3856ad364e35_10.0.26100.1_en-us_856abb806fac2735\scmbus.inf_loc Handle ID: 0xa64 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_netxix64.inf.resources_31bf3856ad364e35_10.0.26100.1_en-us_7afdd32d83d62f56\netxix64.inf_loc Handle ID: 0x6d8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_volume.inf.resources_31bf3856ad364e35_10.0.26100.1_en-us_7819f2992881f7ba\volume.inf_loc Handle ID: 0xaa8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_smrvolume.inf.resources_31bf3856ad364e35_10.0.26100.1_en-us_38f290603bc57c56\smrvolume.inf_loc Handle ID: 0xd8c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_scmvolume.inf.resources_31bf3856ad364e35_10.0.26100.1_en-us_b84e60a0b42adb91\scmvolume.inf_loc Handle ID: 0x10e0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_rt640x64.inf.resources_31bf3856ad364e35_10.0.26100.1_en-us_dee405a1904bfcb6\rt640x64.inf_loc Handle ID: 0x710 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_sdstor.inf.resources_31bf3856ad364e35_10.0.26100.1_en-us_dc6a48606a06e6cd\sdstor.inf_loc Handle ID: 0xa1c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_sisraid2.inf.resources_31bf3856ad364e35_10.0.26100.1_en-us_bc4cbb2ba63e21a9\sisraid2.inf_loc Handle ID: 0x62c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_rtux64w10.inf.resources_31bf3856ad364e35_10.0.26100.1_en-us_5864a9ed4aac727b\rtux64w10.inf_loc Handle ID: 0x9b0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_sisraid4.inf.resources_31bf3856ad364e35_10.0.26100.1_en-us_43bb15bff927517b\sisraid4.inf_loc Handle ID: 0x864 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_sdbus.inf.resources_31bf3856ad364e35_10.0.26100.1_en-us_27aef6a147741a5f\sdbus.inf_loc Handle ID: 0xf54 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_smrdisk.inf.resources_31bf3856ad364e35_10.0.26100.1_en-us_7c4420d4410c2283\smrdisk.inf_loc Handle ID: 0xbe0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_smartsamd.inf.resources_31bf3856ad364e35_10.0.26100.1_en-us_cc8b8362289f065e\SmartSAMD.inf_loc Handle ID: 0x1100 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_spaceport.inf.resources_31bf3856ad364e35_10.0.26100.1_en-us_02d6c7ac97677237\spaceport.inf_loc Handle ID: 0xec8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_rtucx21x64.inf.resources_31bf3856ad364e35_10.0.26100.1_en-us_47e0ad6b8e8606f1\rtucx21x64.inf_loc Handle ID: 0x10f0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_stexstor.inf.resources_31bf3856ad364e35_10.0.26100.1_en-us_ea0c90989161957c\STEXSTOR.inf_loc Handle ID: 0x6b8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_swenum.inf.resources_31bf3856ad364e35_10.0.26100.1_en-us_70030ca9f7f255f7\swenum.inf_loc Handle ID: 0xc80 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_stornvme.inf.resources_31bf3856ad364e35_10.0.26100.1_en-us_de653a15d3a01832\stornvme.inf_loc Handle ID: 0x1168 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_storufs.inf.resources_31bf3856ad364e35_10.0.26100.1_en-us_222b3d5f22bda942\storufs.inf_loc Handle ID: 0xc08 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_tpm.inf.resources_31bf3856ad364e35_10.0.26100.1_en-us_fdf75b09e1cfcd6b\tpm.inf_loc Handle ID: 0x898 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_uaspstor.inf.resources_31bf3856ad364e35_10.0.26100.1_en-us_87f1af9bb81f3fb5\uaspstor.inf_loc Handle ID: 0xa28 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_uefi.inf.resources_31bf3856ad364e35_10.0.26100.1_en-us_a6587d17c7787f5f\uefi.inf_loc Handle ID: 0xf28 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_ufxchipidea.inf.resources_31bf3856ad364e35_10.0.26100.1_en-us_6d76d6caa146c158\ufxchipidea.inf_loc Handle ID: 0x844 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_ufxsynopsys.inf.resources_31bf3856ad364e35_10.0.26100.1_en-us_f4360134247285bb\ufxsynopsys.inf_loc Handle ID: 0x89c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_uiomap.inf.resources_31bf3856ad364e35_10.0.26100.1_en-us_ba8e36c27af5a469\uiomap.inf_loc Handle ID: 0xa40 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_scsidev.inf.resources_31bf3856ad364e35_10.0.26100.1_en-us_7f294ed526c1f963\scsidev.inf_loc Handle ID: 0x1148 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_umbus.inf.resources_31bf3856ad364e35_10.0.26100.1_en-us_bbeb6c197cd210a0\umbus.inf_loc Handle ID: 0xaf4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_umpass.inf.resources_31bf3856ad364e35_10.0.26100.1_en-us_c6868841e609a67b\umpass.inf_loc Handle ID: 0x614 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_uefi.inf.resources_31bf3856ad364e35_10.0.26100.1_en-us_a6587d17c7787f5f\uefi.sys.mui Handle ID: 0xbc4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_unknown.inf.resources_31bf3856ad364e35_10.0.26100.1_en-us_2dceea7e452481ae\unknown.inf_loc Handle ID: 0x110c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_tape.inf.resources_31bf3856ad364e35_10.0.26100.1_en-us_1fd690e2a9e64b74\tape.inf_loc Handle ID: 0xab8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_usb4devicerouter.inf.resources_31bf3856ad364e35_10.0.26100.1_en-us_5f67a794ebec0f85\Usb4DeviceRouter.inf_loc Handle ID: 0x9c0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_usb4hostrouter.inf.resources_31bf3856ad364e35_10.0.26100.1_en-us_d4cde545378297ed\Usb4HostRouter.inf_loc Handle ID: 0xff0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_usb4devicerouter.inf.resources_31bf3856ad364e35_10.0.26100.1_en-us_5f67a794ebec0f85\Usb4DeviceRouter.SYS.mui Handle ID: 0x8f4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_usbser.inf.resources_31bf3856ad364e35_10.0.26100.1_en-us_3e1ef54c8c53d2ea\usbser.inf_loc Handle ID: 0x8e8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_usbhub3.inf.resources_31bf3856ad364e35_10.0.26100.1_en-us_77a41ed6cff26372\usbhub3.inf_loc Handle ID: 0xc60 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_product-onecore__usbxhci.inf.resources_31bf3856ad364e35_10.0.26100.1_en-us_b3b243f8dac5d5d9\usbxhci.inf_loc Handle ID: 0x1170 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_vdrvroot.inf.resources_31bf3856ad364e35_10.0.26100.1_en-us_4e1f43e7b8b90f66\vdrvroot.inf_loc Handle ID: 0xf5c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_vhdmp.inf.resources_31bf3856ad364e35_10.0.26100.1_en-us_e75c2b9321808d5b\vhdmp.inf_loc Handle ID: 0xc44 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_virtdisk.inf.resources_31bf3856ad364e35_10.0.26100.1_en-us_2458fee7ad95c328\virtdisk.inf_loc Handle ID: 0x934 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_volmgr.inf.resources_31bf3856ad364e35_10.0.26100.1_en-us_f79635f89e5f456d\volmgr.inf_loc Handle ID: 0xdac Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_volsnap.inf.resources_31bf3856ad364e35_10.0.26100.1_en-us_1056d355e9ca9b4f\volsnap.inf_loc Handle ID: 0xe28 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_vsmraid.inf.resources_31bf3856ad364e35_10.0.26100.1_en-us_93ee06685bb254cc\vsmraid.inf_loc Handle ID: 0x1204 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_vstxraid.inf.resources_31bf3856ad364e35_10.0.26100.1_en-us_27e36ad317e0d881\vstxraid.inf_loc Handle ID: 0xcf8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_wdmvsc.inf.resources_31bf3856ad364e35_10.0.26100.1_en-us_19184e66d4d4edfe\wdmvsc.inf_loc Handle ID: 0xfe0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_whyperkbd.inf.resources_31bf3856ad364e35_10.0.26100.1_en-us_d9803dd8029b4f08\whyperkbd.inf_loc Handle ID: 0xa4c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_usb.inf.resources_31bf3856ad364e35_10.0.26100.1_en-us_26120a6678f0b4f2\usb.inf_loc Handle ID: 0x7fc Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_wdmaudio.inf.resources_31bf3856ad364e35_10.0.26100.1_en-us_882f4b16d4a9931c\wdmaudio.inf_loc Handle ID: 0xa5c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_wmiacpi.inf.resources_31bf3856ad364e35_10.0.26100.1_en-us_740e5343fbeb37b2\wmiacpi.inf_loc Handle ID: 0xe9c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_wstorflt.inf.resources_31bf3856ad364e35_10.0.26100.1_en-us_9ac07e565b0f0a11\wstorflt.inf_loc Handle ID: 0xd80 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_wstorvsc.inf.resources_31bf3856ad364e35_10.0.26100.1_en-us_55ff8386243169b1\wstorvsc.inf_loc Handle ID: 0xf58 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_wvmbus.inf.resources_31bf3856ad364e35_10.0.26100.1_en-us_778ae6f24641313e\wvmbus.inf_loc Handle ID: 0x9a4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_wvmbushid.inf.resources_31bf3856ad364e35_10.0.26100.1_en-us_84162f874cb661d3\wvmbushid.inf_loc Handle ID: 0xf20 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_wvmbusvideo.inf.resources_31bf3856ad364e35_10.0.26100.1_en-us_09e714016831f4cd\wvmbusvideo.inf_loc Handle ID: 0xe10 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_usbstor.inf.resources_31bf3856ad364e35_10.0.26100.1_en-us_f43a0dff0d8f0b44\usbstor.inf_loc Handle ID: 0x790 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_wvpci.inf.resources_31bf3856ad364e35_10.0.26100.1_en-us_7ec787b6142ed2b7\wvpci.inf_loc Handle ID: 0x10b8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_wnetvsc.inf.resources_31bf3856ad364e35_10.0.26100.1_en-us_5d740456342cfa0e\wnetvsc.inf_loc Handle ID: 0xc40 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_ykinx64.inf.resources_31bf3856ad364e35_10.0.26100.1_en-us_eb07f1648519a59d\ykinx64.inf_loc Handle ID: 0xca4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_usbport.inf.resources_31bf3856ad364e35_10.0.26100.1_en-us_eb006c0a0f6398c3\usbport.inf_loc Handle ID: 0x119c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-a..apc-layer.resources_31bf3856ad364e35_10.0.26100.1_en-us_c2ea40abaa896bfc\adsldpc.dll.mui Handle ID: 0x11c8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-a..ce-router.resources_31bf3856ad364e35_10.0.26100.1_en-us_c53719b03375118b\activeds.dll.mui Handle ID: 0x1244 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-advapi32.resources_31bf3856ad364e35_10.0.26100.1_en-us_157d209419618a1c\advapi32.dll.mui Handle ID: 0x117c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-t..p-utility.resources_31bf3856ad364e35_10.0.26100.1_en-us_f15dd89d07843455\arp.exe.mui Handle ID: 0x738 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-advpack.resources_31bf3856ad364e35_11.0.26100.1_en-us_680cf05ddc035471\advpack.dll.mui Handle ID: 0xf9c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-atl.resources_31bf3856ad364e35_10.0.26100.1_en-us_9bee3fc76b9898e9\atl.dll.mui Handle ID: 0x8e4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-attrib.resources_31bf3856ad364e35_10.0.26100.1_en-us_ddcb691a4f12dce6\attrib.exe.mui Handle ID: 0x1210 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-a..component.resources_31bf3856ad364e35_10.0.26100.1_en-us_72f7879ccccb6b67\authui.dll.mui Handle ID: 0xfa8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-b..dlinetool.resources_31bf3856ad364e35_10.0.26100.1_en-us_1e016beae0dc7c6a\bcdboot.exe.mui Handle ID: 0x970 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-aclui.resources_31bf3856ad364e35_10.0.26100.1_en-us_3ec57c8f19785006\aclui.dll.mui Handle ID: 0xb5c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-bcrypt.resources_31bf3856ad364e35_10.0.26100.1_en-us_7556be333c351282\bcrypt.dll.mui Handle ID: 0xa30 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-s..-counters.resources_31bf3856ad364e35_10.0.26100.1_en-us_b929cb726bab0027\advapi32res.dll.mui Handle ID: 0x1250 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-n..-security.resources_31bf3856ad364e35_10.0.26100.1_en-us_4b297241ad2021d1\bfe.dll.mui Handle ID: 0x1214 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-b..t-strings.resources_31bf3856ad364e35_10.0.26100.1_en-us_1ac8add72b4bb374\bootstr.dll.mui Handle ID: 0x11f0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-b..ectortool.resources_31bf3856ad364e35_10.0.26100.1_en-us_72b51ca158cbd2fe\bootsect.exe.mui Handle ID: 0xdf4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-brokerbase.resources_31bf3856ad364e35_10.0.26100.1_en-us_a181fdcdf6db392a\BrokerLib.dll.mui Handle ID: 0xa3c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-capisp-dll.resources_31bf3856ad364e35_10.0.26100.1_en-us_10e53de22fbf06b1\capisp.dll.mui Handle ID: 0x10cc Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-lddmcore.resources_31bf3856ad364e35_10.0.26100.1_en-us_97f8f55b7e970b0c\cdd.dll.mui Handle ID: 0x1124 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-c..ityclient.resources_31bf3856ad364e35_10.0.26100.1_en-us_61b2ff4b086153b8\certcli.dll.mui Handle ID: 0xcf0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-chkdsk.resources_31bf3856ad364e35_10.0.26100.1_en-us_531caec2772a3efc\chkdsk.exe.mui Handle ID: 0x106c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-a..figurator.resources_31bf3856ad364e35_10.0.26100.1_en-us_bdc1b4f3cdb6bac6\chkntfs.exe.mui Handle ID: 0x1230 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-c..ertca-dll.resources_31bf3856ad364e35_10.0.26100.1_en-us_6b136f228847c969\certca.dll.mui Handle ID: 0xf98 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-commonlog.resources_31bf3856ad364e35_10.0.26100.1_en-us_0f4c638b630dd703\clfs.sys.mui Handle ID: 0xf84 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-f..lientcore.resources_31bf3856ad364e35_10.0.26100.1_en-us_dcc7c012061e0371\clusapi.dll.mui Handle ID: 0x808 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-c..integrity.resources_31bf3856ad364e35_10.0.26100.1_en-us_f6282901b5e72132\ci.dll.mui Handle ID: 0xcb4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-com-base.resources_31bf3856ad364e35_10.0.26100.1_en-us_b573647fa63538bb\combase.dll.mui Handle ID: 0x98c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-b..dlinetool.resources_31bf3856ad364e35_10.0.26100.1_en-us_7f22a518b73b87b3\bcdedit.exe.mui Handle ID: 0xd44 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-compact.resources_31bf3856ad364e35_10.0.26100.1_en-us_cab68ee4e3cbdad1\compact.exe.mui Handle ID: 0x7f0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-onecore-c..host-core.resources_31bf3856ad364e35_10.0.26100.1_en-us_536fb0be5f1c2f1e\Conhost.exe.mui Handle ID: 0x9e8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-c..olehostv1.resources_31bf3856ad364e35_10.0.26100.1_en-us_78ccd41145c154fa\ConhostV1.dll.mui Handle ID: 0xa74 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-m..ditevtlog.resources_31bf3856ad364e35_10.0.26100.1_en-us_56f94c53c2690152\adtschema.dll.mui Handle ID: 0xf14 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-onecore-c..propsheet.resources_31bf3856ad364e35_10.0.26100.1_en-us_ff2707a6ad2356ff\console.dll.mui Handle ID: 0xa44 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-c..n-library.resources_31bf3856ad364e35_10.0.26100.1_en-us_b9ab430c8c1c8aec\ConsoleLogon.dll.mui Handle ID: 0x888 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-c..r-library.resources_31bf3856ad364e35_10.0.26100.1_en-us_d0ebbbe2969c8c08\CredProv2faHelper.dll.mui Handle ID: 0xa2c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-c..s-library.resources_31bf3856ad364e35_10.0.26100.1_en-us_8d5794119b4becd9\credprovs.dll.mui Handle ID: 0x7c8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-c..t-library.resources_31bf3856ad364e35_10.0.26100.1_en-us_61890db2ffc1536d\credprovhost.dll.mui Handle ID: 0x6cc Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-c..andprompt.resources_31bf3856ad364e35_10.0.26100.1_en-us_7c758698fa76cd91\cmd.exe.mui Handle ID: 0x7e4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-cryptdlg-dll.resources_31bf3856ad364e35_10.0.26100.1_en-us_423dd8b56acb3e9a\cryptdlg.dll.mui Handle ID: 0xbd8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-c..y-library.resources_31bf3856ad364e35_10.0.26100.1_en-us_8d68081d93811e88\credprovslegacy.dll.mui Handle ID: 0x8c4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-cryptext-dll.resources_31bf3856ad364e35_10.0.26100.1_en-us_6c6628db1ec36c4a\cryptext.dll.mui Handle ID: 0x1030 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-cryptsvc-dll.resources_31bf3856ad364e35_10.0.26100.1_en-us_a1ba7c635f18ddc5\cryptsvc.dll.mui Handle ID: 0x10b0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-cryptxml.resources_31bf3856ad364e35_10.0.26100.1_en-us_698fc1f60c2de547\cryptxml.dll.mui Handle ID: 0x938 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-csrsrv.resources_31bf3856ad364e35_10.0.26100.1_en-us_7aebdf30fd6ef81b\csrsrv.dll.mui Handle ID: 0xb6c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-autochk.resources_31bf3856ad364e35_10.0.26100.1_en-us_4681afff5a1b502d\autochk.exe.mui Handle ID: 0x1060 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-crypt32-dll.resources_31bf3856ad364e35_10.0.26100.1_en-us_cb1a85ef22d30f24\crypt32.dll.mui Handle ID: 0x1104 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-csrss.resources_31bf3856ad364e35_10.0.26100.1_en-us_d784b37749fd398a\csrss.exe.mui Handle ID: 0x91c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-s..itybroker.resources_31bf3856ad364e35_10.0.26100.1_en-us_b4759b243f4a8b8d\dab.dll.mui Handle ID: 0xda4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\wow64_microsoft-windows-s..brokerapi.resources_31bf3856ad364e35_10.0.26100.1_en-us_5b8c03189ae6ada8\dabapi.dll.mui Handle ID: 0x121c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-s..-credprov.resources_31bf3856ad364e35_10.0.26100.1_en-us_ec2c41a4f8675e9e\devicengccredprov.dll.mui Handle ID: 0x9f0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-d..dateagent.resources_31bf3856ad364e35_10.0.26100.1_en-us_55e1985f592af820\DeviceUpdateAgent.dll.mui Handle ID: 0x850 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-dhcpcmonitor.resources_31bf3856ad364e35_10.0.26100.1_en-us_9affb80e35003a54\dhcpcmonitor.dll.mui Handle ID: 0x118c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-defrag-core.resources_31bf3856ad364e35_10.0.26100.1_en-us_711077dda698bde7\defragsvc.dll.mui Handle ID: 0x74c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-d..ll-minwin.resources_31bf3856ad364e35_10.0.26100.1_en-us_31de1972e0039c05\dhcpcsvc.dll.mui Handle ID: 0x910 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-d..ll-minwin.resources_31bf3856ad364e35_10.0.26100.1_en-us_31de1972e0039c05\dhcpcore.dll.mui Handle ID: 0xf0c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-cryptui-dll.resources_31bf3856ad364e35_10.0.26100.1_en-us_0055d69706e5e37f\cryptui.dll.mui Handle ID: 0xec4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-u..ry-client.resources_31bf3856ad364e35_10.0.26100.1_en-us_c2c3e13fab05f906\diagtrack.dll.mui Handle ID: 0xbf4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-d..ll-minwin.resources_31bf3856ad364e35_10.0.26100.1_en-us_31de1972e0039c05\dhcpcore6.dll.mui Handle ID: 0x75c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-d..ll-minwin.resources_31bf3856ad364e35_10.0.26100.1_en-us_31de1972e0039c05\dhcpcsvc6.dll.mui Handle ID: 0x123c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-d..ement-api.resources_31bf3856ad364e35_10.0.26100.1_en-us_0f964a75ca747327\DismApi.dll.mui Handle ID: 0x7d0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-d..mmandline.resources_31bf3856ad364e35_10.0.26100.1_en-us_b4a467fa82a01b62\Dism.exe.mui Handle ID: 0x704 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-d..ient-core.resources_31bf3856ad364e35_10.0.26100.1_en-us_1436aede69c9b8b1\dnsrslvr.dll.mui Handle ID: 0x918 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-m..utilities.resources_31bf3856ad364e35_10.0.26100.1_en-us_8273ffd35c310c8d\doskey.exe.mui Handle ID: 0x9e4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-dpapi-keys.resources_31bf3856ad364e35_10.0.26100.1_en-us_e5e066f38e6fa6a5\dpapimig.exe.mui Handle ID: 0xb1c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-dpapisrv.resources_31bf3856ad364e35_10.0.26100.1_en-us_2ad78bc57315db3b\dpapisrv.dll.mui Handle ID: 0xbbc Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-d..ient-core.resources_31bf3856ad364e35_10.0.26100.1_en-us_1436aede69c9b8b1\dnsapi.dll.mui Handle ID: 0x124c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-driverquery.resources_31bf3856ad364e35_10.0.26100.1_en-us_fa05ed0f2adae9b4\driverquery.exe.mui Handle ID: 0xe90 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-w..e-drvload.resources_31bf3856ad364e35_10.0.26100.1_en-us_9669540dbe175300\drvload.exe.mui Handle ID: 0x2bc Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-u..istration.resources_31bf3856ad364e35_10.0.26100.1_en-us_60b5c4eee368c62c\dsregcmd.exe.mui Handle ID: 0xc50 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-u..istration.resources_31bf3856ad364e35_10.0.26100.1_en-us_60b5c4eee368c62c\dsregtask.dll.mui Handle ID: 0xd7c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-diskraid.resources_31bf3856ad364e35_10.0.26100.1_en-us_bd9abd4346dc93c9\diskraid.exe.mui Handle ID: 0x1290 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-c..to-dssenh.resources_31bf3856ad364e35_10.0.26100.1_en-us_c7d22aa3d70beb0d\dssenh.dll.mui Handle ID: 0xe78 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-dui70.resources_31bf3856ad364e35_10.0.26100.1_en-us_5ebb662bcc14687d\dui70.dll.mui Handle ID: 0x1094 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-duser.resources_31bf3856ad364e35_10.0.26100.1_en-us_722421038b5c99d7\duser.dll.mui Handle ID: 0x116c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-directwrite.resources_31bf3856ad364e35_10.0.26100.1_en-us_8e75f00536c95f8c\DWrite.dll.mui Handle ID: 0x90c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-d..nager-api.resources_31bf3856ad364e35_10.0.26100.1_en-us_ebb5fe16ec4d587e\dwmapi.dll.mui Handle ID: 0xc84 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-lddmcore.resources_31bf3856ad364e35_10.0.26100.1_en-us_97f8f55b7e970b0c\dxgmms2.sys.mui Handle ID: 0xc0c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-c..mplus.res.resources_31bf3856ad364e35_10.0.26100.1_en-us_a0102c0aaa9cec09\comres.dll.mui Handle ID: 0xc90 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-eappcfgui.resources_31bf3856ad364e35_10.0.26100.1_en-us_c7b8f976b27375a6\eappcfgui.dll.mui Handle ID: 0x1194 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-graphics-wdi.resources_31bf3856ad364e35_10.0.26100.1_en-us_280c66665f1fe688\dxgwdi.dll.mui Handle ID: 0xba0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-e..host-peer.resources_31bf3856ad364e35_10.0.26100.1_en-us_27144980890e384b\eappgnui.dll.mui Handle ID: 0x6e0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-u..istration.resources_31bf3856ad364e35_10.0.26100.1_en-us_60b5c4eee368c62c\dsreg.dll.mui Handle ID: 0x6ac Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-eapteap.resources_31bf3856ad364e35_10.0.26100.1_en-us_cb75146e0e9cede0\EapTeapAuth.dll.mui Handle ID: 0xa60 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-e..host-peer.resources_31bf3856ad364e35_10.0.26100.1_en-us_27144980890e384b\eapphost.dll.mui Handle ID: 0x77c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-efs-service.resources_31bf3856ad364e35_10.0.26100.1_en-us_49d6b752b55e2b1a\efssvc.dll.mui Handle ID: 0x1054 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-e..t-service.resources_31bf3856ad364e35_10.0.26100.1_en-us_9c37b45119cf24ce\eapsvc.dll.mui Handle ID: 0xa80 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-diskpart.resources_31bf3856ad364e35_10.0.26100.1_en-us_cd8b43a2a653cf64\diskpart.exe.mui Handle ID: 0x1164 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-e..e-library.resources_31bf3856ad364e35_10.0.26100.1_en-us_0f5d64ae7c1c2886\efscore.dll.mui Handle ID: 0x9b4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-expand.resources_31bf3856ad364e35_10.0.26100.1_en-us_87e1408065d4da64\expand.exe.mui Handle ID: 0xe1c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-e..ingfaults.resources_31bf3856ad364e35_10.0.26100.1_en-us_7380082b9749e3a3\faultrep.dll.mui Handle ID: 0xfd0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-m..utilities.resources_31bf3856ad364e35_10.0.26100.1_en-us_3d66133be7ddeb80\find.exe.mui Handle ID: 0xcd0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-etw-ese.resources_31bf3856ad364e35_10.0.26100.1_en-us_f14681544809a39a\ETWESEProviderResources.dll.mui Handle ID: 0xbe8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-t..p-utility.resources_31bf3856ad364e35_10.0.26100.1_en-us_f15dd89d07843455\finger.exe.mui Handle ID: 0xdcc Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-f..iguration.resources_31bf3856ad364e35_10.0.26100.1_en-us_5f634db126144927\fcon.dll.mui Handle ID: 0xfd4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-mapi.resources_31bf3856ad364e35_10.0.26100.1_en-us_276ec89252c4c4c3\fixmapi.exe.mui Handle ID: 0xd24 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-f..-settings.resources_31bf3856ad364e35_10.0.26100.1_en-us_f20d175274df0b82\FlightSettings.dll.mui Handle ID: 0xd1c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-lddmcore.resources_31bf3856ad364e35_10.0.26100.1_en-us_97f8f55b7e970b0c\dxgkrnl.sys.mui Handle ID: 0x10c4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-e..gine-isam.resources_31bf3856ad364e35_10.0.26100.1_en-us_68cd365bddb88cf9\ESENT.dll.mui Handle ID: 0xcec Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-f..ger-utils.resources_31bf3856ad364e35_10.0.26100.1_en-us_c5018f88e0ce762d\fltlib.dll.mui Handle ID: 0xce0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-f..ger-utils.resources_31bf3856ad364e35_10.0.26100.1_en-us_c5018f88e0ce762d\fltMC.exe.mui Handle ID: 0xfb8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-g..licy-base.resources_31bf3856ad364e35_10.0.26100.1_en-us_be2843fbd972ca37\gpapi.dll.mui Handle ID: 0x1098 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-ftp.resources_31bf3856ad364e35_10.0.26100.1_en-us_0f126c6e0876fff8\ftp.exe.mui Handle ID: 0x1068 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_hid-dll.resources_31bf3856ad364e35_10.0.26100.1_en-us_14d00ece9ddf093d\hid.dll.mui Handle ID: 0xfe8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_hid-user.resources_31bf3856ad364e35_10.0.26100.1_en-us_6296385c53bf0882\hidserv.dll.mui Handle ID: 0x80c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-s..rtup-core.resources_31bf3856ad364e35_10.0.26100.1_en-us_5214fe76962861f0\fveapi.dll.mui Handle ID: 0x964 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-t..p-utility.resources_31bf3856ad364e35_10.0.26100.1_en-us_f15dd89d07843455\hostname.exe.mui Handle ID: 0xae0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-http-api.resources_31bf3856ad364e35_10.0.26100.1_en-us_526603e39adc1b05\httpapi.dll.mui Handle ID: 0x71c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..utilities.resources_31bf3856ad364e35_11.0.26100.1_en-us_fb8706149352c042\iertutil.dll.mui Handle ID: 0xd38 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-g..licy-base.resources_31bf3856ad364e35_10.0.26100.1_en-us_be2843fbd972ca37\gpsvc.dll.mui Handle ID: 0xc70 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-n..-security.resources_31bf3856ad364e35_10.0.26100.1_en-us_4b297241ad2021d1\ikeext.dll.mui Handle ID: 0x92c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-icacls.resources_31bf3856ad364e35_10.0.26100.1_en-us_f2bfc893f001933b\ICacls.exe.mui Handle ID: 0xb20 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..egacyshim.resources_31bf3856ad364e35_10.0.26100.1_en-us_2067d7da819f1e9d\imapi.dll.mui Handle ID: 0x10a4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-rasifmon.resources_31bf3856ad364e35_10.0.26100.1_en-us_ab8f243055cfc0d1\ifmon.dll.mui Handle ID: 0x714 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..ltinstall.resources_31bf3856ad364e35_10.0.26100.1_en-us_add06455da2689f9\InfDefaultInstall.exe.mui Handle ID: 0xd74 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-imapiv2-base.resources_31bf3856ad364e35_10.0.26100.1_en-us_d60f57bc72425398\imapi2.dll.mui Handle ID: 0xcb0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-n..-security.resources_31bf3856ad364e35_10.0.26100.1_en-us_4b297241ad2021d1\fwpuclnt.dll.mui Handle ID: 0x11b0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-t..libraries.resources_31bf3856ad364e35_10.0.26100.1_en-us_79682cc077c0c116\iphlpapi.dll.mui Handle ID: 0xb60 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-n..ients-svc.resources_31bf3856ad364e35_10.0.26100.1_en-us_ba5fa0591f3b6b1a\ipsecsvc.dll.mui Handle ID: 0xa50 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-t..-inputdll.resources_31bf3856ad364e35_10.0.26100.1_en-us_7b3d86726e862218\input.dll.mui Handle ID: 0xd4c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_iscsi.inf.resources_31bf3856ad364e35_10.0.26100.1_en-us_ea44bb848a5872e7\iscsilog.dll.mui Handle ID: 0x948 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-ipconfig.resources_31bf3856ad364e35_10.0.26100.1_en-us_c4d0d74c66458d39\ipconfig.exe.mui Handle ID: 0xc88 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-c..deronline.resources_31bf3856ad364e35_10.0.26100.1_en-us_f1ccda6ecefee544\joinproviderol.dll.mui Handle ID: 0x900 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_networking-mpssvc-svc.resources_31bf3856ad364e35_10.0.26100.1_en-us_845c5c92f704c625\FirewallAPI.dll.mui Handle ID: 0xd84 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-kdscli.resources_31bf3856ad364e35_10.0.26100.1_en-us_b33652ce186e3d4a\KdsCli.dll.mui Handle ID: 0x1178 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-s..-kerberos.resources_31bf3856ad364e35_10.0.26100.1_en-us_7ba64fa385b67e58\kerberos.dll.mui Handle ID: 0xfc4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-keyiso.resources_31bf3856ad364e35_10.0.26100.1_en-us_077ea9a1dc9d4da4\keyiso.dll.mui Handle ID: 0x1150 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-rasbase.resources_31bf3856ad364e35_10.0.26100.1_en-us_5b0b39a61e2df72f\kmddsp.tsp.mui Handle ID: 0x974 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-lmhsvc.resources_31bf3856ad364e35_10.0.26100.1_en-us_e1a80a13742e8fc5\lmhsvc.dll.mui Handle ID: 0xd88 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-p..xecutable.resources_31bf3856ad364e35_10.0.26100.1_en-us_662e4e2fccbc292d\loadperf.dll.mui Handle ID: 0x10ec Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-fsutil.resources_31bf3856ad364e35_10.0.26100.1_en-us_661d69af3765c65f\fsutil.exe.mui Handle ID: 0x10d4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-p..xecutable.resources_31bf3856ad364e35_10.0.26100.1_en-us_662e4e2fccbc292d\lodctr.exe.mui Handle ID: 0xfdc Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-l..r-library.resources_31bf3856ad364e35_10.0.26100.1_en-us_45825672a926c8e1\LogonController.dll.mui Handle ID: 0x1270 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-s..-kerberos.resources_31bf3856ad364e35_10.0.26100.1_en-us_7ba64fa385b67e58\localkdcsvc.dll.mui Handle ID: 0x1208 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-s..on-netapi.resources_31bf3856ad364e35_10.0.26100.1_en-us_ed1c94089619dd01\logoncli.dll.mui Handle ID: 0x7a8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-t..onmanager.resources_31bf3856ad364e35_10.0.26100.1_en-us_d9857636a5632e01\lsm.dll.mui Handle ID: 0x1064 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-mapi.resources_31bf3856ad364e35_10.0.26100.1_en-us_276ec89252c4c4c3\mapistub.dll.mui Handle ID: 0xa6c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-mapi.resources_31bf3856ad364e35_10.0.26100.1_en-us_276ec89252c4c4c3\mapi32.dll.mui Handle ID: 0x1040 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-mfc42x.resources_31bf3856ad364e35_10.0.26100.1_en-us_bf956144f7916cd2\MFC42u.dll.mui Handle ID: 0x7dc Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-mfc42x.resources_31bf3856ad364e35_10.0.26100.1_en-us_bf956144f7916cd2\MFC42.dll.mui Handle ID: 0x720 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-lsa.resources_31bf3856ad364e35_10.0.26100.1_en-us_839b7cb1ff27f1ac\lsasrv.dll.mui Handle ID: 0x740 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-h..container.resources_31bf3856ad364e35_10.0.26100.1_en-us_c50744028a9f4b3f\microsoft-windows-hal-events.dll.mui Handle ID: 0xcbc Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-k..container.resources_31bf3856ad364e35_10.0.26100.1_en-us_f5166111dedeb21a\microsoft-windows-kernel-processor-power-events.dll.mui Handle ID: 0xd58 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-k..container.resources_31bf3856ad364e35_10.0.26100.1_en-us_f0b41ed2db7299fa\microsoft-windows-kernel-pnp-events.dll.mui Handle ID: 0x1240 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-e..tservices.resources_31bf3856ad364e35_10.0.26100.1_en-us_bf9a911deef0180c\microsoft-windows-sac-events.dll.mui Handle ID: 0x11ec Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-s..container.resources_31bf3856ad364e35_10.0.26100.1_en-us_f5dedf5be6bb51e0\microsoft-windows-storage-tiering-events.dll.mui Handle ID: 0x78c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-k..container.resources_31bf3856ad364e35_10.0.26100.1_en-us_b2154f439dc68293\microsoft-windows-kernel-power-events.dll.mui Handle ID: 0xe2c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-pdc-events-container.resources_31bf3856ad364e35_10.0.26100.1_en-us_bf8cf75f207add33\microsoft-windows-pdc.dll.mui Handle ID: 0xa54 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-mountvol.resources_31bf3856ad364e35_10.0.26100.1_en-us_8066262f2da7c1ee\mountvol.exe.mui Handle ID: 0x694 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-mpr.resources_31bf3856ad364e35_10.0.26100.1_en-us_b779365c9c8cb3c7\mpr.dll.mui Handle ID: 0xd94 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-m..extension.resources_31bf3856ad364e35_10.0.26100.1_en-us_e0a4ffa1b427ee51\mprext.dll.mui Handle ID: 0xa58 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-wsp-spaces.resources_31bf3856ad364e35_10.0.26100.1_en-us_97c09fdd85e9e5dc\mispace.dll.mui Handle ID: 0x954 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..emsupport.resources_31bf3856ad364e35_10.0.26100.1_en-us_fcdca7b1b81d5a35\imapi2fs.dll.mui Handle ID: 0xd04 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_networking-mpssvc-drv.resources_31bf3856ad364e35_10.0.26100.1_en-us_4ab7f7a1ee53aafb\mpsdrv.sys.mui Handle ID: 0xe8c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-t..p-utility.resources_31bf3856ad364e35_10.0.26100.1_en-us_f15dd89d07843455\mrinfo.exe.mui Handle ID: 0x8e0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_networking-mpssvc-svc.resources_31bf3856ad364e35_10.0.26100.1_en-us_845c5c92f704c625\mpssvc.dll.mui Handle ID: 0x1038 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-t..ork-msctf.resources_31bf3856ad364e35_10.0.26100.1_en-us_a458d72d21d1f811\msctf.dll.mui Handle ID: 0xb34 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-msftedit.resources_31bf3856ad364e35_10.0.26100.1_en-us_d7d3da7be2e5ce5e\msftedit.dll.mui Handle ID: 0xb64 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-m..otect-dll.resources_31bf3856ad364e35_10.0.26100.1_en-us_998f69bb6c74177f\mskeyprotect.dll.mui Handle ID: 0xf4c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-mprmsg.resources_31bf3856ad364e35_10.0.26100.1_en-us_81d37f4a364e97f8\mprmsg.dll.mui Handle ID: 0xc2c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-msports.resources_31bf3856ad364e35_10.0.26100.1_en-us_d7f6857348977de8\msports.dll.mui Handle ID: 0xb08 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-mssign32-dll.resources_31bf3856ad364e35_10.0.26100.1_en-us_baeaeeff5c6da077\mssign32.dll.mui Handle ID: 0x100c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-s..container.resources_31bf3856ad364e35_10.0.26100.1_en-us_5223b64df2405fed\microsoft-windows-system-events.dll.mui Handle ID: 0xaac Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-s..rity-ntlm.resources_31bf3856ad364e35_10.0.26100.1_en-us_6508a6bad4f4b01a\msv1_0.dll.mui Handle ID: 0x11a8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-w..cture-bsp.resources_31bf3856ad364e35_10.0.26100.1_en-us_cad4e4e5cc425932\mswsock.dll.mui Handle ID: 0xb8c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-m..ditevtlog.resources_31bf3856ad364e35_10.0.26100.1_en-us_56f94c53c2690152\msaudite.dll.mui Handle ID: 0xfbc Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-m..ditevtlog.resources_31bf3856ad364e35_10.0.26100.1_en-us_56f94c53c2690152\msobjs.dll.mui Handle ID: 0xef8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-netshell-mui.resources_31bf3856ad364e35_10.0.26100.1_en-us_4bed20fea307bd87\ncpa.cpl.mui Handle ID: 0x1110 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-nbtstat.resources_31bf3856ad364e35_10.0.26100.1_en-us_b86467978422fcaa\nbtstat.exe.mui Handle ID: 0x1264 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-n..tprov-dll.resources_31bf3856ad364e35_10.0.26100.1_en-us_8682985ff7276162\ncryptprov.dll.mui Handle ID: 0xa94 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-ncrypt.resources_31bf3856ad364e35_10.0.26100.1_en-us_c6eda8dfbf04fc36\ncrypt.dll.mui Handle ID: 0x904 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-newdev.resources_31bf3856ad364e35_10.0.26100.1_en-us_6fff56ec85166229\ndadmin.exe.mui Handle ID: 0x8ec Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-netbt.resources_31bf3856ad364e35_10.0.26100.1_en-us_4e3490d063f1f0a9\netbtugc.exe.mui Handle ID: 0xfe4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-netcfg.resources_31bf3856ad364e35_10.0.26100.1_en-us_34e7296c89d348cb\netcfg.exe.mui Handle ID: 0x7d4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-n..ingengine.resources_31bf3856ad364e35_10.0.26100.1_en-us_221edeaf25718062\netcfgx.dll.mui Handle ID: 0x1034 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-msxml30.resources_31bf3856ad364e35_10.0.26100.1_en-us_36b28a25af59db7a\msxml3r.dll.mui Handle ID: 0xe88 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-tcpip.resources_31bf3856ad364e35_10.0.26100.1_en-us_c93621b935b09922\netiougc.exe.mui Handle ID: 0x928 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-netjoin.resources_31bf3856ad364e35_10.0.26100.1_en-us_74682c3a3a3e280b\netjoin.dll.mui Handle ID: 0x830 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-msxml60.resources_31bf3856ad364e35_10.0.26100.1_en-us_d286faaeefe774ff\msxml6r.dll.mui Handle ID: 0x764 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-s..-netlogon.resources_31bf3856ad364e35_10.0.26100.1_en-us_2cb72d4a875cc455\netlogon.dll.mui Handle ID: 0x9a0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-n..line-tool.resources_31bf3856ad364e35_10.0.26100.1_en-us_b7fc61542b42b8c7\neth.dll.mui Handle ID: 0x700 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-n..rkprofile.resources_31bf3856ad364e35_10.0.26100.1_en-us_aa39ab5ac356acdf\netprofmsvc.dll.mui Handle ID: 0xa9c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-n..ork-setup.resources_31bf3856ad364e35_10.0.26100.1_en-us_d9d8838fbc25888e\NetSetupSvc.dll.mui Handle ID: 0x126c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-netsh.resources_31bf3856ad364e35_10.0.26100.1_en-us_28b7081035bdc8d4\netsh.exe.mui Handle ID: 0x12a0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-t..p-utility.resources_31bf3856ad364e35_10.0.26100.1_en-us_f15dd89d07843455\netstat.exe.mui Handle ID: 0x1138 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-newdev.resources_31bf3856ad364e35_10.0.26100.1_en-us_6fff56ec85166229\newdev.dll.mui Handle ID: 0xdb8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-netshell-mui.resources_31bf3856ad364e35_10.0.26100.1_en-us_4bed20fea307bd87\netshell.dll.mui Handle ID: 0xef0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-newdev.resources_31bf3856ad364e35_10.0.26100.1_en-us_6fff56ec85166229\newdev.exe.mui Handle ID: 0xe18 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-t..ut-ninput.resources_31bf3856ad364e35_10.0.26100.1_en-us_1d18bcddcaf2ee83\Ninput.dll.mui Handle ID: 0xbcc Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-d..sh-helper.resources_31bf3856ad364e35_10.0.26100.1_en-us_502ed721c0b7b87a\nshdnsclient.dll.mui Handle ID: 0xf88 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-usermodensi.resources_31bf3856ad364e35_10.0.26100.1_en-us_3944be89485fcd02\nsisvc.dll.mui Handle ID: 0x5d4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-ntasn1.resources_31bf3856ad364e35_10.0.26100.1_en-us_5344f191360536c3\ntasn1.dll.mui Handle ID: 0xdd4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-b..isc-tools.resources_31bf3856ad364e35_10.0.26100.1_en-us_e03a7fcf89c463d7\netmsg.dll.mui Handle ID: 0xe0c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\wow64_microsoft-windows-ntlanman.resources_31bf3856ad364e35_10.0.26100.1_en-us_4309da05e54aa326\ntlanman.dll.mui Handle ID: 0xe20 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-n..-security.resources_31bf3856ad364e35_10.0.26100.1_en-us_4b297241ad2021d1\nshwfp.dll.mui Handle ID: 0x8d4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-s..y-ntmarta.resources_31bf3856ad364e35_10.0.26100.1_en-us_86a1606342ddb8d8\ntmarta.dll.mui Handle ID: 0x10b4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-p..i-ntprint.resources_31bf3856ad364e35_10.0.26100.1_en-us_6ff199c21e8ad886\ntprint.exe.mui Handle ID: 0x968 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-t..p-utility.resources_31bf3856ad364e35_10.0.26100.1_en-us_f15dd89d07843455\netiohlp.dll.mui Handle ID: 0x9e0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-ntshrui.resources_31bf3856ad364e35_10.0.26100.1_en-us_f5432cb87c45827d\ntshrui.dll.mui Handle ID: 0xd54 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-m..nager-rll.resources_31bf3856ad364e35_10.0.26100.1_en-us_2cd0f412bbfbe232\odbcint.dll.mui Handle ID: 0x10a0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-p..i-ntprint.resources_31bf3856ad364e35_10.0.26100.1_en-us_6ff199c21e8ad886\ntprint.dll.mui Handle ID: 0xbc0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-com-ole.resources_31bf3856ad364e35_10.0.26100.1_en-us_e14a3e8b8b845cf8\ole32.dll.mui Handle ID: 0xdd0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-o..gs-client.resources_31bf3856ad364e35_10.0.26100.1_en-us_c8b698ceb6097e8f\OneSettingsClient.dll.mui Handle ID: 0xa84 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-openwith.resources_31bf3856ad364e35_10.0.26100.1_en-us_20292d7962b08378\OpenWith.exe.mui Handle ID: 0x1294 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-pcwum.resources_31bf3856ad364e35_10.0.26100.1_en-us_fa62b356a7268a60\pcwum.dll.mui Handle ID: 0x70c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-p..utilities.resources_31bf3856ad364e35_10.0.26100.1_en-us_892fb9dcc69f265f\pathping.exe.mui Handle ID: 0x8a8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-p..ecounters.resources_31bf3856ad364e35_10.0.26100.1_en-us_2287fd8f3fd61572\perfdisk.dll.mui Handle ID: 0xeb0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-oleaccrc.resources_31bf3856ad364e35_10.0.26100.1_en-us_fd4c697a5f16de70\oleaccrc.dll.mui Handle ID: 0xdb0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-p..ecounters.resources_31bf3856ad364e35_10.0.26100.1_en-us_2287fd8f3fd61572\perfnet.dll.mui Handle ID: 0xcd4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-p..ecounters.resources_31bf3856ad364e35_10.0.26100.1_en-us_2287fd8f3fd61572\perfproc.dll.mui Handle ID: 0x8ac Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-p..ecounters.resources_31bf3856ad364e35_10.0.26100.1_en-us_2287fd8f3fd61572\perfos.dll.mui Handle ID: 0xcc4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-d..ouppolicy.resources_31bf3856ad364e35_10.0.26100.1_en-us_911df262bc90dd51\pnppolicy.dll.mui Handle ID: 0xbc8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-pnpclean.resources_31bf3856ad364e35_10.0.26100.1_en-us_f045d46940b45f8b\pnpclean.dll.mui Handle ID: 0x83c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-pnpui.resources_31bf3856ad364e35_10.0.26100.1_en-us_c5efacc6d0ec6126\pnpui.dll.mui Handle ID: 0xf38 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-p..utilities.resources_31bf3856ad364e35_10.0.26100.1_en-us_892fb9dcc69f265f\ping.exe.mui Handle ID: 0xa0c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-n..ients-svc.resources_31bf3856ad364e35_10.0.26100.1_en-us_ba5fa0591f3b6b1a\polstore.dll.mui Handle ID: 0xad4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-s..cingstack.resources_31bf3856ad364e35_10.0.26100.1_en-us_89ad6321fd4fc0de\poqexec.exe.mui Handle ID: 0xa68 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-p..npeplugin.resources_31bf3856ad364e35_10.0.26100.1_en-us_42a947a2f851e6bd\PnPUnattend.exe.mui Handle ID: 0x1220 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-pnputil.resources_31bf3856ad364e35_10.0.26100.1_en-us_d9a150a91eae659e\pnputil.exe.mui Handle ID: 0x980 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-p..minkernel.resources_31bf3856ad364e35_10.0.26100.1_en-us_6680f00942f59cb1\prflbmsg.dll.mui Handle ID: 0x8dc Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-m..utilities.resources_31bf3856ad364e35_10.0.26100.1_en-us_8273ffd35c310c8d\print.exe.mui Handle ID: 0xf68 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-p..n-cmdline.resources_31bf3856ad364e35_10.0.26100.1_en-us_33623264345b030a\powercfg.exe.mui Handle ID: 0x87c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-userenvext.resources_31bf3856ad364e35_10.0.26100.1_en-us_dd68a7e2e7743d85\profext.dll.mui Handle ID: 0xa04 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-u..anagement.resources_31bf3856ad364e35_10.0.26100.1_en-us_02369df692f85f5f\powrprof.dll.mui Handle ID: 0x908 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-profsvc.resources_31bf3856ad364e35_10.0.26100.1_en-us_63afbc426d007f3f\profsvc.dll.mui Handle ID: 0x9a8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-propsys.resources_31bf3856ad364e35_7.0.26100.1_en-us_5f955c5e0343a900\propsys.dll.mui Handle ID: 0x1108 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-o..-base-vpn.resources_31bf3856ad364e35_10.0.26100.1_en-us_5e9b718be2237e81\rasapi32.dll.mui Handle ID: 0xb88 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-pshed.resources_31bf3856ad364e35_10.0.26100.1_en-us_9087ecfce1b0fb16\pshed.dll.mui Handle ID: 0xc04 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-rasauto-mui.resources_31bf3856ad364e35_10.0.26100.1_en-us_c4254516aecc127f\rasauto.dll.mui Handle ID: 0x9dc Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-rasauto-mui.resources_31bf3856ad364e35_10.0.26100.1_en-us_c4254516aecc127f\rasautou.exe.mui Handle ID: 0xa34 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-o..p-raschap.resources_31bf3856ad364e35_10.0.26100.1_en-us_0e90e4b3121a1266\raschap.dll.mui Handle ID: 0xb40 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-rasctrs.resources_31bf3856ad364e35_10.0.26100.1_en-us_bd22249a469c8ffc\rasctrs.dll.mui Handle ID: 0x788 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-raschap.resources_31bf3856ad364e35_10.0.26100.1_en-us_2bad31da7e8f16be\raschapext.dll.mui Handle ID: 0xc18 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-rasbase.resources_31bf3856ad364e35_10.0.26100.1_en-us_5b0b39a61e2df72f\rasdiag.dll.mui Handle ID: 0xb38 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-r..rvice-mui.resources_31bf3856ad364e35_10.0.26100.1_en-us_1ba9dc391a362baf\rasmans.dll.mui Handle ID: 0xc58 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-r..tymanager.resources_31bf3856ad364e35_10.0.26100.1_en-us_a5a8d102ba39052c\rasmbmgr.dll.mui Handle ID: 0x1238 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-p..i-printui.resources_31bf3856ad364e35_10.0.26100.1_en-us_61756ced46f65014\printui.dll.mui Handle ID: 0x890 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-kernel32.resources_31bf3856ad364e35_10.0.26100.1_en-us_3a0e6bde8dd1141c\kernel32.dll.mui Handle ID: 0x8a0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-r..iagnostic.resources_31bf3856ad364e35_10.0.26100.1_en-us_2b35d63b86aa2a72\rdrleakdiag.exe.mui Handle ID: 0xa38 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-recover.resources_31bf3856ad364e35_10.0.26100.1_en-us_6036b6b5128ee74e\recover.exe.mui Handle ID: 0xdd8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-o..ap-rastls.resources_31bf3856ad364e35_10.0.26100.1_en-us_7146e68ab6c9bca1\rastls.dll.mui Handle ID: 0xc14 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-rastls.resources_31bf3856ad364e35_10.0.26100.1_en-us_ac2e0a409106d9e7\rastlsext.dll.mui Handle ID: 0xbd0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-s..sdedupsvc.resources_31bf3856ad364e35_10.0.26100.1_en-us_398216b0027c5104\refsdedupsvc.exe.mui Handle ID: 0xd60 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-regsvr32.resources_31bf3856ad364e35_10.0.26100.1_en-us_1639212dc9867110\regsvr32.exe.mui Handle ID: 0xadc Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-m..utilities.resources_31bf3856ad364e35_10.0.26100.1_en-us_3d66133be7ddeb80\replace.exe.mui Handle ID: 0xf48 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-f..lientcore.resources_31bf3856ad364e35_10.0.26100.1_en-us_dcc7c012061e0371\resutils.dll.mui Handle ID: 0x718 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-r..ne-editor.resources_31bf3856ad364e35_10.0.26100.1_en-us_b090499c67e0c8df\reg.exe.mui Handle ID: 0xe30 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-refsutil.resources_31bf3856ad364e35_10.0.26100.1_en-us_f19015aca6a796e0\refsutil.exe.mui Handle ID: 0xb54 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-t..p-utility.resources_31bf3856ad364e35_10.0.26100.1_en-us_f15dd89d07843455\route.exe.mui Handle ID: 0x111c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-r..intmapper.resources_31bf3856ad364e35_10.0.26100.1_en-us_e78c7242621d04f0\RpcEpMap.dll.mui Handle ID: 0xbe4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-robocopy.resources_31bf3856ad364e35_10.0.26100.1_en-us_b1be676858fb1bed\Robocopy.exe.mui Handle ID: 0xe98 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-rasrtutils.resources_31bf3856ad364e35_10.0.26100.1_en-us_da2956087b625e65\rtutils.dll.mui Handle ID: 0x848 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-rundll32.resources_31bf3856ad364e35_10.0.26100.1_en-us_49bf2b2101f15696\rundll32.exe.mui Handle ID: 0x1008 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-c..to-rsaenh.resources_31bf3856ad364e35_10.0.26100.1_en-us_5da8c5a88f5226c9\rsaenh.dll.mui Handle ID: 0x1050 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-e..tservices.resources_31bf3856ad364e35_10.0.26100.1_en-us_bf9a911deef0180c\sacsess.exe.mui Handle ID: 0xea8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-e..tservices.resources_31bf3856ad364e35_10.0.26100.1_en-us_bf9a911deef0180c\sacsvr.dll.mui Handle ID: 0x1198 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-d..es-samlib.resources_31bf3856ad364e35_10.0.26100.1_en-us_03b260e0a1de5913\samlib.dll.mui Handle ID: 0xebc Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-rpc-local.resources_31bf3856ad364e35_10.0.26100.1_en-us_98af46fe2617cb87\rpcrt4.dll.mui Handle ID: 0x10e8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-rasdlg.resources_31bf3856ad364e35_10.0.26100.1_en-us_b301da7eb08f6843\rasdlg.dll.mui Handle ID: 0x10d0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-rasmontr.resources_31bf3856ad364e35_10.0.26100.1_en-us_1cd588d1b4a1b0c6\rasmontr.dll.mui Handle ID: 0x114c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-s..-schannel.resources_31bf3856ad364e35_10.0.26100.1_en-us_e4146f07a16fb35d\schannel.dll.mui Handle ID: 0x944 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-sechost.resources_31bf3856ad364e35_10.0.26100.1_en-us_da160a4397af0ecb\sechost.dll.mui Handle ID: 0xb50 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\wow64_microsoft-windows-ntdll.resources_31bf3856ad364e35_10.0.26100.1_en-us_6fdd05c7f90f5019\ntdll.dll.mui Handle ID: 0xec0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-kernelbase.resources_31bf3856ad364e35_10.0.26100.1_en-us_751063101f14c91a\KernelBase.dll.mui Handle ID: 0xbfc Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-s..ineclient.resources_31bf3856ad364e35_10.0.26100.1_en-us_49ae546445a69772\scecli.dll.mui Handle ID: 0xcf4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-shcore.resources_31bf3856ad364e35_10.0.26100.1_en-us_cece7c2a1713d16c\SHCore.dll.mui Handle ID: 0x5d8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-s..ontroller.resources_31bf3856ad364e35_10.0.26100.1_en-us_66f0ef778e81c846\services.exe.mui Handle ID: 0x7f8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-w..ty-client.resources_31bf3856ad364e35_10.0.26100.1_en-us_13750fd03c1ca21d\sfc.exe.mui Handle ID: 0xff8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-s..ionengine.resources_31bf3856ad364e35_10.0.26100.1_en-us_e63bd45b831a32e3\scesrv.dll.mui Handle ID: 0x6f4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-shlwapi.resources_31bf3856ad364e35_10.0.26100.1_en-us_50c321018c95a7b2\shlwapi.dll.mui Handle ID: 0xf30 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-shutdownux.resources_31bf3856ad364e35_10.0.26100.1_en-us_7dad665c352e5927\ShutdownUX.dll.mui Handle ID: 0x1174 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-smss.resources_31bf3856ad364e35_10.0.26100.1_en-us_e15de0c3c7c19712\smss.exe.mui Handle ID: 0x730 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-s..rver-apis.resources_31bf3856ad364e35_10.0.26100.1_en-us_5c434b2f0b8aff65\smbwmiv2.dll.mui Handle ID: 0x122c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-setupapi.resources_31bf3856ad364e35_10.0.26100.1_en-us_675475b2dfeed211\setupapi.dll.mui Handle ID: 0xce8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-d..vices-sam.resources_31bf3856ad364e35_10.0.26100.1_en-us_1173e6cfa8041172\samsrv.dll.mui Handle ID: 0xe34 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-pnpsysprep.resources_31bf3856ad364e35_10.0.26100.1_en-us_ce1162fe9e928cd4\sppnp.dll.mui Handle ID: 0x734 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-smbserver.resources_31bf3856ad364e35_10.0.26100.1_en-us_7dfb0194fc59c309\srvsvc.dll.mui Handle ID: 0xb14 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-smbserver.resources_31bf3856ad364e35_10.0.26100.1_en-us_7dfb0194fc59c309\sscore.dll.mui Handle ID: 0x82c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-wsp-spaces.resources_31bf3856ad364e35_10.0.26100.1_en-us_97c09fdd85e9e5dc\smphost.dll.mui Handle ID: 0x6e8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-m..utilities.resources_31bf3856ad364e35_10.0.26100.1_en-us_8273ffd35c310c8d\subst.exe.mui Handle ID: 0x984 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-s..s-svchost.resources_31bf3856ad364e35_10.0.26100.1_en-us_4e3c993a10063df5\svchost.exe.mui Handle ID: 0x7bc Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-svsvc.resources_31bf3856ad364e35_10.0.26100.1_en-us_afbc214fef1b53b9\svsvc.dll.mui Handle ID: 0xdc0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-v..mprovider.resources_31bf3856ad364e35_10.0.26100.1_en-us_5c602569fbc089fe\swprv.dll.mui Handle ID: 0x107c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-s..pp-client.resources_31bf3856ad364e35_10.0.26100.1_en-us_363dc0314a9a290e\slc.dll.mui Handle ID: 0x11fc Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-r..e-rassstp.resources_31bf3856ad364e35_10.0.26100.1_en-us_e5d2efa5c15c5086\sstpsvc.dll.mui Handle ID: 0x924 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-sysclass.resources_31bf3856ad364e35_10.0.26100.1_en-us_06ecfb6dd17d05a9\sysclass.dll.mui Handle ID: 0x1014 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-s..spaceutil.resources_31bf3856ad364e35_10.0.26100.1_en-us_079b236bf9684fe9\spaceutil.exe.mui Handle ID: 0xae8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-storprop.resources_31bf3856ad364e35_10.0.26100.1_en-us_c5967c8c65167a6d\Storprop.dll.mui Handle ID: 0xe94 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-s..ntsbroker.resources_31bf3856ad364e35_10.0.26100.1_en-us_1460b1e0c484a79d\SystemEventsBrokerServer.dll.mui Handle ID: 0xb04 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-tapi2xclient.resources_31bf3856ad364e35_10.0.26100.1_en-us_e60224ae5e0b5cdd\tapi32.dll.mui Handle ID: 0xb0c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-sxs.resources_31bf3856ad364e35_10.0.26100.1_en-us_eec4d657ee5ade1a\sxstrace.exe.mui Handle ID: 0x81c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-sxs.resources_31bf3856ad364e35_10.0.26100.1_en-us_eec4d657ee5ade1a\sxs.dll.mui Handle ID: 0x824 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-s..pp-client.resources_31bf3856ad364e35_10.0.26100.1_en-us_363dc0314a9a290e\sppc.dll.mui Handle ID: 0xeac Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-timebroker.resources_31bf3856ad364e35_10.0.26100.1_en-us_176c0976ea2d675e\TimeBrokerServer.dll.mui Handle ID: 0xda8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-takeown.resources_31bf3856ad364e35_10.0.26100.1_en-us_b32bf585597a22bb\takeown.exe.mui Handle ID: 0xc3c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-p..utilities.resources_31bf3856ad364e35_10.0.26100.1_en-us_892fb9dcc69f265f\tracert.exe.mui Handle ID: 0x11d8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-s..-credprov.resources_31bf3856ad364e35_10.0.26100.1_en-us_080e5e17ad23b7b4\TrustedSignalCredProv.dll.mui Handle ID: 0xe40 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_wdmaudio.inf.resources_31bf3856ad364e35_10.0.26100.1_en-us_882f4b16d4a9931c\sysfxui.dll.mui Handle ID: 0x7b0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-eapttls.resources_31bf3856ad364e35_10.0.26100.1_en-us_f9aaeebef6432e81\TtlsAuth.dll.mui Handle ID: 0xc94 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-eapttls.resources_31bf3856ad364e35_10.0.26100.1_en-us_f9aaeebef6432e81\TtlsCfg.dll.mui Handle ID: 0x874 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-t..x-library.resources_31bf3856ad364e35_10.0.26100.1_en-us_916010a014d60a40\TSSessionUX.dll.mui Handle ID: 0x770 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-tcpip.resources_31bf3856ad364e35_10.0.26100.1_en-us_c93621b935b09922\tcpipcfg.dll.mui Handle ID: 0x8d8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-l..skmanager.resources_31bf3856ad364e35_10.0.26100.1_en-us_ec2d13d524add5a1\taskmgr.exe.mui Handle ID: 0x11a4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-u..erservice.resources_31bf3856ad364e35_10.0.26100.1_en-us_edbb1f11fa6117d6\umpo.dll.mui Handle ID: 0x1248 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-p..xecutable.resources_31bf3856ad364e35_10.0.26100.1_en-us_662e4e2fccbc292d\unlodctr.exe.mui Handle ID: 0xfc8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-u..ationcore.resources_31bf3856ad364e35_10.0.26100.1_en-us_077597209181da9c\UIAutomationCore.dll.mui Handle ID: 0x8f8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-onecore-pnp-umpnpmgr.resources_31bf3856ad364e35_10.0.26100.1_en-us_62d5ec9df125e449\umpnpmgr.dll.mui Handle ID: 0xff4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-u..istration.resources_31bf3856ad364e35_10.0.26100.1_en-us_60b5c4eee368c62c\UserDeviceRegistration.dll.mui Handle ID: 0xfec Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-u..istration.resources_31bf3856ad364e35_10.0.26100.1_en-us_60b5c4eee368c62c\UserDeviceRegistration.Ngc.dll.mui Handle ID: 0x94c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-userenv.resources_31bf3856ad364e35_10.0.26100.1_en-us_c0e5ec418bfe8ddc\userenv.dll.mui Handle ID: 0xb44 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-userinit.resources_31bf3856ad364e35_10.0.26100.1_en-us_8ce44e8c3adf2d4b\userinit.exe.mui Handle ID: 0x1190 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-userinitext.resources_31bf3856ad364e35_10.0.26100.1_en-us_dbf7554e6d8c83de\userinitext.dll.mui Handle ID: 0x1020 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-user32.resources_31bf3856ad364e35_10.0.26100.1_en-us_3af1a02a93a9d492\user32.dll.mui Handle ID: 0x8bc Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-system-user-service.resources_31bf3856ad364e35_10.0.26100.1_en-us_69e36409445fe207\usermgr.dll.mui Handle ID: 0x774 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-u..ry-client.resources_31bf3856ad364e35_10.0.26100.1_en-us_c2c3e13fab05f906\utcutil.dll.mui Handle ID: 0x97c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..timezones.resources_31bf3856ad364e35_10.0.26100.1_en-us_8068fa6aea532025\tzres.dll.mui Handle ID: 0x868 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-t..s-utildll.resources_31bf3856ad364e35_10.0.26100.1_en-us_3dd672de227b7429\utildll.dll.mui Handle ID: 0x11e4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-v..cprovider.resources_31bf3856ad364e35_10.0.26100.1_en-us_13006c55a19711a3\vdsbas.dll.mui Handle ID: 0x11e8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-uxtheme.resources_31bf3856ad364e35_10.0.26100.1_en-us_1313a7c6af327bf8\uxtheme.dll.mui Handle ID: 0xe48 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-v..skservice.resources_31bf3856ad364e35_10.0.26100.1_en-us_9f0484d3550b518f\vds.exe.mui Handle ID: 0x798 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-v..kprovider.resources_31bf3856ad364e35_10.0.26100.1_en-us_2e2c0c7f8b25d665\vdsvd.dll.mui Handle ID: 0xc38 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-v..cprovider.resources_31bf3856ad364e35_10.0.26100.1_en-us_214c885645468d72\vdsdyn.dll.mui Handle ID: 0xfa4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..rityzones.resources_31bf3856ad364e35_11.0.26100.1_en-us_9f67d4d8b4dfe0a6\urlmon.dll.mui Handle ID: 0xf50 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-vssapi-core.resources_31bf3856ad364e35_10.0.26100.1_en-us_2ab8807bf9f9757e\vsstrace.dll.mui Handle ID: 0x115c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-d..rverifier.resources_31bf3856ad364e35_10.0.26100.1_en-us_68b100aa7970a8e2\verifiergui.exe.mui Handle ID: 0x834 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-onecore-d..ier-tools.resources_31bf3856ad364e35_10.0.26100.1_en-us_ca0d94c763e94a5a\verifier.exe.mui Handle ID: 0xf1c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-v..skservice.resources_31bf3856ad364e35_10.0.26100.1_en-us_9f0484d3550b518f\vdsutil.dll.mui Handle ID: 0xb7c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-w..component.resources_31bf3856ad364e35_10.0.26100.1_en-us_3cfc4ef37321793a\Websocket.dll.mui Handle ID: 0x998 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-webio.resources_31bf3856ad364e35_10.0.26100.1_en-us_fc6d4146a136cafe\webio.dll.mui Handle ID: 0xf94 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-time-service.resources_31bf3856ad364e35_10.0.26100.1_en-us_4ff97532fcaa3ca5\w32time.dll.mui Handle ID: 0x6c0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-e..ingfaults.resources_31bf3856ad364e35_10.0.26100.1_en-us_7380082b9749e3a3\WerFaultSecure.exe.mui Handle ID: 0xef4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-e..rtingcore.resources_31bf3856ad364e35_10.0.26100.1_en-us_000733769f592257\wer.dll.mui Handle ID: 0xba8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-eventlog-api.resources_31bf3856ad364e35_10.0.26100.1_en-us_20ca4913c0100623\wevtapi.dll.mui Handle ID: 0x858 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-f..k-service.resources_31bf3856ad364e35_10.0.26100.1_en-us_7febb5b7cee8a159\wersvc.dll.mui Handle ID: 0xd00 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-e..ingfaults.resources_31bf3856ad364e35_10.0.26100.1_en-us_7380082b9749e3a3\WerFault.exe.mui Handle ID: 0xe6c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-eventlog.resources_31bf3856ad364e35_10.0.26100.1_en-us_9afa77f3295b9e9a\wevtsvc.dll.mui Handle ID: 0x978 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-wimgapi.resources_31bf3856ad364e35_10.0.26100.1_en-us_164b3c67290ec94e\wimgapi.dll.mui Handle ID: 0x778 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-win32kbase.resources_31bf3856ad364e35_10.0.26100.1_en-us_1db2438ee272f57b\win32kbase.sys.mui Handle ID: 0xbf8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-winbio.resources_31bf3856ad364e35_10.0.26100.1_en-us_98ce6c4253cd970e\winbio.dll.mui Handle ID: 0xad8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-f..er-common.resources_31bf3856ad364e35_10.0.26100.1_en-us_42b90b8a6b79623d\Windows.FileExplorer.Common.dll.mui Handle ID: 0x1018 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-e..mmandline.resources_31bf3856ad364e35_10.0.26100.1_en-us_318cf1da5fcb28d0\wevtutil.exe.mui Handle ID: 0xea0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-wincredui.resources_31bf3856ad364e35_10.0.26100.1_en-us_a8e4eaf269609724\wincredui.dll.mui Handle ID: 0xf08 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-c..ontroller.resources_31bf3856ad364e35_10.0.26100.1_en-us_2834bbdd59bc7dab\Windows.UI.CredDialogController.dll.mui Handle ID: 0xbdc Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-wininit.resources_31bf3856ad364e35_10.0.26100.1_en-us_425939267313e02c\wininit.exe.mui Handle ID: 0xb68 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft.windows.winhttp.resources_31bf3856ad364e35_6.0.26100.1_en-us_7af19d2fa0066295\winhttp.dll.mui Handle ID: 0x6e4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-shell32.resources_31bf3856ad364e35_10.0.26100.1_en-us_569d6efa41683e79\shell32.dll.mui Handle ID: 0xb74 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..mentation.resources_31bf3856ad364e35_11.0.26100.1_en-us_4935ce3e2d0faab1\wininet.dll.mui Handle ID: 0xe80 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-a..core-base.resources_31bf3856ad364e35_10.0.26100.1_en-us_671f1cf35c5f642d\winmmbase.dll.mui Handle ID: 0x73c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-o..t-storage.resources_31bf3856ad364e35_10.0.26100.1_en-us_b013853d7dab78fa\windows.storage.dll.mui Handle ID: 0xe50 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-winpe_tools.resources_31bf3856ad364e35_10.0.26100.1_en-us_22fffc59729189ff\winpeshl.exe.mui Handle ID: 0xfc0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-s..temclient.resources_31bf3856ad364e35_10.0.26100.1_en-us_cf3226766c2544f9\WinSCard.dll.mui Handle ID: 0x1254 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-winlogon.resources_31bf3856ad364e35_10.0.26100.1_en-us_c7ec39eb6ca30cbf\winlogon.exe.mui Handle ID: 0x7ac Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-winsrv.resources_31bf3856ad364e35_10.0.26100.1_en-us_3abce8216cf89331\winsrv.dll.mui Handle ID: 0xac0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-com-base.resources_31bf3856ad364e35_10.0.26100.1_en-us_b573647fa63538bb\wintypes.dll.mui Handle ID: 0xf3c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-a..winmmbase.resources_31bf3856ad364e35_10.0.26100.1_en-us_cde05e6f321ee38b\winmm.dll.mui Handle ID: 0x11e0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-wlanutil.resources_31bf3856ad364e35_10.0.26100.1_en-us_60ef0d9c195f9ade\wlanutil.dll.mui Handle ID: 0xf60 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-wldp.resources_31bf3856ad364e35_10.0.26100.1_en-us_28e2096f7d3cea01\wldp.dll.mui Handle ID: 0xcb8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-w..onservice.resources_31bf3856ad364e35_10.0.26100.1_en-us_949b347ecedcaffa\wkssvc.dll.mui Handle ID: 0x10fc Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-w..eprovider.resources_31bf3856ad364e35_10.0.26100.1_en-us_6041960979404e3f\wmiprop.dll.mui Handle ID: 0xbec Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-f..ngsclient.resources_31bf3856ad364e35_10.0.26100.1_en-us_fb5cd0bf936ad95d\wosc.dll.mui Handle ID: 0x794 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\wow64_microsoft-windows-ldap-client.resources_31bf3856ad364e35_10.0.26100.1_en-us_e2b43c0fc3f4758c\wldap32.dll.mui Handle ID: 0x1028 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-f..libraries.resources_31bf3856ad364e35_10.0.26100.1_en-us_30d86c90473dfbda\ulib.dll.mui Handle ID: 0xc9c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-winpe_tools.resources_31bf3856ad364e35_10.0.26100.1_en-us_22fffc59729189ff\wpeutil.dll.mui Handle ID: 0xe44 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-w..ure-other.resources_31bf3856ad364e35_10.0.26100.1_en-us_aad1141701518b1b\wshelper.dll.mui Handle ID: 0xe4c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-w..per-tcpip.resources_31bf3856ad364e35_10.0.26100.1_en-us_6021ae08079934d4\wship6.dll.mui Handle ID: 0x11f4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-w..per-tcpip.resources_31bf3856ad364e35_10.0.26100.1_en-us_6021ae08079934d4\wshtcpip.dll.mui Handle ID: 0x1224 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-webservices.resources_31bf3856ad364e35_10.0.26100.1_en-us_0baac802decc888a\webservices.dll.mui Handle ID: 0xc28 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..ocale-nls.resources_31bf3856ad364e35_10.0.26100.1_en-us_d9f8791526ccd66d\winnlsres.dll.mui Handle ID: 0xf70 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-w..ure-ws232.resources_31bf3856ad364e35_10.0.26100.1_en-us_0b032535ed858942\ws2_32.dll.mui Handle ID: 0x79c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-p..er-client.resources_31bf3856ad364e35_10.0.26100.1_en-us_c1872f8879c1e982\winspool.drv.mui Handle ID: 0x1088 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-w..ck-legacy.resources_31bf3856ad364e35_10.0.26100.1_en-us_48af640c02989194\wsock32.dll.mui Handle ID: 0x914 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-sxs.resources_31bf3856ad364e35_10.0.26100.1_en-us_eec4d657ee5ade1a\SxsMigPlugin.dll.mui Handle ID: 0xac4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-wsp-spaces.resources_31bf3856ad364e35_10.0.26100.1_en-us_97c09fdd85e9e5dc\mispace_uninstall.mfl Handle ID: 0x728 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-wsp-spaces.resources_31bf3856ad364e35_10.0.26100.1_en-us_97c09fdd85e9e5dc\mispace.mfl Handle ID: 0xb30 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-s..gementwmi.resources_31bf3856ad364e35_10.0.26100.1_en-us_769af521b18ff477\storagewmi_passthru_uninstall.mfl Handle ID: 0x7c4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-wmi-mof.resources_31bf3856ad364e35_10.0.26100.1_en-us_6a2065d12877f0a6\ncprov.mfl Handle ID: 0xaec Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-s..rver-apis.resources_31bf3856ad364e35_10.0.26100.1_en-us_5c434b2f0b8aff65\smbwmiv2.mfl Handle ID: 0xc48 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-w..mof-admin.resources_31bf3856ad364e35_10.0.26100.1_en-us_203b36bde6b5a050\subscrpt.mfl Handle ID: 0x1078 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-w..mof-admin.resources_31bf3856ad364e35_10.0.26100.1_en-us_203b36bde6b5a050\ScrCons.mfl Handle ID: 0xbb4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-w..mof-admin.resources_31bf3856ad364e35_10.0.26100.1_en-us_203b36bde6b5a050\smtpcons.mfl Handle ID: 0xc64 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-wmi-mof.resources_31bf3856ad364e35_10.0.26100.1_en-us_6a2065d12877f0a6\wmi.mfl Handle ID: 0x1184 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-w..mof-admin.resources_31bf3856ad364e35_10.0.26100.1_en-us_203b36bde6b5a050\WbemCons.mfl Handle ID: 0x8d0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-wmi-mof.resources_31bf3856ad364e35_10.0.26100.1_en-us_6a2065d12877f0a6\secrcw32.mfl Handle ID: 0xc24 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-wmi-mof.resources_31bf3856ad364e35_10.0.26100.1_en-us_6a2065d12877f0a6\interop.mfl Handle ID: 0xc20 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-wmi-mof.resources_31bf3856ad364e35_10.0.26100.1_en-us_6a2065d12877f0a6\wmipcima.mfl Handle ID: 0x8f0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-wmi-mof.resources_31bf3856ad364e35_10.0.26100.1_en-us_6a2065d12877f0a6\system.mfl Handle ID: 0x10f8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-s..owershell.resources_31bf3856ad364e35_10.0.26100.1_en-us_cbbefa2557b8209f\SmbLocalization.psd1 Handle ID: 0xf44 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-wmi-mof.resources_31bf3856ad364e35_10.0.26100.1_en-us_6a2065d12877f0a6\cimwin32.mfl Handle ID: 0xb98 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_boot_pcat_0f8924c0debe64e4.cdf-ms Handle ID: 0xd40 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_boot_pcat_en-us_da440b72296cc45e.cdf-ms Handle ID: 0xc30 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_boot_resources_en-us_3393f588464e4d11.cdf-ms Handle ID: 0xaf8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_branding_basebrd_9ee9a176c9fadab4.cdf-ms Handle ID: 0x1180 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_branding_basebrd_en-us_51c0631d4347f350.cdf-ms Handle ID: 0x9c4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_help_mui_0409_c7942094fabea651.cdf-ms Handle ID: 0x990 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_inf_en-us_0ef70046e1d1b811.cdf-ms Handle ID: 0xc10 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_inf_lsm_0409_b44cb59d03cf68aa.cdf-ms Handle ID: 0x750 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_inf_3f581daba4c8c835.cdf-ms Handle ID: 0xefc Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_inf_lsm_b45be09c559d6e1d.cdf-ms Handle ID: 0x8a4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_inf_remoteaccess_0409_86bc979ae65d5e96.cdf-ms Handle ID: 0x600 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_inf_remoteaccess_110554180baafc8b.cdf-ms Handle ID: 0xa7c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_resources_themes_aero_3fd78bf4cb5fa2c4.cdf-ms Handle ID: 0x109c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_resources_themes_aero_en-us_ab16867f204414fa.cdf-ms Handle ID: 0xc5c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_system32_0409_06652563df2ff0c1.cdf-ms Handle ID: 0x6c4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_system32_boot_en-us_bd4746182a790f00.cdf-ms Handle ID: 0x10c0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_system32_drivers_umdf_a531b5dc588477d3.cdf-ms Handle ID: 0x128c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_system32_drivers_umdf_en-us_b8ba9f5b7f1c3933.cdf-ms Handle ID: 0xed8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_system32_migration_en-us_815d10948a0810a2.cdf-ms Handle ID: 0x884 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_system32_mui_0409_ecc96e0e9498d62e.cdf-ms Handle ID: 0x113c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_system32_oobe_en-us_e44fe14df02b3595.cdf-ms Handle ID: 0xa48 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_system32_setup_5d3758a05cf4a445.cdf-ms Handle ID: 0x11b4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_system32_setup_en-us_afa35959583f5dbd.cdf-ms Handle ID: 0x950 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_system32_sysprep_en-us_ed807a30a752749a.cdf-ms Handle ID: 0xacc Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_system32_windowspowershell_v1.0_modules_smbshare_en-us_afb84194eaac32a1.cdf-ms Handle ID: 0x7f4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_system32_windowspowershell_v1.0_modules_smbshare_b160c489ca4b107d.cdf-ms Handle ID: 0x9d4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_syswow64_dism_en-us_c5f337028c1b1b59.cdf-ms Handle ID: 0xfd8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\program_files_common_files_system_ado_en-us_9c12689ac1360dc2.cdf-ms Handle ID: 0xc78 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\program_files_common_files_system_msadc_en-us_58bb034fa66b57cc.cdf-ms Handle ID: 0x9bc Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\program_files_common_files_system_ole_db_en-us_5ff73071fce05070.cdf-ms Handle ID: 0x930 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-t..nputpanel-languages_31bf3856ad364e35_10.0.26100.1_none_bc572045652e8d7d\tipresx.dll Handle ID: 0x868 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-t..tkeyboard.resources_31bf3856ad364e35_10.0.26100.1_en-us_e51d09f7aeafff35\tabskb.dll.mui Handle ID: 0x85c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-t..nputpanel.resources_31bf3856ad364e35_10.0.26100.1_en-us_fa08a1c4056daba2\TabTip.exe.mui Handle ID: 0x86c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-t..nputpanel.resources_31bf3856ad364e35_10.0.26100.1_en-us_fa08a1c4056daba2\TipRes.dll.mui Handle ID: 0xfc0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-t..languages.resources_31bf3856ad364e35_10.0.26100.1_en-us_afd0b35e614a2d60\tipresx.dll.mui Handle ID: 0xf1c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-t..tservices.resources_31bf3856ad364e35_10.0.26100.1_en-us_0e559b1db0c9aef8\TipTsf.dll.mui Handle ID: 0xfc0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-tabletpc-softkeyboard_31bf3856ad364e35_10.0.26100.1_none_cea5585ab9e96cba\auxpad.xml Handle ID: 0x86c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-tabletpc-softkeyboard_31bf3856ad364e35_10.0.26100.1_none_cea5585ab9e96cba\insert.xml Handle ID: 0x85c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-tabletpc-softkeyboard_31bf3856ad364e35_10.0.26100.1_none_cea5585ab9e96cba\keypad.xml Handle ID: 0x868 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-tabletpc-softkeyboard_31bf3856ad364e35_10.0.26100.1_none_cea5585ab9e96cba\main.xml Handle ID: 0x6f8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-tabletpc-softkeyboard_31bf3856ad364e35_10.0.26100.1_none_cea5585ab9e96cba\oskclearui.xml Handle ID: 0x11e4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-tabletpc-softkeyboard_31bf3856ad364e35_10.0.26100.1_none_cea5585ab9e96cba\oskmenu.xml Handle ID: 0x11e8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-tabletpc-softkeyboard_31bf3856ad364e35_10.0.26100.1_none_cea5585ab9e96cba\osknav.xml Handle ID: 0x85c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-tabletpc-softkeyboard_31bf3856ad364e35_10.0.26100.1_none_cea5585ab9e96cba\osknumpad.xml Handle ID: 0x86c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-tabletpc-softkeyboard_31bf3856ad364e35_10.0.26100.1_none_cea5585ab9e96cba\oskpred.xml Handle ID: 0xfc0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-tabletpc-softkeyboard_31bf3856ad364e35_10.0.26100.1_none_cea5585ab9e96cba\symbols.xml Handle ID: 0xe50 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-tabletpc-softkeyboard_31bf3856ad364e35_10.0.26100.1_none_cea5585ab9e96cba\auxbase.xml Handle ID: 0xf28 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-tabletpc-softkeyboard_31bf3856ad364e35_10.0.26100.1_none_cea5585ab9e96cba\keypadbase.xml Handle ID: 0xf1c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-tabletpc-softkeyboard_31bf3856ad364e35_10.0.26100.1_none_cea5585ab9e96cba\insertbase.xml Handle ID: 0x834 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-tabletpc-softkeyboard_31bf3856ad364e35_10.0.26100.1_none_cea5585ab9e96cba\ea.xml Handle ID: 0x85c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-tabletpc-softkeyboard_31bf3856ad364e35_10.0.26100.1_none_cea5585ab9e96cba\kor-kor.xml Handle ID: 0x11e8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-tabletpc-softkeyboard_31bf3856ad364e35_10.0.26100.1_none_cea5585ab9e96cba\base.xml Handle ID: 0x11e4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-tabletpc-softkeyboard_31bf3856ad364e35_10.0.26100.1_none_cea5585ab9e96cba\baseAltGr_rtl.xml Handle ID: 0x6f8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-tabletpc-softkeyboard_31bf3856ad364e35_10.0.26100.1_none_cea5585ab9e96cba\base_altgr.xml Handle ID: 0x868 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-tabletpc-softkeyboard_31bf3856ad364e35_10.0.26100.1_none_cea5585ab9e96cba\base_ca.xml Handle ID: 0xe50 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-tabletpc-softkeyboard_31bf3856ad364e35_10.0.26100.1_none_cea5585ab9e96cba\base_heb.xml Handle ID: 0xfc0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-tabletpc-softkeyboard_31bf3856ad364e35_10.0.26100.1_none_cea5585ab9e96cba\base_jpn.xml Handle ID: 0x115c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-tabletpc-softkeyboard_31bf3856ad364e35_10.0.26100.1_none_cea5585ab9e96cba\base_kor.xml Handle ID: 0x854 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-tabletpc-softkeyboard_31bf3856ad364e35_10.0.26100.1_none_cea5585ab9e96cba\base_rtl.xml Handle ID: 0x7ac Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-tabletpc-softkeyboard_31bf3856ad364e35_10.0.26100.1_none_cea5585ab9e96cba\ja-jp.xml Handle ID: 0xf28 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-tabletpc-softkeyboard_31bf3856ad364e35_10.0.26100.1_none_cea5585ab9e96cba\ko-kr.xml Handle ID: 0x86c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-tabletpc-softkeyboard_31bf3856ad364e35_10.0.26100.1_none_cea5585ab9e96cba\zh-changjei.xml Handle ID: 0xde8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-tabletpc-inputpanel_31bf3856ad364e35_10.0.26100.1_none_0e82be26e00ee7a3\Microsoft.Ink.Intelligence.TextInput.Implementation.dll Handle ID: 0x614 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-tabletpc-softkeyboard_31bf3856ad364e35_10.0.26100.1_none_cea5585ab9e96cba\zh-dayi.xml Handle ID: 0xbc4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-tabletpc-softkeyboard_31bf3856ad364e35_10.0.26100.1_none_cea5585ab9e96cba\oskclearuibase.xml Handle ID: 0xfc0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-tabletpc-softkeyboard_31bf3856ad364e35_10.0.26100.1_none_cea5585ab9e96cba\oskmenubase.xml Handle ID: 0x868 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-tabletpc-softkeyboard_31bf3856ad364e35_10.0.26100.1_none_cea5585ab9e96cba\osknavbase.xml Handle ID: 0x6f8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-tabletpc-softkeyboard_31bf3856ad364e35_10.0.26100.1_none_cea5585ab9e96cba\zh-phonetic.xml Handle ID: 0x11e4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-tabletpc-softkeyboard_31bf3856ad364e35_10.0.26100.1_none_cea5585ab9e96cba\osknumpadbase.xml Handle ID: 0x11e8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-tabletpc-softkeyboard_31bf3856ad364e35_10.0.26100.1_none_cea5585ab9e96cba\oskpredbase.xml Handle ID: 0x85c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-tabletpc-softkeyboard_31bf3856ad364e35_10.0.26100.1_none_cea5585ab9e96cba\ea-sym.xml Handle ID: 0x834 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-tabletpc-softkeyboard_31bf3856ad364e35_10.0.26100.1_none_cea5585ab9e96cba\ja-jp-sym.xml Handle ID: 0xf1c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-tabletpc-inputpanel_31bf3856ad364e35_10.0.26100.1_none_0e82be26e00ee7a3\TabTip.exe Handle ID: 0x11bc Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-tabletpc-softkeyboard_31bf3856ad364e35_10.0.26100.1_none_cea5585ab9e96cba\symbase.xml Handle ID: 0xb44 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-winre-tools.resources_31bf3856ad364e35_10.0.26100.1_en-us_7d5a7b5a317e198b\RecEnv.exe.mui Handle ID: 0x1190 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-winre-tools.resources_31bf3856ad364e35_10.0.26100.1_en-us_7d5a7b5a317e198b\StartRep.exe.mui Handle ID: 0x7ac Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-t..andinkinputservices_31bf3856ad364e35_10.0.26100.1_none_19a0d334819f5da7\tiptsf.dll Handle ID: 0x854 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-htmlhelp_31bf3856ad364e35_10.0.26100.1_none_c5499f12ed491599\hh.exe Handle ID: 0x6f8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-winre-tools_31bf3856ad364e35_10.0.26100.1_none_c6f14614d89ecab4\RecEnv.exe Handle ID: 0x868 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-tabletpc-inputpanel_31bf3856ad364e35_10.0.26100.1_none_0e82be26e00ee7a3\TipRes.dll Handle ID: 0xfc0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-winre-tools_31bf3856ad364e35_10.0.26100.1_none_c6f14614d89ecab4\StartRep.exe Handle ID: 0xeb4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-b..nvironment-dvd-pcat_31bf3856ad364e35_10.0.26100.1_none_970b79c3990b4446\BCD Handle ID: 0xc14 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-tabletpc-inputpanel_31bf3856ad364e35_10.0.26100.1_none_0e82be26e00ee7a3\tipskins.dll Handle ID: 0xd60 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\x86_microsoft-windows-b..d-bootfix.resources_31bf3856ad364e35_10.0.26100.1_en-us_96f88cb217b25ad4\bootfix.bin Handle ID: 0xb84 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\x86_microsoft-windows-b..onment-dvd-etfsboot_31bf3856ad364e35_10.0.26100.1_none_2350f58e1a989738\etfsboot.com Handle ID: 0xc04 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-b..ironment-dvd-efisys_31bf3856ad364e35_10.0.26100.1_none_5f948fdc4b69586b\efisys_EX.bin Handle ID: 0xbd0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-b..ironment-dvd-efisys_31bf3856ad364e35_10.0.26100.1_none_5f948fdc4b69586b\efisys.bin Handle ID: 0x9dc Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-tabletpc-inputpanel_31bf3856ad364e35_10.0.26100.1_none_0e82be26e00ee7a3\Microsoft.Ink.Intelligence.TextInput.Skill.dll Handle ID: 0xa34 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-b..ironment-dvd-efisys_31bf3856ad364e35_10.0.26100.1_none_5f948fdc4b69586b\efisys_noprompt_EX.bin Handle ID: 0xb40 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-b..ironment-dvd-efisys_31bf3856ad364e35_10.0.26100.1_none_5f948fdc4b69586b\efisys_noprompt.bin Handle ID: 0x868 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-htmlhelp.resources_31bf3856ad364e35_10.0.26100.1_en-us_b241ef07e994792e\hh.exe.mui Handle ID: 0x6f8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..-unicode-components_31bf3856ad364e35_10.0.26100.1_none_158e2f5efa46ad38\timezoneTypes.res Handle ID: 0xbc4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..-unicode-components_31bf3856ad364e35_10.0.26100.1_none_158e2f5efa46ad38\windowsZones.res Handle ID: 0x115c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..-unicode-components_31bf3856ad364e35_10.0.26100.1_none_158e2f5efa46ad38\metaZones.res Handle ID: 0xb84 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..-unicode-components_31bf3856ad364e35_10.0.26100.1_none_158e2f5efa46ad38\zoneinfo64.res Handle ID: 0xc14 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\Microsoft-OneCore-Audio-AudioCore-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.1.mum Handle ID: 0xd60 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\Microsoft-OneCore-Audio-AudioCore-Package~31bf3856ad364e35~amd64~~10.0.26100.1.mum Handle ID: 0xb84 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-tabletpc-softkeyboard_31bf3856ad364e35_10.0.26100.1_none_cea5585ab9e96cba\tabskb.dll Handle ID: 0xa34 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\Microsoft-OneCore-Wer-Core-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.1.mum Handle ID: 0xf1c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\Microsoft-OneCore-Wer-Core-Package~31bf3856ad364e35~amd64~~10.0.26100.1.mum Handle ID: 0x8ac Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\Microsoft-Windows-BootEnvironment-Dvd-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.1.mum Handle ID: 0xfc0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\Microsoft-Windows-BootEnvironment-Dvd-Package~31bf3856ad364e35~amd64~~10.0.26100.1.mum Handle ID: 0x788 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\Microsoft-Windows-Deployment-Services-WinPE-Tools-Opt-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.1.mum Handle ID: 0x1138 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\Microsoft-Windows-Deployment-Services-WinPE-Tools-Opt-Package~31bf3856ad364e35~amd64~~10.0.26100.1.mum Handle ID: 0xe88 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\Microsoft-Windows-WinPE-ATBroker-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.1.mum Handle ID: 0xb84 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\Microsoft-Windows-WinPE-ATBroker-Package~31bf3856ad364e35~amd64~~10.0.26100.1.mum Handle ID: 0x968 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\Microsoft-Windows-WinPE-AudioCore-merged-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.1.mum Handle ID: 0x115c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\Microsoft-Windows-WinPE-AudioCore-merged-Package~31bf3856ad364e35~amd64~~10.0.26100.1.mum Handle ID: 0xb38 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\Microsoft-Windows-WinPE-AudioCore-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.1.mum Handle ID: 0xeb4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\Microsoft-Windows-WinPE-AudioCore-Package~31bf3856ad364e35~amd64~~10.0.26100.1.mum Handle ID: 0x8ac Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\Microsoft-Windows-WinPE-AudioDrivers-merged-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.1.mum Handle ID: 0x1264 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-WinPE-AudioCore-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.1.cat Handle ID: 0xe0c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-WinPE-AudioCore-Package~31bf3856ad364e35~amd64~~10.0.26100.1.cat Handle ID: 0xdd4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\Microsoft-Windows-WinPE-AudioDrivers-merged-Package~31bf3856ad364e35~amd64~~10.0.26100.1.mum Handle ID: 0x834 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\Microsoft-Windows-WinPE-AudioDrivers-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.1.mum Handle ID: 0xe50 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\Microsoft-Windows-WinPE-AudioDrivers-Package~31bf3856ad364e35~amd64~~10.0.26100.1.mum Handle ID: 0x928 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-WinPE-AudioDrivers-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.1.cat Handle ID: 0x764 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-WinPE-AudioDrivers-Package~31bf3856ad364e35~amd64~~10.0.26100.1.cat Handle ID: 0x8ec Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\Microsoft-Windows-WinPE-Narrator-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.1.mum Handle ID: 0xb8c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\Microsoft-Windows-WinPE-Narrator-Package~31bf3856ad364e35~amd64~~10.0.26100.1.mum Handle ID: 0xfbc Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\Microsoft-Windows-WinPE-OC-WMI-onecorebase~31bf3856ad364e35~amd64~en-US~10.0.26100.1.mum Handle ID: 0xef8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\Microsoft-Windows-WinPE-OC-WMI-onecorebase~31bf3856ad364e35~amd64~~10.0.26100.1.mum Handle ID: 0xcbc Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\Microsoft-Windows-WinPE-Speech-TTS-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.1.mum Handle ID: 0xd94 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\Microsoft-Windows-WinPE-Speech-TTS-Package~31bf3856ad364e35~amd64~~10.0.26100.1.mum Handle ID: 0x7fc Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\Microsoft-Windows-WinPE-SRH-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.1.mum Handle ID: 0x788 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\Microsoft-Windows-WinPE-SRH-Package~31bf3856ad364e35~amd64~~10.0.26100.1.mum Handle ID: 0x6f8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\Microsoft-Windows-WinPE-TPM-onecorebase~31bf3856ad364e35~amd64~en-US~10.0.26100.1.mum Handle ID: 0xc14 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\Microsoft-Windows-WinPE-TPM-onecorebase~31bf3856ad364e35~amd64~~10.0.26100.1.mum Handle ID: 0x868 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\Multimedia-MMECoreWdmAudio-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.1.mum Handle ID: 0x1270 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\Multimedia-MMECoreWdmAudio-Package~31bf3856ad364e35~amd64~~10.0.26100.1.mum Handle ID: 0xa6c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\WinPE-ATBroker-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.1.mum Handle ID: 0x1054 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\WinPE-ATBroker-Package~31bf3856ad364e35~amd64~~10.0.26100.1.mum Handle ID: 0xbe8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\WinPE-AudioCore-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.1.mum Handle ID: 0x92c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\WinPE-ATBroker-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.1.cat Handle ID: 0xc70 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\WinPE-ATBroker-Package~31bf3856ad364e35~amd64~~10.0.26100.1.cat Handle ID: 0x9dc Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\WinPE-AudioCore-Package~31bf3856ad364e35~amd64~~10.0.26100.1.mum Handle ID: 0xbd0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\WinPE-AudioDrivers-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.1.mum Handle ID: 0x1138 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\WinPE-AudioCore-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.1.cat Handle ID: 0x7f0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\WinPE-AudioDrivers-Package~31bf3856ad364e35~amd64~~10.0.26100.1.mum Handle ID: 0xa74 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\WinPE-AudioCore-Package~31bf3856ad364e35~amd64~~10.0.26100.1.cat Handle ID: 0xcf8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\WinPE-AudioDrivers-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.1.cat Handle ID: 0xbd8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\WinPE-EnhancedStorage-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.1.mum Handle ID: 0xe88 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\WinPE-EnhancedStorage-Package~31bf3856ad364e35~amd64~~10.0.26100.1.mum Handle ID: 0x12a0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\WinPE-AudioDrivers-Package~31bf3856ad364e35~amd64~~10.0.26100.1.cat Handle ID: 0x1194 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\WinPE-MDAC-Package-windows~31bf3856ad364e35~amd64~en-US~10.0.26100.1.mum Handle ID: 0x1164 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\WinPE-MDAC-Package-windows~31bf3856ad364e35~amd64~~10.0.26100.1.mum Handle ID: 0x115c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\WinPE-Narrator-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.1.mum Handle ID: 0x968 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\WinPE-Narrator-Package~31bf3856ad364e35~amd64~~10.0.26100.1.mum Handle ID: 0xba0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\WinPE-Rejuv-Package-Servercommon~31bf3856ad364e35~amd64~en-US~10.0.26100.1.mum Handle ID: 0x1188 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\WinPE-Narrator-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.1.cat Handle ID: 0x744 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\WinPE-Narrator-Package~31bf3856ad364e35~amd64~~10.0.26100.1.cat Handle ID: 0x1264 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\WinPE-Rejuv-Package-Servercommon~31bf3856ad364e35~amd64~~10.0.26100.1.mum Handle ID: 0x8ac Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\WinPE-Scripting-Package-onecoreuap~31bf3856ad364e35~amd64~en-US~10.0.26100.1.mum Handle ID: 0xeb4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\WinPE-Scripting-Package-onecoreuap~31bf3856ad364e35~amd64~~10.0.26100.1.mum Handle ID: 0xa34 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\WinPE-Scripting-Package-onecore~31bf3856ad364e35~amd64~en-US~10.0.26100.1.mum Handle ID: 0x1230 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\WinPE-Scripting-Package-onecore~31bf3856ad364e35~amd64~~10.0.26100.1.mum Handle ID: 0x7ac Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\WinPE-Scripting-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.1.mum Handle ID: 0xe50 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\WinPE-Scripting-Package~31bf3856ad364e35~amd64~~10.0.26100.1.mum Handle ID: 0x834 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\WinPE-SecureStartup-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.1.mum Handle ID: 0xb44 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\WinPE-SecureStartup-Package~31bf3856ad364e35~amd64~~10.0.26100.1.mum Handle ID: 0xfec Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\WinPE-Speech-TTS-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.1.mum Handle ID: 0x85c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\WinPE-Speech-TTS-Package~31bf3856ad364e35~amd64~~10.0.26100.1.mum Handle ID: 0xef8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\WinPE-SRH-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.1.mum Handle ID: 0xfbc Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\WinPE-Speech-TTS-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.1.cat Handle ID: 0x11e4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\WinPE-SRH-Package~31bf3856ad364e35~amd64~~10.0.26100.1.mum Handle ID: 0x614 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\WinPE-Speech-TTS-Package~31bf3856ad364e35~amd64~~10.0.26100.1.cat Handle ID: 0xde8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\WinPE-SRT-Package-onecorebase~31bf3856ad364e35~amd64~en-US~10.0.26100.1.mum Handle ID: 0x86c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\WinPE-SRH-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.1.cat Handle ID: 0x11a8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\WinPE-SRT-Package-onecorebase~31bf3856ad364e35~amd64~~10.0.26100.1.mum Handle ID: 0x8ec Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\WinPE-SRH-Package~31bf3856ad364e35~amd64~~10.0.26100.1.cat Handle ID: 0xc04 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\WinPE-SRT-Package-onecoreuapwindows~31bf3856ad364e35~amd64~en-US~10.0.26100.1.mum Handle ID: 0xf1c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\WinPE-SRT-Package-onecoreuapwindows~31bf3856ad364e35~amd64~~10.0.26100.1.mum Handle ID: 0x920 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\WinPE-SRT-Package-shell~31bf3856ad364e35~amd64~en-US~10.0.26100.1.mum Handle ID: 0xd90 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\WinPE-SRT-Package-shell~31bf3856ad364e35~amd64~~10.0.26100.1.mum Handle ID: 0x9e4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\WinPE-SRT-Package-TouchKeyboard~31bf3856ad364e35~amd64~en-US~10.0.26100.1.mum Handle ID: 0xbbc Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\WinPE-SRT-Package-TouchKeyboard~31bf3856ad364e35~amd64~~10.0.26100.1.mum Handle ID: 0x918 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\WinPE-WDS-Tools-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.1.mum Handle ID: 0xcbc Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\WinPE-SRT-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.1.mum Handle ID: 0x740 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\WinPE-SRT-Package~31bf3856ad364e35~amd64~~10.0.26100.1.mum Handle ID: 0xd94 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\WinPE-WDS-Tools-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.1.cat Handle ID: 0x9a0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\WinPE-WDS-Tools-Package~31bf3856ad364e35~amd64~~10.0.26100.1.mum Handle ID: 0x764 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\WinPE-WMI-Package-admin~31bf3856ad364e35~amd64~en-US~10.0.26100.1.mum Handle ID: 0xe70 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\WinPE-WMI-Package-admin~31bf3856ad364e35~amd64~~10.0.26100.1.mum Handle ID: 0xfe0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\WinPE-WDS-Tools-Package~31bf3856ad364e35~amd64~~10.0.26100.1.cat Handle ID: 0x7fc Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\WinPE-WMI-Package-drivers~31bf3856ad364e35~amd64~en-US~10.0.26100.1.mum Handle ID: 0x1254 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\WinPE-WMI-Package-drivers~31bf3856ad364e35~amd64~~10.0.26100.1.mum Handle ID: 0xc74 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\WinPE-WMI-Package-ds~31bf3856ad364e35~amd64~en-US~10.0.26100.1.mum Handle ID: 0xf40 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\WinPE-WMI-Package-ds~31bf3856ad364e35~amd64~~10.0.26100.1.mum Handle ID: 0xe6c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\WinPE-WMI-Package-enduser~31bf3856ad364e35~amd64~en-US~10.0.26100.1.mum Handle ID: 0xa30 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\WinPE-WMI-Package-enduser~31bf3856ad364e35~amd64~~10.0.26100.1.mum Handle ID: 0x910 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\WinPE-WMI-Package-inetcore~31bf3856ad364e35~amd64~en-US~10.0.26100.1.mum Handle ID: 0xc84 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\WinPE-WMI-Package-inetcore~31bf3856ad364e35~amd64~~10.0.26100.1.mum Handle ID: 0xd60 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\WinPE-WMI-Package-minio~31bf3856ad364e35~amd64~en-US~10.0.26100.1.mum Handle ID: 0x1054 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\WinPE-WMI-Package-minio~31bf3856ad364e35~amd64~~10.0.26100.1.mum Handle ID: 0xbe8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\WinPE-WMI-Package-minkernel~31bf3856ad364e35~amd64~en-US~10.0.26100.1.mum Handle ID: 0x1198 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\WinPE-WMI-Package-minkernel~31bf3856ad364e35~amd64~~10.0.26100.1.mum Handle ID: 0xa6c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\WinPE-WMI-Package-net~31bf3856ad364e35~amd64~en-US~10.0.26100.1.mum Handle ID: 0x92c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\WinPE-WMI-Package-net~31bf3856ad364e35~amd64~~10.0.26100.1.mum Handle ID: 0xfd0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\WinPE-WMI-Package-onecoreadmin~31bf3856ad364e35~amd64~en-US~10.0.26100.1.mum Handle ID: 0x874 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\WinPE-WMI-Package-onecoreadmin~31bf3856ad364e35~amd64~~10.0.26100.1.mum Handle ID: 0x7f0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\WinPE-WMI-Package-onecoreds~31bf3856ad364e35~amd64~en-US~10.0.26100.1.mum Handle ID: 0xbd0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\WinPE-WMI-Package-onecoreds~31bf3856ad364e35~amd64~~10.0.26100.1.mum Handle ID: 0x1270 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\WinPE-WMI-Package-printscan~31bf3856ad364e35~amd64~en-US~10.0.26100.1.mum Handle ID: 0xfdc Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\WinPE-WMI-Package-printscan~31bf3856ad364e35~amd64~~10.0.26100.1.mum Handle ID: 0xd00 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\WinPE-WMI-Package-shell~31bf3856ad364e35~amd64~en-US~10.0.26100.1.mum Handle ID: 0x788 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\WinPE-WMI-Package-shell~31bf3856ad364e35~amd64~~10.0.26100.1.mum Handle ID: 0xe7c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\WinPE-WMI-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.1.mum Handle ID: 0x9f0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\WinPE-WMI-Package~31bf3856ad364e35~amd64~~10.0.26100.1.mum Handle ID: 0x8c4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-s..monnoia64.resources_31bf3856ad364e35_10.0.26100.1_en-us_520428772c45561c\sapisvr.exe.mui Handle ID: 0xe88 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-speechcommonnoia64_31bf3856ad364e35_10.0.26100.1_none_ff9d2f602c1cc7f1\sapisvr.exe Handle ID: 0xce8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-w..-texttospeech-en-us_31bf3856ad364e35_10.0.26100.1_none_4dde83d05390383e\M1033ZIR.INI Handle ID: 0x107c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-w..-texttospeech-en-us_31bf3856ad364e35_10.0.26100.1_none_4dde83d05390383e\M1033ZIR.Keyboard.NUS Handle ID: 0xc94 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-atbroker_31bf3856ad364e35_10.0.26100.1_none_cc94583186e1d279\AtBroker.exe Handle ID: 0x11a4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-audio-audiocore_31bf3856ad364e35_10.0.26100.1_none_73936c874d2c5a5f\audioresourceregistrar.dll Handle ID: 0xff4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-audio-audiocore_31bf3856ad364e35_10.0.26100.1_none_73936c874d2c5a5f\AUDIOKSE.dll Handle ID: 0x968 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-audio-audiocore_31bf3856ad364e35_10.0.26100.1_none_73936c874d2c5a5f\AudioEndpointBuilder.dll Handle ID: 0x115c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-audio-audiocore_31bf3856ad364e35_10.0.26100.1_none_73936c874d2c5a5f\audiodg.exe Handle ID: 0x6ac Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-autofstx_31bf3856ad364e35_10.0.26100.1_none_ac035a0e50e062b5\autofstx.exe Handle ID: 0x1164 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-mmcss_31bf3856ad364e35_10.0.26100.1_none_548bdf494c16c73c\avrt.dll Handle ID: 0x1194 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-a..iocorepolicymanager_31bf3856ad364e35_10.0.26100.1_none_4550f65983f69410\AudioSrvPolicyManager.dll Handle ID: 0x12a0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-b..ondata-wmi-provider_31bf3856ad364e35_10.0.26100.1_none_ad5b851ee599c51f\bcdprov.dll Handle ID: 0x938 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-s..restartup-repairbde_31bf3856ad364e35_10.0.26100.1_none_cee7e9b87891de0a\bderepair.dll Handle ID: 0xb6c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-blb-engine-proxy-main_31bf3856ad364e35_10.0.26100.1_none_a1966f409bcdb881\blbres.dll Handle ID: 0xb38 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-securestartup-ui-libs_31bf3856ad364e35_10.0.26100.1_none_38a907c7a549d9b1\bdeui.dll Handle ID: 0xb84 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-blb-engine-proxy-main_31bf3856ad364e35_10.0.26100.1_none_a1966f409bcdb881\blb_ps.dll Handle ID: 0xbd8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-bootmenuux_31bf3856ad364e35_10.0.26100.1_none_f1d53d087dea7fc1\BootMenuUX.dll Handle ID: 0x8ac Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-disasterrecoveryui_31bf3856ad364e35_10.0.26100.1_none_364d98cece1440ad\bmrui.exe Handle ID: 0xba0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-audio-audiocore_31bf3856ad364e35_10.0.26100.1_none_73936c874d2c5a5f\AudioEng.dll Handle ID: 0x11cc Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-winre-tools_31bf3856ad364e35_10.0.26100.1_none_c6f14614d89ecab4\BootRec.exe Handle ID: 0xec4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-audio-audiocore-client_31bf3856ad364e35_10.0.26100.1_none_c6a38d25bf59fcef\AudioSes.dll Handle ID: 0xa34 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-scripting-chakra_31bf3856ad364e35_11.0.26100.1_none_f44392a7adddbbca\Chakradiag.dll Handle ID: 0xc18 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-winre-cloudrec_31bf3856ad364e35_10.0.26100.1_none_43e5b884410463a0\CloudRecApi.dll Handle ID: 0x7ac Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-scripting-chakra_31bf3856ad364e35_11.0.26100.1_none_f44392a7adddbbca\Chakrathunk.dll Handle ID: 0x11b8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-winre-cloudrec_31bf3856ad364e35_10.0.26100.1_none_43e5b884410463a0\CloudRecSvc.exe Handle ID: 0x854 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-audio-audiocore_31bf3856ad364e35_10.0.26100.1_none_73936c874d2c5a5f\audiosrv.dll Handle ID: 0xeb4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-c..onentpackagesupport_31bf3856ad364e35_10.0.26100.1_none_5cb01382416234a7\CompPkgSrv.exe Handle ID: 0x10c8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-c..diopolicymanagerext_31bf3856ad364e35_10.0.26100.1_none_936a88f36df8276e\coreaudiopolicymanagerext.dll Handle ID: 0x8f8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-c..onentpackagesupport_31bf3856ad364e35_10.0.26100.1_none_5cb01382416234a7\CompPkgSup.dll Handle ID: 0xdd4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-audio-audiocore_31bf3856ad364e35_10.0.26100.1_none_73936c874d2c5a5f\CoreMas.dll Handle ID: 0x834 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-scripting_31bf3856ad364e35_10.0.26100.1_none_455bfb7668e68c00\cscript.exe Handle ID: 0x1264 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-w..-texttospeech-en-us_31bf3856ad364e35_10.0.26100.1_none_4dde83d05390383e\M1033ZIR.APM Handle ID: 0x744 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-narrator_31bf3856ad364e35_10.0.26100.1_none_bb1181510c4592be\DetailedReading-Default.xml Handle ID: 0x1188 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-scripting_31bf3856ad364e35_10.0.26100.1_none_455bfb7668e68c00\dispex.dll Handle ID: 0xa44 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-dskquota_31bf3856ad364e35_10.0.26100.1_none_7b071a5f1ce9c73d\dskquota.dll Handle ID: 0xda4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-wmi-core-framedyn-dll_31bf3856ad364e35_10.0.26100.1_none_29de290224253e1a\framedyn.dll Handle ID: 0x91c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-wmi-core_31bf3856ad364e35_10.0.26100.1_none_b647ab7588253a78\framedynos.dll Handle ID: 0x1104 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-onecore-c..ecoverydownloadtool_31bf3856ad364e35_10.0.26100.1_none_5da384d4bf5a82a9\CloudRecoveryDownloadTool.dll Handle ID: 0xf14 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-s..tartup-fverecoverux_31bf3856ad364e35_10.0.26100.1_none_4c230c58042d7d70\fverecoverux.dll Handle ID: 0xb44 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-hbaapi_31bf3856ad364e35_10.0.26100.1_none_46075543dbac6e08\hbaapi.dll Handle ID: 0xe0c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-onecore-u..latform-facilitator_31bf3856ad364e35_10.0.26100.1_none_8f5bda04c978540e\Facilitator.dll Handle ID: 0x614 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-securestartup-ui-libs_31bf3856ad364e35_10.0.26100.1_none_38a907c7a549d9b1\fveui.dll Handle ID: 0x888 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-htmlhelp_31bf3856ad364e35_10.0.26100.1_none_c5499f12ed491599\hhsetup.dll Handle ID: 0xa2c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..-unicode-components_31bf3856ad364e35_10.0.26100.1_none_158e2f5efa46ad38\icuin.dll Handle ID: 0x10b0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..-unicode-components_31bf3856ad364e35_10.0.26100.1_none_158e2f5efa46ad38\icuuc.dll Handle ID: 0xde8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-audio-acmcorecodecs_31bf3856ad364e35_10.0.26100.1_none_1dc883ef6254fb87\imaadp32.acm Handle ID: 0x11e4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-b..ux-winre.deployment_31bf3856ad364e35_10.0.26100.1_none_6373d21ba97e529b\bootux.dll Handle ID: 0xb8c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-htmlhelp_31bf3856ad364e35_10.0.26100.1_none_c5499f12ed491599\hhctrl.ocx Handle ID: 0x86c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-imagelib_31bf3856ad364e35_10.0.26100.1_none_dc2fbfa75ec43e11\imagelib.dll Handle ID: 0x770 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-scripting-jscript_31bf3856ad364e35_11.0.26100.1_none_b3c50bcfca8acf69\jscript.dll Handle ID: 0x8d8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-w..-texttospeech-en-us_31bf3856ad364e35_10.0.26100.1_none_4dde83d05390383e\MSTTSLocEnUS.dat Handle ID: 0xfc8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-d..w-kernelsupportuser_31bf3856ad364e35_10.0.26100.1_none_6265c6387e62b295\ksuser.dll Handle ID: 0xfbc Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-scripting-jscript9_31bf3856ad364e35_11.0.26100.1_none_750eafe89117ef12\jscript9diag.dll Handle ID: 0xef8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-m..diagnostic-schedule_31bf3856ad364e35_10.0.26100.1_none_90ca449ce2441ece\MdSched.exe Handle ID: 0xd90 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-securestartup-tool-exe_31bf3856ad364e35_10.0.26100.1_none_f70e66181fe2eced\manage-bde.exe Handle ID: 0x11e8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-winomi-mibincodec-dll_31bf3856ad364e35_10.0.26100.1_none_458e2ff5d653a559\mibincodec.dll Handle ID: 0xc28 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-wmiv2-mi-dll_31bf3856ad364e35_10.0.26100.1_none_8734e9e7787acc18\mi.dll Handle ID: 0xbc8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-winomi-mimofcodec-dll_31bf3856ad364e35_10.0.26100.1_none_4279bac98ff20466\mimofcodec.dll Handle ID: 0xb1c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-wmiv2-miutils-dll_31bf3856ad364e35_10.0.26100.1_none_68387a70864b4bfd\miutils.dll Handle ID: 0x798 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..-unicode-components_31bf3856ad364e35_10.0.26100.1_none_158e2f5efa46ad38\icu.dll Handle ID: 0xc38 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-audio-acmcorecodecs_31bf3856ad364e35_10.0.26100.1_none_1dc883ef6254fb87\msadp32.acm Handle ID: 0xbbc Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-audio-mmecore-acm_31bf3856ad364e35_10.0.26100.1_none_ddd9317f49960960\msacm32.dll Handle ID: 0xab0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-directshow-dmo_31bf3856ad364e35_10.0.26100.1_none_1789e9ae6735aed4\msdmo.dll Handle ID: 0xcc8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-audio-acmcorecodecs_31bf3856ad364e35_10.0.26100.1_none_1dc883ef6254fb87\msgsm32.acm Handle ID: 0x73c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-audio-acmcorecodecs_31bf3856ad364e35_10.0.26100.1_none_1dc883ef6254fb87\msg711.acm Handle ID: 0x85c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-mmdeviceapi_31bf3856ad364e35_10.0.26100.1_none_51f7ebf821ee750f\MMDevAPI.dll Handle ID: 0x11bc Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-srh_31bf3856ad364e35_10.0.26100.1_none_a65ffe32c3528a2c\NarratorControlTemplates.xml Handle ID: 0xcbc Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-wmi-core_31bf3856ad364e35_10.0.26100.1_none_b647ab7588253a78\ncobjapi.dll Handle ID: 0xe2c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-netman_31bf3856ad364e35_10.0.26100.1_none_0cb0c3f6ba5c6db8\netman.dll Handle ID: 0xc44 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-narrator_31bf3856ad364e35_10.0.26100.1_none_bb1181510c4592be\Narrator.exe Handle ID: 0xfec Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-d2d_31bf3856ad364e35_10.0.26100.1_none_a4908f24c47d93b7\d2d1.dll Handle ID: 0x94c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-w..scoveryprovider-dll_31bf3856ad364e35_10.0.26100.1_none_709d519cb82804c0\psmodulediscoveryprovider.mof Handle ID: 0xe50 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-w..scoveryprovider-dll_31bf3856ad364e35_10.0.26100.1_none_709d519cb82804c0\PSModuleDiscoveryProvider.dll Handle ID: 0x928 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-wmiv2-prvdmofcomp-dll_31bf3856ad364e35_10.0.26100.1_none_d4b7ae425bb4d7eb\prvdmofcomp.dll Handle ID: 0x1290 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-wmi-provider-common_31bf3856ad364e35_10.0.26100.1_none_a5336d1c41ad177e\provthrd.dll Handle ID: 0xfe0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-w..ter-cimprovider-exe_31bf3856ad364e35_10.0.26100.1_none_603d466a5482ab50\Register-CimProvider.exe Handle ID: 0xba4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-recdisc-main_31bf3856ad364e35_10.0.26100.1_none_816fa2d21c2de036\recdisc.exe Handle ID: 0x754 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-winre-recoveryagent_31bf3856ad364e35_10.0.26100.1_none_b7c04644d870148d\ReInfo.dll Handle ID: 0x10fc Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-scripting-chakra_31bf3856ad364e35_11.0.26100.1_none_f44392a7adddbbca\Chakra.dll Handle ID: 0x6c0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-sysreset_31bf3856ad364e35_10.0.26100.1_none_3915c371e7039343\ResetEngine.exe Handle ID: 0xf94 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-audio-audiocore_31bf3856ad364e35_10.0.26100.1_none_73936c874d2c5a5f\remoteaudioendpoint.dll Handle ID: 0xe70 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-s..restartup-repairbde_31bf3856ad364e35_10.0.26100.1_none_cee7e9b87891de0a\repair-bde.exe Handle ID: 0xbc4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-sysreset_31bf3856ad364e35_10.0.26100.1_none_3915c371e7039343\ResetPluginHost.exe Handle ID: 0x9e0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-systemrestore-main_31bf3856ad364e35_10.0.26100.1_none_43d378481bcb98ae\rstrui.exe Handle ID: 0xf70 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-winre-recoveryagent_31bf3856ad364e35_10.0.26100.1_none_b7c04644d870148d\ReAgent.dll Handle ID: 0x7b0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-rtworkq_31bf3856ad364e35_10.0.26100.1_none_eae21d959198ad9f\RTWorkQ.dll Handle ID: 0x1230 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-scripting_31bf3856ad364e35_10.0.26100.1_none_455bfb7668e68c00\scrrun.dll Handle ID: 0x1190 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-scripting_31bf3856ad364e35_10.0.26100.1_none_455bfb7668e68c00\scrobj.dll Handle ID: 0xb18 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-sysreset_31bf3856ad364e35_10.0.26100.1_none_3915c371e7039343\ResetTelemetry.dll Handle ID: 0xcf8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-systemrestore-main_31bf3856ad364e35_10.0.26100.1_none_43d378481bcb98ae\srclient.dll Handle ID: 0x910 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-scripting-jscript9_31bf3856ad364e35_11.0.26100.1_none_750eafe89117ef12\jscript9.dll Handle ID: 0x126c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-audio-audiocore_31bf3856ad364e35_10.0.26100.1_none_73936c874d2c5a5f\SpatialAudioLicenseSrv.exe Handle ID: 0x123c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-sysreset_31bf3856ad364e35_10.0.26100.5059_none_d81376042e59a095\srms.dat Handle ID: 0xb40 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-systemrestore-srhelper_31bf3856ad364e35_10.0.26100.1_none_abd8005cc30a2c50\srhelper.dll Handle ID: 0x858 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-spp-main_31bf3856ad364e35_10.0.26100.1_none_e13a9f2215696a92\spp.dll Handle ID: 0xc84 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-spp-main_31bf3856ad364e35_10.0.26100.1_none_e13a9f2215696a92\sxproxy.dll Handle ID: 0xa30 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-s..ting-jscript9legacy_31bf3856ad364e35_11.0.26100.1_none_c4862f5f3abb0f85\jscript9Legacy.dll Handle ID: 0xbf8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-p..rtmonitor-tcpmibdll_31bf3856ad364e35_10.0.26100.1_none_531f92e2792fb205\tcpmib.dll Handle ID: 0xad8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-tpm-tbs_31bf3856ad364e35_10.0.26100.1_none_ebab7d55e0e0e8ac\tbs.dll Handle ID: 0x778 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-srh_31bf3856ad364e35_10.0.26100.1_none_a65ffe32c3528a2c\tier2punctuations.dll Handle ID: 0xbe8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-tpm-coreprovisioning_31bf3856ad364e35_10.0.26100.1_none_34584adaded9b667\TpmCertResources.dll Handle ID: 0x90c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-systemrestore-main_31bf3856ad364e35_10.0.26100.1_none_43d378481bcb98ae\srcore.dll Handle ID: 0x1054 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-sysreset_31bf3856ad364e35_10.0.26100.1_none_3915c371e7039343\sysreset.exe Handle ID: 0x1244 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-blb-cli-main_31bf3856ad364e35_10.0.26100.1_none_48488580f79252e6\wbadmin.exe Handle ID: 0xe6c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-wmi-core-wbemcomn-dll_31bf3856ad364e35_10.0.26100.1_none_006ed65d8bbf0720\wbemcomn.dll Handle ID: 0xf40 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-scripting-vbscript_31bf3856ad364e35_11.0.26100.1_none_793f2688014d7ba5\vbscript.dll Handle ID: 0x998 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-d..mage-capture-wizard_31bf3856ad364e35_10.0.26100.1_none_65c5b0fa4d6c6f44\wdscapture.exe Handle ID: 0xc74 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-d..mage-capture-wizard_31bf3856ad364e35_10.0.26100.1_none_65c5b0fa4d6c6f44\wdscapture.inf Handle ID: 0x1254 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-a..o-mmecore-wdm-audio_31bf3856ad364e35_10.0.26100.1_none_4741f4874e3eba8c\wdmaud.drv Handle ID: 0xf28 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-tpm-coreprovisioning_31bf3856ad364e35_10.0.26100.1_none_34584adaded9b667\TpmCoreProvisioning.dll Handle ID: 0x7fc Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-d..ient-server-library_31bf3856ad364e35_10.0.26100.1_none_0363e2079fb501f7\wdscsl.dll Handle ID: 0x764 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-d..ervices-diagnostics_31bf3856ad364e35_10.0.26100.1_none_372bb2ca9fdfd3d6\WdsDiag.dll Handle ID: 0x9a0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-onecore-w..-services-commonlib_31bf3856ad364e35_10.0.26100.1_none_a992b3fea6c39c62\WdsCommonLib.dll Handle ID: 0xd94 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-d..ent-services-client_31bf3856ad364e35_10.0.26100.1_none_ad4f7155543c0399\wdsclient.exe Handle ID: 0x740 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-d..vices-image-library_31bf3856ad364e35_10.0.26100.1_none_7b4c0461a729ec6f\WdsImage.dll Handle ID: 0xd58 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-onecore-w..es-server-commonlib_31bf3856ad364e35_10.0.26100.1_none_9288c430050d2f5e\WdsServerCommonLib.dll Handle ID: 0xa54 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-d..es-transport-client_31bf3856ad364e35_10.0.26100.1_none_0e215dffde686a95\wdstptc.dll Handle ID: 0x918 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-sysreset_31bf3856ad364e35_10.0.26100.1_none_3915c371e7039343\ResetEngine.dll Handle ID: 0x704 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-vssservice_31bf3856ad364e35_10.0.26100.1_none_57c076d780640e4c\VSSVC.exe Handle ID: 0xc0c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-errorreportingui_31bf3856ad364e35_10.0.26100.1_none_cb58d2fd6aa3e851\werui.dll Handle ID: 0x9e4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-blb-engine-main_31bf3856ad364e35_10.0.26100.1_none_e0d59e58684c835e\wbengine.exe Handle ID: 0x7d8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-d..es-multicast-client_31bf3856ad364e35_10.0.26100.1_none_b38687bb3e5d115c\wdsmcast.exe Handle ID: 0x920 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-devices-midi_31bf3856ad364e35_10.0.26100.1_none_e7cdcbc30433aa46\Windows.Devices.Midi.dll Handle ID: 0x6e0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-w..e-oc-srt-background_31bf3856ad364e35_10.0.26100.1_none_e5ef706e93a86fe0\winre.jpg Handle ID: 0xf1c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-scripting_31bf3856ad364e35_10.0.26100.1_none_455bfb7668e68c00\wshcon.dll Handle ID: 0xc04 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-wmi-tools_31bf3856ad364e35_10.0.26100.1_none_d4ef1241ec2c00e8\WmiMgmt.msc Handle ID: 0x8ec Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-wmi-tools.resources_31bf3856ad364e35_10.0.26100.1_en-us_446aaec28d00dc8d\WmiMgmt.msc Handle ID: 0xd00 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-wmiv2-wmidcom-dll_31bf3856ad364e35_10.0.26100.1_none_389d47e50c083b24\wmidcom.dll Handle ID: 0x788 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-directx-xaudio2_8_31bf3856ad364e35_10.0.26100.1_none_4375e61ea5b7686c\XAudio2_8.dll Handle ID: 0xe7c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-w..adapter-wmitomi-dll_31bf3856ad364e35_10.0.26100.1_none_783fe9091fa50dde\wmitomi.dll Handle ID: 0x11a8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-scripting_31bf3856ad364e35_10.0.26100.1_none_455bfb7668e68c00\wscript.exe Handle ID: 0x1030 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-scripting_31bf3856ad364e35_10.0.26100.1_none_455bfb7668e68c00\wshom.ocx Handle ID: 0x7c8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-media-devices_31bf3856ad364e35_10.0.26100.1_none_785b017847f054e3\Windows.Media.Devices.dll Handle ID: 0x6cc Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-directx-xaudio2_9_31bf3856ad364e35_10.0.26100.1_none_4376e668a5b681c3\XAudio2_9.dll Handle ID: 0x7e4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-srh_31bf3856ad364e35_10.0.26100.1_none_a65ffe32c3528a2c\SRH.dll Handle ID: 0x10d4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-e..storage-classdriver_31bf3856ad364e35_10.0.26100.1_none_5ae33db3d50d7de1\EhStorClass.sys Handle ID: 0x74c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-filetracefilter_31bf3856ad364e35_10.0.26100.1_none_f7b7fc42d5aa7316\filetrace.sys Handle ID: 0x874 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-mmcss_31bf3856ad364e35_10.0.26100.1_none_548bdf494c16c73c\mmcss.sys Handle ID: 0x1098 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-tpm-tbs_31bf3856ad364e35_10.0.26100.1_none_ebab7d55e0e0e8ac\tbs.sys Handle ID: 0x75c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_ehstortcgdrv.inf.resources_31bf3856ad364e35_10.0.26100.1_en-us_00ffe530f8b2d8ad\EhStorTcgDrv.sys.mui Handle ID: 0xfc0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_audioendpoint.inf.resources_31bf3856ad364e35_10.0.26100.1_en-us_1e1ee14b8ab6c2a5\AudioEndpoint.inf_loc Handle ID: 0xe88 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_ehstortcgdrv.inf.resources_31bf3856ad364e35_10.0.26100.1_en-us_00ffe530f8b2d8ad\EhStorTcgDrv.inf_loc Handle ID: 0xfd0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_hdaudss.inf.resources_31bf3856ad364e35_10.0.26100.1_en-us_9aa6b54beb283fc8\hdaudss.inf_loc Handle ID: 0x116c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_hdaudio.inf.resources_31bf3856ad364e35_10.0.26100.1_en-us_de92b08094a4f552\hdaudio.inf_loc Handle ID: 0xff4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_rawsilo.inf.resources_31bf3856ad364e35_10.0.26100.1_en-us_ea16643c98c4ce2b\rawsilo.inf_loc Handle ID: 0x11a4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_wdmaudiocoresystem.inf.resources_31bf3856ad364e35_10.0.26100.1_en-us_ec015cd5eb2d4c78\wdmaudioCoreSystem.inf_loc Handle ID: 0x6f8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_wdma_usb.inf.resources_31bf3856ad364e35_10.0.26100.1_en-us_a6c84596ba1840be\wdma_usb.inf_loc Handle ID: 0xc94 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-a..audiocore.resources_31bf3856ad364e35_10.0.26100.1_en-us_21823bda82ea31ac\audiodg.exe.mui Handle ID: 0x1164 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-a..audiocore.resources_31bf3856ad364e35_10.0.26100.1_en-us_21823bda82ea31ac\AudioEndpointBuilder.dll.mui Handle ID: 0x115c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-a..audiocore.resources_31bf3856ad364e35_10.0.26100.1_en-us_21823bda82ea31ac\AudioSrv.dll.mui Handle ID: 0x6ac Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-autofstx.resources_31bf3856ad364e35_10.0.26100.1_en-us_524826bf417fdef2\autofstx.exe.mui Handle ID: 0x968 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_mmcss.resources_31bf3856ad364e35_10.0.26100.1_en-us_aabe10ef9fcff164\avrt.dll.mui Handle ID: 0xd60 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-winre-tools.resources_31bf3856ad364e35_10.0.26100.1_en-us_7d5a7b5a317e198b\BootRec.exe.mui Handle ID: 0xb38 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-a..re-client.resources_31bf3856ad364e35_10.0.26100.1_en-us_816f85d9cd569f62\AudioSes.dll.mui Handle ID: 0xb6c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-bootux-winre.resources_31bf3856ad364e35_10.0.26100.1_en-us_3b36f331a4266aa1\bootux.dll.mui Handle ID: 0x938 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-d..ecoveryui.resources_31bf3856ad364e35_10.0.26100.1_en-us_897ebc1ab3a8138a\bmrui.exe.mui Handle ID: 0xc14 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-scripting.resources_31bf3856ad364e35_10.0.26100.1_en-us_8820496fc0004121\cscript.exe.mui Handle ID: 0x868 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-dskquota.resources_31bf3856ad364e35_10.0.26100.1_en-us_fdf85c94c82843ee\dskquota.dll.mui Handle ID: 0xbd8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-b..roxy-main.resources_31bf3856ad364e35_10.0.26100.1_en-us_7f16304a7e970118\blbres.dll.mui Handle ID: 0xb84 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-s..p-ui-libs.resources_31bf3856ad364e35_10.0.26100.1_en-us_ccd99822d25e05ba\fveui.dll.mui Handle ID: 0xec4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-s..recoverux.resources_31bf3856ad364e35_10.0.26100.1_en-us_1d68981429b90915\fverecoverux.dll.mui Handle ID: 0x11cc Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-a..orecodecs.resources_31bf3856ad364e35_10.0.26100.1_en-us_4110270a2b46a652\imaadp32.acm.mui Handle ID: 0xba0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-htmlhelp.resources_31bf3856ad364e35_10.0.26100.1_en-us_b241ef07e994792e\hhctrl.ocx.mui Handle ID: 0x11b8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-s..g-jscript.resources_31bf3856ad364e35_11.0.26100.1_en-us_84dbae9459d0da72\jscript.dll.mui Handle ID: 0x7ac Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-s..pt9legacy.resources_31bf3856ad364e35_11.0.26100.1_en-us_2a477902ca280fda\jscript9Legacy.dll.mui Handle ID: 0xeb4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-s..-jscript9.resources_31bf3856ad364e35_11.0.26100.1_en-us_12a050f44b7708d7\jscript9.dll.mui Handle ID: 0x8f8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-m..-schedule.resources_31bf3856ad364e35_10.0.26100.1_en-us_f4c467772edfda45\MdSched.exe.mui Handle ID: 0x10c8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-wmiv2-mi-dll.resources_31bf3856ad364e35_10.0.26100.1_en-us_9347cac8e640fcf1\mi.dll.mui Handle ID: 0x834 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\wow64_microsoft-windows-w..codec-dll.resources_31bf3856ad364e35_10.0.26100.1_en-us_e4daa11469d6883c\mimofcodec.dll.mui Handle ID: 0xdd4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\wow64_microsoft-windows-w..codec-dll.resources_31bf3856ad364e35_10.0.26100.1_en-us_88cd470dd3b2a2f7\mibincodec.dll.mui Handle ID: 0x744 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-mmdeviceapi.resources_31bf3856ad364e35_10.0.26100.1_en-us_c4d7d6b66d7f3be0\MMDevAPI.dll.mui Handle ID: 0x1264 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-d2d.resources_31bf3856ad364e35_10.0.26100.1_en-us_946ba1a0b3672be0\d2d1.dll.mui Handle ID: 0x8ac Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-w..utils-dll.resources_31bf3856ad364e35_10.0.26100.1_en-us_24496a3c69e0aefc\miutils.dll.mui Handle ID: 0x12a0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-a..ecore-acm.resources_31bf3856ad364e35_10.0.26100.1_en-us_56a293ef6c8927ab\msacm32.dll.mui Handle ID: 0x91c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-a..orecodecs.resources_31bf3856ad364e35_10.0.26100.1_en-us_4110270a2b46a652\msadp32.acm.mui Handle ID: 0x1104 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-a..orecodecs.resources_31bf3856ad364e35_10.0.26100.1_en-us_4110270a2b46a652\msg711.acm.mui Handle ID: 0x1194 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-a..orecodecs.resources_31bf3856ad364e35_10.0.26100.1_en-us_4110270a2b46a652\msgsm32.acm.mui Handle ID: 0x107c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-narrator.resources_31bf3856ad364e35_10.0.26100.1_en-us_c34952e6b8fa617f\Narrator.exe.mui Handle ID: 0xb44 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-netman-mui.resources_31bf3856ad364e35_10.0.26100.1_en-us_83e7e6280cb7951d\netman.dll.mui Handle ID: 0x614 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-s..-tool-exe.resources_31bf3856ad364e35_10.0.26100.1_en-us_ba255a87b9dae710\manage-bde.exe.mui Handle ID: 0xe0c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-w..vider-dll.resources_31bf3856ad364e35_10.0.26100.1_en-us_58766f0951209a39\PSModuleDiscoveryProvider.dll.mui Handle ID: 0x888 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-w..vider-dll.resources_31bf3856ad364e35_10.0.26100.1_en-us_58766f0951209a39\psmodulediscoveryprovider.mfl Handle ID: 0xce8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-recdisc-main.resources_31bf3856ad364e35_10.0.26100.1_en-us_a6ec64cb59eb3f29\recdisc.exe.mui Handle ID: 0x8c4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-w..veryagent.resources_31bf3856ad364e35_10.0.26100.1_en-us_af225b1905410d2c\reagent.dll.mui Handle ID: 0x850 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-sysreset.resources_31bf3856ad364e35_10.0.26100.1_en-us_783f5ce2586763b2\ResetEngine.dll.mui Handle ID: 0x9f0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-w..vider-exe.resources_31bf3856ad364e35_10.0.26100.1_en-us_270049511f4d56ef\register-cimprovider.exe.mui Handle ID: 0x86c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-s..repairbde.resources_31bf3856ad364e35_10.0.26100.1_en-us_760398448a5d9613\repair-bde.exe.mui Handle ID: 0xb8c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-scripting.resources_31bf3856ad364e35_10.0.26100.1_en-us_8820496fc0004121\scrobj.dll.mui Handle ID: 0x11e4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-rtworkq.resources_31bf3856ad364e35_10.0.26100.1_en-us_36f3899a17f154ee\RTWorkQ.dll.mui Handle ID: 0xfc8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-scripting.resources_31bf3856ad364e35_10.0.26100.1_en-us_8820496fc0004121\scrrun.dll.mui Handle ID: 0x8d8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-spp-main.resources_31bf3856ad364e35_10.0.26100.1_en-us_bda8e2e1c253bd39\spp.dll.mui Handle ID: 0x118c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-s..tore-main.resources_31bf3856ad364e35_10.0.26100.1_en-us_7d62da30a472d103\rstrui.exe.mui Handle ID: 0xa74 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-spp-main.resources_31bf3856ad364e35_10.0.26100.1_en-us_bda8e2e1c253bd39\sxproxy.dll.mui Handle ID: 0xc28 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-sysreset.resources_31bf3856ad364e35_10.0.26100.1_en-us_783f5ce2586763b2\sysreset.exe.mui Handle ID: 0x11e8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-s..tore-main.resources_31bf3856ad364e35_10.0.26100.1_en-us_7d62da30a472d103\srcore.dll.mui Handle ID: 0xb1c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-t..visioning.resources_31bf3856ad364e35_10.0.26100.1_en-us_02a9e83b832fd45c\TpmCoreProvisioning.dll.mui Handle ID: 0xbc8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-srh.resources_31bf3856ad364e35_10.0.26100.1_en-us_729c5a9273bfa0c5\SRH.dll.mui Handle ID: 0xf0c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-s..-vbscript.resources_31bf3856ad364e35_11.0.26100.1_en-us_40c10dc5437cd766\vbscript.dll.mui Handle ID: 0xaa4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-b..gine-main.resources_31bf3856ad364e35_10.0.26100.1_en-us_c6facfc1927fb96f\wbengine.exe.mui Handle ID: 0xb58 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-a..wdm-audio.resources_31bf3856ad364e35_10.0.26100.1_en-us_6da781a56a672a0f\wdmaud.drv.mui Handle ID: 0x117c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-vssservice.resources_31bf3856ad364e35_10.0.26100.1_en-us_ca306667d37ac835\VSSVC.exe.mui Handle ID: 0x9e8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-d..re-wizard.resources_31bf3856ad364e35_10.0.26100.1_en-us_f8a86e31380b5363\wdscapture.exe.mui Handle ID: 0xff0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-d..es-client.resources_31bf3856ad364e35_10.0.26100.1_en-us_f7f4c41d17e62b60\wdsclient.exe.mui Handle ID: 0x119c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-d..e-library.resources_31bf3856ad364e35_10.0.26100.1_en-us_4d9eeffb8add4052\WdsImage.dll.mui Handle ID: 0xf20 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-d..agnostics.resources_31bf3856ad364e35_10.0.26100.1_en-us_d94181ed8c4b16bb\WdsDiag.dll.mui Handle ID: 0x73c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-d..st-client.resources_31bf3856ad364e35_10.0.26100.1_en-us_e0613840ae5b5547\wdsmcast.exe.mui Handle ID: 0xc44 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-e..portingui.resources_31bf3856ad364e35_10.0.26100.1_en-us_8c1c31132c830666\werui.dll.mui Handle ID: 0xe2c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-w..itomi-dll.resources_31bf3856ad364e35_10.0.26100.1_en-us_58b68966e341e3eb\wmitomi.dll.mui Handle ID: 0x10b8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-scripting.resources_31bf3856ad364e35_10.0.26100.1_en-us_8820496fc0004121\wshom.ocx.mui Handle ID: 0xc40 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-d..xaudio2_9.resources_31bf3856ad364e35_10.0.26100.1_en-us_443e30a592a609be\XAudio2_9.dll.mui Handle ID: 0xd80 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-scripting.resources_31bf3856ad364e35_10.0.26100.1_en-us_8820496fc0004121\wscript.exe.mui Handle ID: 0x898 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-blb-cli-main.resources_31bf3856ad364e35_10.0.26100.1_en-us_f1b80dfef965cac9\wbadmin.exe.mui Handle ID: 0xa28 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-srh.resources_31bf3856ad364e35_10.0.26100.1_en-us_729c5a9273bfa0c5\tier2punctuations.dll.mui Handle ID: 0x690 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-s..monnoia64.resources_31bf3856ad364e35_10.0.26100.1_en-us_520428772c45561c\sapi.dll.mui Handle ID: 0xd6c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-wmi-core_31bf3856ad364e35_10.0.26100.1_none_b647ab7588253a78\WMIMigrationPlugin.dll Handle ID: 0xe70 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-b..ondata-wmi-provider_31bf3856ad364e35_10.0.26100.1_none_ad5b851ee599c51f\bcd.mof Handle ID: 0x930 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-u..odepowerservice-mof_31bf3856ad364e35_10.0.26100.1_none_42e35b871e5f5eb6\cimdmtf.mof Handle ID: 0x9bc Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-shenzhouttsvoicecommon_31bf3856ad364e35_10.0.26100.1_none_791b3e57b08ce093\MSTTSLoc.dll Handle ID: 0xc78 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-w..d-line-utility-base_31bf3856ad364e35_10.0.26100.1_none_0abf77822bedc120\cli.mof Handle ID: 0xfd8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-shenzhouttsvoicecommon_31bf3856ad364e35_10.0.26100.1_none_791b3e57b08ce093\MSTTSEngine.dll Handle ID: 0x9d4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-wmi-core_31bf3856ad364e35_10.0.26100.1_none_b647ab7588253a78\esscli.dll Handle ID: 0x7f4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-filetracefilter_31bf3856ad364e35_10.0.26100.1_none_f7b7fc42d5aa7316\filetrace.mof Handle ID: 0xacc Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-speechcommon_31bf3856ad364e35_10.0.26100.1_none_d2f5f0f73b377fc0\sapi.dll Handle ID: 0xf94 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-imapiv2-base-mof_31bf3856ad364e35_10.0.26100.1_none_50847d3c494a5936\IMAPIv2-Base.mof Handle ID: 0x123c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..lesystemsupport-mof_31bf3856ad364e35_10.0.26100.1_none_903448bbd4a38479\IMAPIv2-FileSystemSupport.mof Handle ID: 0x950 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-imapiv2-legacyshim-mof_31bf3856ad364e35_10.0.26100.1_none_dbf2a923110b1f4b\IMAPIv2-LegacyShim.mof Handle ID: 0x11b4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-security-kerberos-mof_31bf3856ad364e35_10.0.26100.1_none_e0743c480e419334\kerberos.mof Handle ID: 0x113c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-hbaapi_31bf3856ad364e35_10.0.26100.1_none_46075543dbac6e08\hbaapi.mof Handle ID: 0x128c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-wmi-krnlprov-provider_31bf3856ad364e35_10.0.26100.1_none_e0a46c605da3883f\KrnlProv.dll Handle ID: 0x10c0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-mup-mof_31bf3856ad364e35_10.0.26100.1_none_5976ba618cc18384\Microsoft-Windows-Remote-FileSystem.mof Handle ID: 0x6c4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-wmi-krnlprov-provider_31bf3856ad364e35_10.0.26100.1_none_e0a46c605da3883f\krnlprov.mof Handle ID: 0xbe8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-wmi-core_31bf3856ad364e35_10.0.26100.1_none_b647ab7588253a78\mofcomp.exe Handle ID: 0xba4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-wmi-mofinstaller_31bf3856ad364e35_10.0.26100.1_none_0f11079c944d47d1\mofinstall.dll Handle ID: 0xfe0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-security-ntlm-mof_31bf3856ad364e35_10.0.26100.1_none_214acf11fef12814\msv1_0.mof Handle ID: 0x1244 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-wmi-core_31bf3856ad364e35_10.0.26100.1_none_b647ab7588253a78\NCProv.dll Handle ID: 0xe6c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-ntfs-mof_31bf3856ad364e35_10.0.26100.1_none_921cf033b29fc1cf\ntfs.mof Handle ID: 0x1290 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-wmi-core-fastprox-dll_31bf3856ad364e35_10.0.26100.1_none_f83cfbbae2493e6d\fastprox.dll Handle ID: 0x998 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-wmi-core_31bf3856ad364e35_10.0.26100.1_none_b647ab7588253a78\mofd.dll Handle ID: 0xf40 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-wmi-filter_31bf3856ad364e35_10.0.26100.1_none_d91267a2bea65a4b\PolicMan.mof Handle ID: 0x1054 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-u..odepowerservice-mof_31bf3856ad364e35_10.0.26100.1_none_42e35b871e5f5eb6\powermeterprovider.mof Handle ID: 0x1254 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-u..odepowerservice-mof_31bf3856ad364e35_10.0.26100.1_none_42e35b871e5f5eb6\profileassociationprovider.mof Handle ID: 0xc74 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-w..d-line-utility-base_31bf3856ad364e35_10.0.26100.1_none_0abf77822bedc120\rawxml.xsl Handle ID: 0xf28 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-u..odepowerservice-mof_31bf3856ad364e35_10.0.26100.1_none_42e35b871e5f5eb6\PowerPolicyProvider.mof Handle ID: 0xad8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-wmi-filter_31bf3856ad364e35_10.0.26100.1_none_d91267a2bea65a4b\PolicMan.dll Handle ID: 0xbf8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-wmi-stdprov-provider_31bf3856ad364e35_10.0.26100.1_none_3b8207812f1bf025\regevent.mof Handle ID: 0xa6c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-security-schannel-mof_31bf3856ad364e35_10.0.26100.1_none_e2b0584acde6feab\schannel.mof Handle ID: 0x104c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-grouppolicy-base-mof_31bf3856ad364e35_10.0.26100.1_none_efb7ddca7abdd1dd\rsop.mof Handle ID: 0xab4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-wmi-consumers_31bf3856ad364e35_10.0.26100.1_none_47c5cfc8c16dfb4a\scrcons.exe Handle ID: 0x11ac Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-wmi-consumers_31bf3856ad364e35_10.0.26100.1_none_47c5cfc8c16dfb4a\SMTPCons.dll Handle ID: 0xc0c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-tcpip-mof_31bf3856ad364e35_10.0.26100.1_none_34d18c36ed7c2874\tcpip.mof Handle ID: 0x704 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-w..ovider-cimwin32-dll_31bf3856ad364e35_10.0.26100.1_none_cc9e99916e9c660a\cimwin32.dll Handle ID: 0x920 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-w..d-line-utility-base_31bf3856ad364e35_10.0.26100.1_none_0abf77822bedc120\texttable.xsl Handle ID: 0x778 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-w..d-line-utility-base_31bf3856ad364e35_10.0.26100.1_none_0abf77822bedc120\textvaluelist.xsl Handle ID: 0xcbc Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-wmi-core_31bf3856ad364e35_10.0.26100.1_none_b647ab7588253a78\unsecapp.exe Handle ID: 0x7d8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-wmi-stdprov-provider_31bf3856ad364e35_10.0.26100.1_none_3b8207812f1bf025\stdprov.dll Handle ID: 0x9e4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-s..gevolumewmiprovider_31bf3856ad364e35_10.0.26100.1_none_14c76e6772794a8e\vds.mof Handle ID: 0x8ec Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-wmi-core-repdrvfs-dll_31bf3856ad364e35_10.0.26100.1_none_7b3562419977b9a0\repdrvfs.dll Handle ID: 0xa30 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-wmi-consumers_31bf3856ad364e35_10.0.26100.1_none_47c5cfc8c16dfb4a\wbemcons.dll Handle ID: 0xc04 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-wmi-scripting_31bf3856ad364e35_10.0.26100.1_none_5e04e0f75b49d2b2\wbemdisp.tlb Handle ID: 0xf1c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-s..gevolumewmiprovider_31bf3856ad364e35_10.0.26100.1_none_14c76e6772794a8e\vdswmi.dll Handle ID: 0x11a8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-wmi-core_31bf3856ad364e35_10.0.26100.1_none_b647ab7588253a78\wbemprox.dll Handle ID: 0xc84 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-wmi-core_31bf3856ad364e35_10.0.26100.1_none_b647ab7588253a78\wbemsvc.dll Handle ID: 0x1030 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-wmi-scripting_31bf3856ad364e35_10.0.26100.1_none_5e04e0f75b49d2b2\wbemdisp.dll Handle ID: 0xe7c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-security-digest-mof_31bf3856ad364e35_10.0.26100.1_none_29200b8abff3fcb3\wdigest.mof Handle ID: 0x10d4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-wmi-tools_31bf3856ad364e35_10.0.26100.1_none_d4ef1241ec2c00e8\wbemtest.exe Handle ID: 0x7e4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-securestartup-wmi_31bf3856ad364e35_10.0.26100.1_none_5d75fe32eddbb4e7\win32_encryptablevolume.mof Handle ID: 0x6cc Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-securestartup-wmi_31bf3856ad364e35_10.0.26100.1_none_5d75fe32eddbb4e7\Win32_EncryptableVolumeUninstall.mof Handle ID: 0x788 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-wmi-core-wbemess-dll_31bf3856ad364e35_10.0.26100.1_none_60c8f784982d81c4\wbemess.dll Handle ID: 0xd00 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-tpm-driver-wmi_31bf3856ad364e35_10.0.26100.1_none_6c80b6c128d060f7\Win32_Tpm.dll Handle ID: 0x1098 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-wininit-mof_31bf3856ad364e35_10.0.26100.1_none_d7d484d9b216201a\wininit.mof Handle ID: 0x874 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-securestartup-wmi_31bf3856ad364e35_10.0.26100.1_none_5d75fe32eddbb4e7\Win32_EncryptableVolume.dll Handle ID: 0x7c8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-winlogon-mof_31bf3856ad364e35_10.0.26100.1_none_7d2c7230de7477ed\winlogon.mof Handle ID: 0x6e0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-tpm-driver-wmi_31bf3856ad364e35_10.0.26100.1_none_6c80b6c128d060f7\Win32_Tpm.mof Handle ID: 0x918 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-wmi-core_31bf3856ad364e35_10.0.26100.1_none_b647ab7588253a78\WinMgmtR.dll Handle ID: 0xa54 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-wmi-core_31bf3856ad364e35_10.0.26100.1_none_b647ab7588253a78\WmiApRes.dll Handle ID: 0xbf4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-wmi-core-svc_31bf3856ad364e35_10.0.26100.1_none_9da664305f7db913\WinMgmt.exe Handle ID: 0x75c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-wmi-core-svc_31bf3856ad364e35_10.0.26100.1_none_9da664305f7db913\WmiApRpl.dll Handle ID: 0x10ac Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-wmi-core_31bf3856ad364e35_10.0.26100.1_none_b647ab7588253a78\WMIADAP.exe Handle ID: 0x74c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-wmi-core_31bf3856ad364e35_10.0.26100.1_none_b647ab7588253a78\WmiApSrv.exe Handle ID: 0x7f0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-wmi-core_31bf3856ad364e35_10.0.26100.1_none_b647ab7588253a78\WMICOOKR.dll Handle ID: 0x858 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-w..in32-provider-admin_31bf3856ad364e35_10.0.26100.1_none_37f441cb6d64d47a\wmipcima.dll Handle ID: 0xb40 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-wmi-core-providerhost_31bf3856ad364e35_10.0.26100.1_none_0d5666ebf3f1a44c\WmiDcPrv.dll Handle ID: 0xc94 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-wmi-win32-provider_31bf3856ad364e35_10.0.26100.1_none_c3beae16deddbf5e\wmipdfs.mof Handle ID: 0x11a4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-w..in32-provider-admin_31bf3856ad364e35_10.0.26100.1_none_37f441cb6d64d47a\wmipdfs.dll Handle ID: 0x910 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-wmi-win32-provider_31bf3856ad364e35_10.0.26100.1_none_c3beae16deddbf5e\wmipdskq.mof Handle ID: 0x6ac Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-w..ommand-line-utility_31bf3856ad364e35_10.0.26100.1_none_9e9d7dbf35638ca0\WMIC.exe Handle ID: 0xcf8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-w..in32-provider-admin_31bf3856ad364e35_10.0.26100.1_none_37f441cb6d64d47a\wmipdskq.dll Handle ID: 0x1164 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-w..d-line-utility-base_31bf3856ad364e35_10.0.26100.1_none_0abf77822bedc120\cliegaliases.mof Handle ID: 0x126c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-wmi-ping-provider_31bf3856ad364e35_10.0.26100.1_none_4879a7a536d435a9\wmipicmp.mof Handle ID: 0xb6c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-wmi-ping-provider_31bf3856ad364e35_10.0.26100.1_none_4879a7a536d435a9\WMIPICMP.dll Handle ID: 0xb38 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-w..in32-provider-admin_31bf3856ad364e35_10.0.26100.1_none_37f441cb6d64d47a\WMIPSESS.dll Handle ID: 0x938 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-wmi-win32-provider_31bf3856ad364e35_10.0.26100.1_none_c3beae16deddbf5e\wmipsess.mof Handle ID: 0xb18 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-wmi-wdm-provider_31bf3856ad364e35_10.0.26100.1_none_77267465ca9c4c05\wmiprov.dll Handle ID: 0xb84 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-wmi-core_31bf3856ad364e35_10.0.26100.1_none_b647ab7588253a78\wmiutils.dll Handle ID: 0x1190 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-w..d-line-utility-base_31bf3856ad364e35_10.0.26100.1_none_0abf77822bedc120\xsl-mappings.xml Handle ID: 0xec4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-wmi-core-svc_31bf3856ad364e35_10.0.26100.1_none_9da664305f7db913\WMIsvc.dll Handle ID: 0x11cc Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-w..win32-dll.resources_31bf3856ad364e35_10.0.26100.1_en-us_a099efc28231aa5d\cimwin32.dll.mui Handle ID: 0xbd8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-wmi-core-providerhost_31bf3856ad364e35_10.0.26100.1_none_0d5666ebf3f1a44c\WmiPrvSE.exe Handle ID: 0x868 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-wmi-core-wbemcore-dll_31bf3856ad364e35_10.0.26100.1_none_deb35b443f5e48fa\wbemcore.dll Handle ID: 0xd60 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-w..lity-base.resources_31bf3856ad364e35_10.0.26100.1_en-us_23089f043f9c1d1d\csv.xsl Handle ID: 0x968 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-w..lity-base.resources_31bf3856ad364e35_10.0.26100.1_en-us_23089f043f9c1d1d\cliegaliases.mfl Handle ID: 0x8f8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-f..acefilter.resources_31bf3856ad364e35_10.0.26100.1_en-us_b51b6e4475f11933\filetrace.mfl Handle ID: 0xba0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-u..rvice-mof.resources_31bf3856ad364e35_10.0.26100.1_en-us_f20d243674b720fd\cimdmtf.mfl Handle ID: 0x1230 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-w..lity-base.resources_31bf3856ad364e35_10.0.26100.1_en-us_23089f043f9c1d1d\hform.xsl Handle ID: 0x10c8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-w..lity-base.resources_31bf3856ad364e35_10.0.26100.1_en-us_23089f043f9c1d1d\htable.xsl Handle ID: 0x115c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-w..-provider.resources_31bf3856ad364e35_10.0.26100.1_en-us_bf7ab48fe4bd466e\KrnlProv.dll.mui Handle ID: 0xff4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-w..-provider.resources_31bf3856ad364e35_10.0.26100.1_en-us_bf7ab48fe4bd466e\krnlprov.mfl Handle ID: 0x7b0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-wmi-core.resources_31bf3856ad364e35_10.0.26100.1_en-us_d1bb369b303559b1\mofcomp.exe.mui Handle ID: 0x116c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-w..lity-base.resources_31bf3856ad364e35_10.0.26100.1_en-us_23089f043f9c1d1d\mof.xsl Handle ID: 0xfd0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-wmi-core.resources_31bf3856ad364e35_10.0.26100.1_en-us_d1bb369b303559b1\NCProv.dll.mui Handle ID: 0xe88 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-wmi-core.resources_31bf3856ad364e35_10.0.26100.1_en-us_d1bb369b303559b1\mofd.dll.mui Handle ID: 0xd58 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-w..lity-base.resources_31bf3856ad364e35_10.0.26100.1_en-us_23089f043f9c1d1d\cli.mfl Handle ID: 0x740 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-wmi-filter.resources_31bf3856ad364e35_10.0.26100.1_en-us_bfa8a2311cebe910\PolicMan.mfl Handle ID: 0x12a0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-u..rvice-mof.resources_31bf3856ad364e35_10.0.26100.1_en-us_f20d243674b720fd\powermeterprovider.mfl Handle ID: 0x9e0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-u..rvice-mof.resources_31bf3856ad364e35_10.0.26100.1_en-us_f20d243674b720fd\profileassociationprovider.mfl Handle ID: 0xbc4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-u..rvice-mof.resources_31bf3856ad364e35_10.0.26100.1_en-us_f20d243674b720fd\PowerPolicyProvider.mfl Handle ID: 0x8ac Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-w..consumers.resources_31bf3856ad364e35_10.0.26100.1_en-us_5d0e2df387a86d5d\scrcons.exe.mui Handle ID: 0xf70 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-s..iprovider.resources_31bf3856ad364e35_10.0.26100.1_en-us_d37f4399069b3425\vds.mfl Handle ID: 0x1264 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-w..-provider.resources_31bf3856ad364e35_10.0.26100.1_en-us_cc69054f258235ae\regevent.mfl Handle ID: 0x744 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-s..iprovider.resources_31bf3856ad364e35_10.0.26100.1_en-us_d37f4399069b3425\vdswmi.dll.mui Handle ID: 0x6c0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-w..mcore-dll.resources_31bf3856ad364e35_10.0.26100.1_en-us_d4b386709268a8b9\wbemcore.dll.mui Handle ID: 0x10fc Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-wininit-mof.resources_31bf3856ad364e35_10.0.26100.1_en-us_651bed97bb9bed49\wininit.mfl Handle ID: 0xdd4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-winlogon-mof.resources_31bf3856ad364e35_10.0.26100.1_en-us_25ae8bb687db6654\winlogon.mfl Handle ID: 0x834 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-wmi-core-svc.resources_31bf3856ad364e35_10.0.26100.1_en-us_899bf07a94df418a\WinMgmt.exe.mui Handle ID: 0xeb4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-wmi-tools.resources_31bf3856ad364e35_10.0.26100.1_en-us_446aaec28d00dc8d\wbemtest.exe.mui Handle ID: 0xb8c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-wmi-core.resources_31bf3856ad364e35_10.0.26100.1_en-us_d1bb369b303559b1\WmiApRes.dll.mui Handle ID: 0x7ac Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-wmi-core-svc.resources_31bf3856ad364e35_10.0.26100.1_en-us_899bf07a94df418a\WmiApRpl.dll.mui Handle ID: 0xfc8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-wmi-core.resources_31bf3856ad364e35_10.0.26100.1_en-us_d1bb369b303559b1\WmiApSrv.exe.mui Handle ID: 0x86c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-wmi-core.resources_31bf3856ad364e35_10.0.26100.1_en-us_d1bb369b303559b1\WinMgmtR.dll.mui Handle ID: 0x9f0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-w..-provider.resources_31bf3856ad364e35_10.0.26100.1_en-us_f8250d61f417fe41\wmipdfs.mfl Handle ID: 0x850 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-w..-provider.resources_31bf3856ad364e35_10.0.26100.1_en-us_f8250d61f417fe41\wmipdskq.mfl Handle ID: 0x8c4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-w..-provider.resources_31bf3856ad364e35_10.0.26100.1_en-us_fe3c9bc185c24738\WMIPICMP.dll.mui Handle ID: 0xce8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-wmi-core-providerhost_31bf3856ad364e35_10.0.26100.1_none_0d5666ebf3f1a44c\WmiPrvSD.dll Handle ID: 0x888 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-wmi-core-svc.resources_31bf3856ad364e35_10.0.26100.1_en-us_899bf07a94df418a\WMIsvc.dll.mui Handle ID: 0xe0c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-w..-provider.resources_31bf3856ad364e35_10.0.26100.1_en-us_fe3c9bc185c24738\wmipicmp.mfl Handle ID: 0xa74 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-w..-provider.resources_31bf3856ad364e35_10.0.26100.1_en-us_f8250d61f417fe41\wmipsess.mfl Handle ID: 0xbc8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-w..lity-base.resources_31bf3856ad364e35_10.0.26100.1_en-us_23089f043f9c1d1d\xml.xsl Handle ID: 0x11e8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-hbaapi.resources_31bf3856ad364e35_10.0.26100.1_en-us_8d91f408ccb8546f\hbaapi.mfl Handle ID: 0xaa4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-wmi-core.resources_31bf3856ad364e35_10.0.26100.1_en-us_d1bb369b303559b1\wmiutils.dll.mui Handle ID: 0xc28 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-w..e-utility.resources_31bf3856ad364e35_10.0.26100.1_en-us_fc50ce9929dbc2c3\WMIC.exe.mui Handle ID: 0xff0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-g..-base-mof.resources_31bf3856ad364e35_10.0.26100.1_en-us_9d9dd2bb0c7306dc\rsop.mfl Handle ID: 0x9e8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-wmi-core_31bf3856ad364e35_10.0.26100.1_none_b647ab7588253a78\cim20.dtd Handle ID: 0x117c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-wmi-core_31bf3856ad364e35_10.0.26100.1_none_b647ab7588253a78\wmi20.dtd Handle ID: 0xb58 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-wmi-text-encoding_31bf3856ad364e35_10.0.26100.1_none_b6750f6da49d32ba\wmi2xml.dll Handle ID: 0xe2c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-scripting-chakra_31bf3856ad364e35_11.0.26100.1_none_f44392a7adddbbca\Chakra.dll.mun Handle ID: 0x11b8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..-unicode-components_31bf3856ad364e35_10.0.26100.1_none_158e2f5efa46ad38\icudtl.dat Handle ID: 0xc14 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\wow64_microsoft-windows-winomi-mibincodec-dll_31bf3856ad364e35_10.0.26100.1_none_4fe2da480ab46754\mibincodec.dll Handle ID: 0x10b8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\wow64_microsoft-windows-winomi-mimofcodec-dll_31bf3856ad364e35_10.0.26100.1_none_4cce651bc452c661\mimofcodec.dll Handle ID: 0xc44 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$.cdf-ms Handle ID: 0xc40 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_boot_40104b85a18bfcb2.cdf-ms Handle ID: 0xb1c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_boot_dvd_pcat_de3c62295de3e26e.cdf-ms Handle ID: 0xe70 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_boot_dvd_pcat_en-us_80af7686f451a150.cdf-ms Handle ID: 0xd6c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_globalization_0fc22903a221b67f.cdf-ms Handle ID: 0x9bc Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_en-us_40104e69a1d105cc.cdf-ms Handle ID: 0xabc Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_globalization_icu_0b932b2a9cc9f858.cdf-ms Handle ID: 0x1070 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_speech_3b206622a946e834.cdf-ms Handle ID: 0x930 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_speech_common_76cd6f1aaba6e83b.cdf-ms Handle ID: 0x614 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_speech_common_en-us_11ebcc5f3c902d23.cdf-ms Handle ID: 0xb44 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_speech_engines_8a294d630e90192b.cdf-ms Handle ID: 0x107c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_speech_engines_tts_4e06b8e5aea05fb6.cdf-ms Handle ID: 0x1194 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_speech_engines_tts_en-us_5bd3d35b5669eef6.cdf-ms Handle ID: 0x1104 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_system32_driverstore_a531a9c6b3dfcf87.cdf-ms Handle ID: 0x91c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_system32_migration_927a21df1acd7c18.cdf-ms Handle ID: 0xd94 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_system32_recovery_f87e94e0816fb86b.cdf-ms Handle ID: 0x9a0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_system32_speech_common_8c297630658eaa3d.cdf-ms Handle ID: 0x764 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_system32_speech_common_en-us_fda4d836608fc881.cdf-ms Handle ID: 0x7fc Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_system32_speech_engines_tts_181a16025b64685a.cdf-ms Handle ID: 0x90c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_system32_wbem_xml_026f0f207227ebbc.cdf-ms Handle ID: 0xc5c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\programdata.cdf-ms Handle ID: 0xefc Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\programdata_microsoft_fe5c6d762edd2110.cdf-ms Handle ID: 0x750 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\programdata_microsoft_windows_cae2264614449191.cdf-ms Handle ID: 0xc10 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\programdata_microsoft_windows_start_menu_fde55420546edfe6.cdf-ms Handle ID: 0x990 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\programdata_microsoft_windows_start_menu_programs_administrative_tools_50eba26877c48094.cdf-ms Handle ID: 0x9c4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\programdata_microsoft_windows_start_menu_programs_d672ba09d81e87ff.cdf-ms Handle ID: 0x1180 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\program_files_common_files_d7a65bb2f0e854e7.cdf-ms Handle ID: 0xe6c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\program_files_common_files_microsoft_shared_818c5a0e45020fba.cdf-ms Handle ID: 0x998 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\program_files_common_files_microsoft_shared_ink_en-us_8a16130a1a0cde0c.cdf-ms Handle ID: 0x1054 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\program_files_common_files_microsoft_shared_ink_3c86e3db0b3b254c.cdf-ms Handle ID: 0xc30 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\program_files_common_files_microsoft_shared_ink_fsdefinitions_auxpad_bb15ebb5c2b76782.cdf-ms Handle ID: 0xf40 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\program_files_common_files_microsoft_shared_ink_fsdefinitions_92b215ec670a7f35.cdf-ms Handle ID: 0x1244 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\program_files_common_files_microsoft_shared_ink_fsdefinitions_insert_bb25e7d5c2685e4a.cdf-ms Handle ID: 0xbe8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\program_files_common_files_microsoft_shared_ink_fsdefinitions_keypad_bb29f287c24d4a93.cdf-ms Handle ID: 0x1254 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\program_files_common_files_microsoft_shared_ink_fsdefinitions_oskclearui_efb22b63342a179d.cdf-ms Handle ID: 0x1290 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\program_files_common_files_microsoft_shared_ink_fsdefinitions_main_992db4c6307e339e.cdf-ms Handle ID: 0xfe0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\program_files_common_files_microsoft_shared_ink_fsdefinitions_osknav_bb31da33c2376c77.cdf-ms Handle ID: 0x104c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\program_files_common_files_microsoft_shared_ink_fsdefinitions_osknumpad_ee37ed195958108b.cdf-ms Handle ID: 0xbf8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\program_files_common_files_microsoft_shared_ink_fsdefinitions_oskpred_4ada71c56aba89ef.cdf-ms Handle ID: 0x11ac Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\program_files_common_files_microsoft_shared_ink_fsdefinitions_symbols_4eaf815d64e8ecbc.cdf-ms Handle ID: 0xa6c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\program_files_common_files_microsoft_shared_ink_languagemodel_ccceb944834c6c97.cdf-ms Handle ID: 0x6c4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\program_files_ffd0cbfc813cc4f1.cdf-ms Handle ID: 0xab4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\program_files_common_files_microsoft_shared_ink_fsdefinitions_oskmenu_4ada925d6aba5911.cdf-ms Handle ID: 0x778 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\users.cdf-ms Handle ID: 0x920 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\users_default_73615b64075aa65f.cdf-ms Handle ID: 0x704 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\users_default_appdata_33f0d5f51e505ec2.cdf-ms Handle ID: 0x754 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\users_default_appdata_roaming_482f0bdd00d1643d.cdf-ms Handle ID: 0x7d8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\users_default_appdata_roaming_microsoft_b898cfd29d5951f1.cdf-ms Handle ID: 0xcbc Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\users_default_appdata_roaming_microsoft_windows_4793cab2f72cc262.cdf-ms Handle ID: 0xba4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\users_default_appdata_roaming_microsoft_windows_start_menu_5eb528778fd8d821.cdf-ms Handle ID: 0xc04 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\users_default_appdata_roaming_microsoft_windows_start_menu_programs_accessibility_1fe25fac404028a8.cdf-ms Handle ID: 0xa30 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\_0000000000000000.cdf-ms Handle ID: 0xc0c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..dsetup-rejuvenation_31bf3856ad364e35_10.0.26100.1_none_4f8cc7ff7948385b\diagER.dll Handle ID: 0x7d8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..dsetup-rejuvenation_31bf3856ad364e35_10.0.26100.5059_none_ee8a7a91c09e45ad\hwexclude.txt Handle ID: 0xcbc Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..dsetup-rejuvenation_31bf3856ad364e35_10.0.26100.1_none_4f8cc7ff7948385b\hwcompat.dll Handle ID: 0x7f4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..dsetup-rejuvenation_31bf3856ad364e35_10.0.26100.1_none_4f8cc7ff7948385b\offline.xml Handle ID: 0xfd8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..dsetup-rejuvenation_31bf3856ad364e35_10.0.26100.1_none_4f8cc7ff7948385b\pnppropmig.dll Handle ID: 0xe50 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..dsetup-rejuvenation_31bf3856ad364e35_10.0.26100.1_none_4f8cc7ff7948385b\hwcompat.txt Handle ID: 0x11e4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..dsetup-rejuvenation_31bf3856ad364e35_10.0.26100.1_none_4f8cc7ff7948385b\setupplatform.exe Handle ID: 0x2b8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..dsetup-rejuvenation_31bf3856ad364e35_10.0.26100.5059_none_ee8a7a91c09e45ad\upgrade_frmwrk.xml Handle ID: 0xca4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..dsetup-rejuvenation_31bf3856ad364e35_10.0.26100.1_none_4f8cc7ff7948385b\unbcl.dll Handle ID: 0x970 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..dsetup-rejuvenation_31bf3856ad364e35_10.0.26100.1_none_4f8cc7ff7948385b\wdsutil.dll Handle ID: 0xab4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..dsetup-rejuvenation_31bf3856ad364e35_10.0.26100.1_none_4f8cc7ff7948385b\WinSetupMon.hiv Handle ID: 0x6c4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..dsetup-rejuvenation_31bf3856ad364e35_10.0.26100.1_none_4f8cc7ff7948385b\WinSetupMon.sys Handle ID: 0xa6c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..uvenation.resources_31bf3856ad364e35_10.0.26100.1_en-us_40d47957b5a0a4be\setupplatform.exe.mui Handle ID: 0x1254 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..dsetup-rejuvenation_31bf3856ad364e35_10.0.26100.1_none_4f8cc7ff7948385b\setupplatform.dll Handle ID: 0x950 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-b..environment-dvd-efi_31bf3856ad364e35_10.0.26100.1_none_d23b3fb5ed0fb788\BCD Handle ID: 0x123c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-b..nvironment-dvd-pcat_31bf3856ad364e35_10.0.26100.1_none_970b79c3990b4446\boot.sdi Handle ID: 0x6f8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-b..environment-dvd-efi_31bf3856ad364e35_10.0.26100.1_none_d23b3fb5ed0fb788\boot.sdi Handle ID: 0x7fc Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-b..ore-bootmanager-efi_31bf3856ad364e35_10.0.26100.1_none_8474913804ec759d\bootmgfw.efi Handle ID: 0x90c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-c..gci-elockdownpolicy_31bf3856ad364e35_10.0.26100.1_none_a9965b84b2b642e8\{5DAC656C-21AD-4A02-AB49-649917162E70}.cip Handle ID: 0xc5c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-c..gci-elockdownpolicy_31bf3856ad364e35_10.0.26100.1_none_a9965b84b2b642e8\{CDD5CB55-DB68-4D71-AA38-3DF2B6473A52}.cip Handle ID: 0x73c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-c..gci-elockdownpolicy_31bf3856ad364e35_10.0.26100.1_none_a9965b84b2b642e8\{82443e1e-8a39-4b4a-96a8-f40ddc00b9f3}.cip Handle ID: 0xa28 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-f..-truetype-dokchampa_31bf3856ad364e35_10.0.26100.1_none_4e74ea686a484896\dokchamp.ttf Handle ID: 0xb40 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-f..pe-estrangeloedessa_31bf3856ad364e35_10.0.26100.1_none_f9a268d3e281950b\estre.ttf Handle ID: 0xc94 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-font-truetype-daunpenh_31bf3856ad364e35_10.0.26100.1_none_04b856ab8c5206f3\daunpenh.ttf Handle ID: 0x74c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-f..-truetype-browallia_31bf3856ad364e35_10.0.26100.1_none_c8f50d0aea263793\browalia.ttc Handle ID: 0xd00 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-font-truetype-euphemia_31bf3856ad364e35_10.0.26100.1_none_b517d5b8c1852032\euphemia.ttf Handle ID: 0x788 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-font-truetype-gadugi_31bf3856ad364e35_10.0.26100.1_none_e1326a4c8dcc8ee1\gadugi.ttf Handle ID: 0x7f0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-f..truetype-gadugibold_31bf3856ad364e35_10.0.26100.1_none_7d13a3571ac64614\gadugib.ttf Handle ID: 0x858 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-font-truetype-gautami_31bf3856ad364e35_10.0.26100.1_none_78a8178504c74544\gautami.ttf Handle ID: 0xae4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-font-truetype-gautami_31bf3856ad364e35_10.0.26100.1_none_78a8178504c74544\gautamib.ttf Handle ID: 0x6cc Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-font-truetype-kalinga_31bf3856ad364e35_10.0.26100.1_none_064d38f0e91c4909\kalinga.ttf Handle ID: 0xbf4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-font-truetype-kalinga_31bf3856ad364e35_10.0.26100.1_none_064d38f0e91c4909\kalingab.ttf Handle ID: 0xaec Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-f..ruetype-iskoolapota_31bf3856ad364e35_10.0.26100.1_none_cb6543adc8ca9766\iskpotab.ttf Handle ID: 0xc48 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-f..uetype-javanesetext_31bf3856ad364e35_10.0.26100.1_none_fa59e84ab2fe455c\javatext.ttf Handle ID: 0xfbc Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-f..e-microsofthimalaya_31bf3856ad364e35_10.0.26100.1_none_0526684aa434b846\himalaya.ttf Handle ID: 0x10b0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-font-truetype-kartika_31bf3856ad364e35_10.0.26100.1_none_071fc8018160268b\kartikab.ttf Handle ID: 0xa2c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-font-truetype-kartika_31bf3856ad364e35_10.0.26100.1_none_071fc8018160268b\kartika.ttf Handle ID: 0xbd0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-f..ruetype-iskoolapota_31bf3856ad364e35_10.0.26100.1_none_cb6543adc8ca9766\iskpota.ttf Handle ID: 0x1270 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-font-truetype-laoui_31bf3856ad364e35_10.0.26100.1_none_712b783082719fec\LaoUIb.ttf Handle ID: 0xc70 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-font-truetype-laoui_31bf3856ad364e35_10.0.26100.1_none_712b783082719fec\LaoUI.ttf Handle ID: 0x92c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-font-truetype-latha_31bf3856ad364e35_10.0.26100.1_none_6da5685a84b3ad3a\latha.ttf Handle ID: 0x1138 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-font-truetype-latha_31bf3856ad364e35_10.0.26100.1_none_6da5685a84b3ad3a\lathab.ttf Handle ID: 0x898 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-font-truetype-khmerui_31bf3856ad364e35_10.0.26100.1_none_45f93912d30fa519\KhmerUI.ttf Handle ID: 0x118c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-f..truetype-leelawadee_31bf3856ad364e35_10.0.26100.1_none_0584b54546c9dfc7\leelawad.ttf Handle ID: 0xdac Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-f..truetype-leelawadee_31bf3856ad364e35_10.0.26100.1_none_0584b54546c9dfc7\leelawdb.ttf Handle ID: 0xac0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-font-truetype-ebrima_31bf3856ad364e35_10.0.26100.1_none_cb6f770ec4959f96\ebrima.ttf Handle ID: 0x1004 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-f..truetype-ebrimabold_31bf3856ad364e35_10.0.26100.1_none_2e41eb08a6f6629f\ebrimabd.ttf Handle ID: 0x7c0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-font-truetype-mangal_31bf3856ad364e35_10.0.26100.1_none_b129a97e3ef70d78\mangal.ttf Handle ID: 0x8ac Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-font-truetype-khmerui_31bf3856ad364e35_10.0.26100.1_none_45f93912d30fa519\KhmerUIb.ttf Handle ID: 0xba0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-font-truetype-mvboli_31bf3856ad364e35_10.0.26100.1_none_6fe1a68ab074eee1\mvboli.ttf Handle ID: 0xc84 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-font-truetype-mangal_31bf3856ad364e35_10.0.26100.1_none_b129a97e3ef70d78\mangalb.ttf Handle ID: 0xab8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-f..-truetype-newtailue_31bf3856ad364e35_10.0.26100.1_none_ae572df792ef0924\ntailu.ttf Handle ID: 0xc44 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-f..etype-newtailuebold_31bf3856ad364e35_10.0.26100.1_none_a413c103dab0fcff\ntailub.ttf Handle ID: 0x11a8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-font-truetype-yibaiti_31bf3856ad364e35_10.0.26100.1_none_553568aa232adacf\msyi.ttf Handle ID: 0xf1c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-f..type-mongolianbaiti_31bf3856ad364e35_10.0.26100.1_none_00916f176f16b93d\monbaiti.ttf Handle ID: 0xb1c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-f..ype-myanmartextbold_31bf3856ad364e35_10.0.26100.1_none_895eec49319b5797\mmrtextb.ttf Handle ID: 0x1070 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-f..ruetype-myanmartext_31bf3856ad364e35_10.0.26100.1_none_55dbe9afb3e346bc\mmrtext.ttf Handle ID: 0xc40 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-font-truetype-phagspa_31bf3856ad364e35_10.0.26100.1_none_6fc319ac621043a6\phagspa.ttf Handle ID: 0xd80 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-font-truetype-raavi_31bf3856ad364e35_10.0.26100.1_none_43d2f59231e50621\raavi.ttf Handle ID: 0x8f8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-f..ruetype-phagspabold_31bf3856ad364e35_10.0.26100.1_none_81ec9b030b97952d\phagspab.ttf Handle ID: 0x11ac Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-font-truetype-raavi_31bf3856ad364e35_10.0.26100.1_none_43d2f59231e50621\raavib.ttf Handle ID: 0x8c4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-f..ruetype-plantagenet_31bf3856ad364e35_10.0.26100.1_none_e823244c80c2068d\plantc.ttf Handle ID: 0x9e4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-font-truetype-taile_31bf3856ad364e35_10.0.26100.1_none_8852470c1822f8e5\taile.ttf Handle ID: 0x7b0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-f..-truetype-tailebold_31bf3856ad364e35_10.0.26100.1_none_a88cc4c19239fd7e\taileb.ttf Handle ID: 0xff4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-font-truetype-shruti_31bf3856ad364e35_10.0.26100.1_none_ca5b4ec6ba67ad53\shrutib.ttf Handle ID: 0xfc8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-font-truetype-shruti_31bf3856ad364e35_10.0.26100.1_none_ca5b4ec6ba67ad53\shruti.ttf Handle ID: 0xe10 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-font-truetype-tunga_31bf3856ad364e35_10.0.26100.1_none_85b95f3e19e4142b\tungab.ttf Handle ID: 0xd60 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-font-truetype-tunga_31bf3856ad364e35_10.0.26100.1_none_85b95f3e19e4142b\tunga.ttf Handle ID: 0x9e0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-font-truetype-vrinda_31bf3856ad364e35_10.0.26100.1_none_731815c8c1d008a6\vrinda.ttf Handle ID: 0x9d4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-font-truetype-vrinda_31bf3856ad364e35_10.0.26100.1_none_731815c8c1d008a6\vrindab.ttf Handle ID: 0xacc Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-font-truetype-nyala_31bf3856ad364e35_10.0.26100.1_none_b2cb11ae6aaa0b53\nyala.ttf Handle ID: 0xf94 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-wimconfig-winre_31bf3856ad364e35_10.0.26100.1_none_fdc46a3e280967aa\WimConfig.ini Handle ID: 0x12a0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-onexschema_31bf3856ad364e35_10.0.26100.1_none_5235d93aaee3a25c\OneX_v1.xsd Handle ID: 0x6bc Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-wlanschemas_31bf3856ad364e35_10.0.26100.1_none_aaf5c4dc24eff819\WLAN_profile_v3.xsd Handle ID: 0x704 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-wlanschemas_31bf3856ad364e35_10.0.26100.1_none_aaf5c4dc24eff819\WLAN_profile_v2.xsd Handle ID: 0xba4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-wlanschemas_31bf3856ad364e35_10.0.26100.1_none_aaf5c4dc24eff819\WFD_LEGACY_profile_v1.xsd Handle ID: 0x930 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-wlanschemas_31bf3856ad364e35_10.0.26100.1_none_aaf5c4dc24eff819\WLAN_profile_v4.xsd Handle ID: 0xefc Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-wlanschemas_31bf3856ad364e35_10.0.26100.1_none_aaf5c4dc24eff819\WLAN_profile_v5.xsd Handle ID: 0x6f8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-wlanschemas_31bf3856ad364e35_10.0.26100.1_none_aaf5c4dc24eff819\WFD_profile_v1.xsd Handle ID: 0x8fc Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-wlanschemas_31bf3856ad364e35_10.0.26100.1_none_aaf5c4dc24eff819\WLAN_policy_v1.xsd Handle ID: 0xf00 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-wlanschemas_31bf3856ad364e35_10.0.26100.1_none_aaf5c4dc24eff819\WLANAP_profile_v1.xsd Handle ID: 0x8ec Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-wlanschemas_31bf3856ad364e35_10.0.26100.1_none_aaf5c4dc24eff819\WLAN_profile_v1.xsd Handle ID: 0x7cc Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-wlansvc.resources_31bf3856ad364e35_10.0.26100.1_en-us_3ab9325afea77d36\Rules.System.Wireless.xml Handle ID: 0xc78 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-wlansvc.resources_31bf3856ad364e35_10.0.26100.1_en-us_3ab9325afea77d36\Report.System.Wireless.xml Handle ID: 0xc94 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-d..ryoptimization-admx_31bf3856ad364e35_10.0.26100.1_none_566bf28632855b3b\DeliveryOptimization.admx Handle ID: 0xb40 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-d..tion-admx.resources_31bf3856ad364e35_10.0.26100.1_en-us_1f810dfd0a3e00ba\DeliveryOptimization.adml Handle ID: 0xa28 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-onecoreuap-wlansvc_31bf3856ad364e35_10.0.26100.1_none_3fd362665ade9a4f\Report.System.Wireless.xml Handle ID: 0x73c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\Microsoft-OneCore-BITS-Client-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.1.mum Handle ID: 0xc5c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-onecoreuap-wlansvc_31bf3856ad364e35_10.0.26100.1_none_3fd362665ade9a4f\Rules.System.Wireless.xml Handle ID: 0xae4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\Microsoft-OneCore-BITS-Client-Package~31bf3856ad364e35~amd64~~10.0.26100.1.mum Handle ID: 0x90c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\Microsoft-OneCore-ConfigCI-Client-LockdownPolicies-Package~31bf3856ad364e35~amd64~~10.0.26100.1.mum Handle ID: 0x950 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\Microsoft-OneCore-Connectivity-HID-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.1.mum Handle ID: 0x1254 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\Microsoft-OneCore-Connectivity-HID-Package~31bf3856ad364e35~amd64~~10.0.26100.1.mum Handle ID: 0xa6c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\Microsoft-OneCore-DeliveryOptimization-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.1.mum Handle ID: 0xca4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\Microsoft-OneCore-DeliveryOptimization-Package~31bf3856ad364e35~amd64~~10.0.26100.1.mum Handle ID: 0x2b8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\Microsoft-OneCore-EnterpriseTempControls-1519381645-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.1.mum Handle ID: 0xfd8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\Microsoft-OneCore-EnterpriseTempControls-1519381645-Package~31bf3856ad364e35~amd64~~10.0.26100.1.mum Handle ID: 0x7f4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\Microsoft-OneCore-EnterpriseTempControls-2208259724-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.1.mum Handle ID: 0xcbc Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\Microsoft-OneCore-EnterpriseTempControls-2208259724-Package~31bf3856ad364e35~amd64~~10.0.26100.1.mum Handle ID: 0x754 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\Microsoft-OneCore-EnterpriseTempControls-ActiveConfig-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.1.mum Handle ID: 0x778 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\Microsoft-OneCore-EnterpriseTempControls-ActiveConfig-Package~31bf3856ad364e35~amd64~~10.0.26100.1.mum Handle ID: 0x10d4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\Microsoft-OneCore-EnterpriseTempControls-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.1.mum Handle ID: 0x7c0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\Microsoft-OneCore-EnterpriseTempControls-Package~31bf3856ad364e35~amd64~~10.0.26100.1.mum Handle ID: 0xab8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-OneCore-EnterpriseTempControls-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.1.cat Handle ID: 0xc84 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\Microsoft-OneCore-EnterpriseTempControls-Security-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.1.mum Handle ID: 0xba0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-OneCore-EnterpriseTempControls-Package~31bf3856ad364e35~amd64~~10.0.26100.1.cat Handle ID: 0xf28 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\Microsoft-OneCore-EnterpriseTempControls-Security-Package~31bf3856ad364e35~amd64~~10.0.26100.1.mum Handle ID: 0xc44 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\Microsoft-OneCore-Networking-MobileNetworking-Package~31bf3856ad364e35~amd64~~10.0.26100.1.mum Handle ID: 0x1070 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\Microsoft-OneCore-Update-UUS-Stable-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.1.mum Handle ID: 0xc0c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\Microsoft-OneCore-Update-UUS-Stable-Package~31bf3856ad364e35~amd64~~10.0.26100.1.mum Handle ID: 0xa30 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\Microsoft-OneCore-UpdateAgent-Core-merged-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.1.mum Handle ID: 0xf70 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\Microsoft-OneCore-UpdateAgent-Core-merged-Package~31bf3856ad364e35~amd64~~10.0.26100.1.mum Handle ID: 0x6c0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\Microsoft-OneCore-UpdateAgent-Core-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.1.mum Handle ID: 0xbd0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\Microsoft-OneCore-UpdateAgent-Core-Package~31bf3856ad364e35~amd64~~10.0.26100.1.mum Handle ID: 0xe10 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-OneCore-UpdateAgent-Core-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.1.cat Handle ID: 0xfc8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\Microsoft-OneCore-UpdateAgent-DriverUpdateSupport-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.1.mum Handle ID: 0xd60 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-OneCore-UpdateAgent-Core-Package~31bf3856ad364e35~amd64~~10.0.26100.1.cat Handle ID: 0x9d4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\Microsoft-OneCore-UpdateAgent-DriverUpdateSupport-Package~31bf3856ad364e35~amd64~~10.0.26100.1.mum Handle ID: 0xff4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\Microsoft-OneCore-UpdatePolicy-merged-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.1.mum Handle ID: 0x744 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\Microsoft-OneCore-UpdatePolicy-merged-Package~31bf3856ad364e35~amd64~~10.0.26100.1.mum Handle ID: 0xbc4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\Microsoft-OneCore-UpdatePolicy-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.1.mum Handle ID: 0x760 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\Microsoft-OneCore-UpdatePolicy-Package~31bf3856ad364e35~amd64~~10.0.26100.1.mum Handle ID: 0x12a0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-OneCore-UpdatePolicy-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.1.cat Handle ID: 0xc74 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-OneCore-UpdatePolicy-Package~31bf3856ad364e35~amd64~~10.0.26100.1.cat Handle ID: 0x115c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\Microsoft-OneCore-WUDependencies-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.1.mum Handle ID: 0xff0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\Microsoft-OneCore-WUDependencies-Package~31bf3856ad364e35~amd64~~10.0.26100.1.mum Handle ID: 0x868 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\Microsoft-Windows-CoreSystem-WFD-Package~31bf3856ad364e35~amd64~~10.0.26100.1.mum Handle ID: 0x104c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\Microsoft-Windows-ImageBasedSetup-Rejuvenation-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.1.mum Handle ID: 0x810 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\Microsoft-Windows-ImageBasedSetup-Rejuvenation-Package~31bf3856ad364e35~amd64~~10.0.26100.1.mum Handle ID: 0x930 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\Microsoft-Windows-OneCoreUAP-WCN-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.1.mum Handle ID: 0xafc Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\Microsoft-Windows-OneCoreUAP-WCN-Package~31bf3856ad364e35~amd64~~10.0.26100.1.mum Handle ID: 0xaa4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\Microsoft-Windows-OneCoreUAP-WCN-WOW64-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.1.mum Handle ID: 0xf94 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\Microsoft-Windows-OneCoreUAP-WCN-WOW64-Package~31bf3856ad364e35~amd64~~10.0.26100.1.mum Handle ID: 0x9e0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\Microsoft-Windows-WCN-merged-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.1.mum Handle ID: 0xf00 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\Microsoft-Windows-WCN-merged-Package~31bf3856ad364e35~amd64~~10.0.26100.1.mum Handle ID: 0x6f8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\Microsoft-Windows-WCN-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.1.mum Handle ID: 0xefc Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\Microsoft-Windows-WCN-Package~31bf3856ad364e35~amd64~~10.0.26100.1.mum Handle ID: 0x73c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\Microsoft-Windows-WCN-WOW64-merged-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.1.mum Handle ID: 0xa28 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-WCN-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.1.cat Handle ID: 0xb40 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-WCN-Package~31bf3856ad364e35~amd64~~10.0.26100.1.cat Handle ID: 0x704 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\Microsoft-Windows-WCN-WOW64-merged-Package~31bf3856ad364e35~amd64~~10.0.26100.1.mum Handle ID: 0x7b0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\Microsoft-Windows-WCN-WOW64-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.1.mum Handle ID: 0x9e4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\Microsoft-Windows-WCN-WOW64-Package~31bf3856ad364e35~amd64~~10.0.26100.1.mum Handle ID: 0x7fc Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\Microsoft-Windows-WinPE-AppxPackaging-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.1.mum Handle ID: 0x8f8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-WCN-WOW64-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.1.cat Handle ID: 0xd80 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-WCN-WOW64-Package~31bf3856ad364e35~amd64~~10.0.26100.1.cat Handle ID: 0xc94 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\Microsoft-Windows-WinPE-AppxPackaging-Package~31bf3856ad364e35~amd64~~10.0.26100.1.mum Handle ID: 0xc78 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\Microsoft-Windows-WinPE-Fonts-Legacy-Package~31bf3856ad364e35~amd64~~10.0.26100.1.mum Handle ID: 0xabc Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\Microsoft-Windows-WinPE-FontSupport-WinRE-Package~31bf3856ad364e35~amd64~~10.0.26100.1.mum Handle ID: 0x9bc Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\Microsoft-Windows-WinPE-OpcServices-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.1.mum Handle ID: 0x106c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\Microsoft-Windows-WinPE-OpcServices-Package~31bf3856ad364e35~amd64~~10.0.26100.1.mum Handle ID: 0xe70 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\WinPE-AppxDeployment-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.1.mum Handle ID: 0xc30 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\WinPE-AppxDeployment-Package~31bf3856ad364e35~amd64~~10.0.26100.1.mum Handle ID: 0xbd8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\WinPE-AppxPackaging-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.1.mum Handle ID: 0x1164 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\WinPE-AppxPackaging-Package~31bf3856ad364e35~amd64~~10.0.26100.1.mum Handle ID: 0xcf8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\WinPE-AppxPackaging-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.1.cat Handle ID: 0x11b8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\WinPE-AppxPackaging-Package~31bf3856ad364e35~amd64~~10.0.26100.1.cat Handle ID: 0xe2c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\WinPE-CILockdownPolicies-Package~31bf3856ad364e35~amd64~~10.0.26100.1.mum Handle ID: 0xb58 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\WinPE-Connectivity-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.1.mum Handle ID: 0x117c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\WinPE-CILockdownPolicies-Package~31bf3856ad364e35~amd64~~10.0.26100.1.cat Handle ID: 0x1194 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\WinPE-Connectivity-Package~31bf3856ad364e35~amd64~~10.0.26100.1.mum Handle ID: 0x1104 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\WinPE-Connectivity-Package~31bf3856ad364e35~amd64~~10.0.26100.1.cat Handle ID: 0x614 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\WinPE-Connectivity-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.1.cat Handle ID: 0x1124 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\WinPE-FMAPI-Package~31bf3856ad364e35~amd64~~10.0.26100.1.mum Handle ID: 0x1230 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\WinPE-HTA-Package-com~31bf3856ad364e35~amd64~en-US~10.0.26100.1.mum Handle ID: 0x850 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\WinPE-HTA-Package-com~31bf3856ad364e35~amd64~~10.0.26100.1.mum Handle ID: 0x9f0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\WinPE-HTA-Package-inetcore~31bf3856ad364e35~amd64~en-US~10.0.26100.1.mum Handle ID: 0x888 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\WinPE-HTA-Package-inetcore~31bf3856ad364e35~amd64~~10.0.26100.1.mum Handle ID: 0x6e4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\WinPE-HTA-Package-onecoreuapwindows~31bf3856ad364e35~amd64~en-US~10.0.26100.1.mum Handle ID: 0x75c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\WinPE-HTA-Package-onecoreuapwindows~31bf3856ad364e35~amd64~~10.0.26100.1.mum Handle ID: 0xb68 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\WinPE-HTA-Package-onecoreuap~31bf3856ad364e35~amd64~en-US~10.0.26100.1.mum Handle ID: 0xb1c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\WinPE-HTA-Package-onecoreuap~31bf3856ad364e35~amd64~~10.0.26100.1.mum Handle ID: 0x978 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\WinPE-HTA-Package-onecore~31bf3856ad364e35~amd64~en-US~10.0.26100.1.mum Handle ID: 0x1018 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\WinPE-HTA-Package-onecore~31bf3856ad364e35~amd64~~10.0.26100.1.mum Handle ID: 0xa80 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\WinPE-HTA-Package-shell~31bf3856ad364e35~amd64~en-US~10.0.26100.1.mum Handle ID: 0x7dc Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\WinPE-HTA-Package-shell~31bf3856ad364e35~amd64~~10.0.26100.1.mum Handle ID: 0xc18 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\WinPE-HTA-Package-windows~31bf3856ad364e35~amd64~en-US~10.0.26100.1.mum Handle ID: 0xa6c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\WinPE-HTA-Package-windows~31bf3856ad364e35~amd64~~10.0.26100.1.mum Handle ID: 0xa44 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\WinPE-HTA-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.1.mum Handle ID: 0x798 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\WinPE-HTA-Package~31bf3856ad364e35~amd64~~10.0.26100.1.mum Handle ID: 0xbbc Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\WinPE-OneCoreUAP-WiFi-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.1.mum Handle ID: 0xf1c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\WinPE-OneCoreUAP-WiFi-Package~31bf3856ad364e35~amd64~~10.0.26100.1.mum Handle ID: 0x1254 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\WinPE-OpcServices-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.1.mum Handle ID: 0x11a8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\WinPE-OpcServices-Package~31bf3856ad364e35~amd64~~10.0.26100.1.mum Handle ID: 0x950 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\WinPE-OpcServices-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.1.cat Handle ID: 0xca4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\WinPE-OpcServices-Package~31bf3856ad364e35~amd64~~10.0.26100.1.cat Handle ID: 0xab4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\WinPE-Rejuv-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.1.mum Handle ID: 0xfec Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\WinPE-Rejuv-Package~31bf3856ad364e35~amd64~~10.0.26100.1.mum Handle ID: 0xae8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\WinPE-Rejuv-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.1.cat Handle ID: 0xb04 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\WinPE-Rejuv-Package~31bf3856ad364e35~amd64~~10.0.26100.1.cat Handle ID: 0x1014 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\WinPE-StorageWMI-Package-onecore~31bf3856ad364e35~amd64~en-US~10.0.26100.1.mum Handle ID: 0xeac Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\WinPE-StorageWMI-Package-onecore~31bf3856ad364e35~amd64~~10.0.26100.1.mum Handle ID: 0xda8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\WinPE-StorageWMI-Package-servercommon~31bf3856ad364e35~amd64~en-US~10.0.26100.1.mum Handle ID: 0x11d8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\WinPE-StorageWMI-Package-servercommon~31bf3856ad364e35~amd64~~10.0.26100.1.mum Handle ID: 0xe40 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\WinPE-StorageWMI-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.1.mum Handle ID: 0xc20 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\WinPE-StorageWMI-Package~31bf3856ad364e35~amd64~~10.0.26100.1.mum Handle ID: 0x10f8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\WinPE-StorageWMI-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.1.cat Handle ID: 0xf44 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\WinPE-StorageWMI-Package~31bf3856ad364e35~amd64~~10.0.26100.1.cat Handle ID: 0x94c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\WinPE-WiFi-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.1.mum Handle ID: 0xa54 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\WinPE-WiFi-Package~31bf3856ad364e35~amd64~~10.0.26100.1.mum Handle ID: 0x11a4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\WinPE-WindowsUpdate-merged-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.1.mum Handle ID: 0x910 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\WinPE-WindowsUpdate-merged-Package~31bf3856ad364e35~amd64~~10.0.26100.1.mum Handle ID: 0x750 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\WinPE-WindowsUpdate-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.1.mum Handle ID: 0x9c4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\WinPE-WindowsUpdate-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.1.cat Handle ID: 0xfd8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\WinPE-WindowsUpdate-Package~31bf3856ad364e35~amd64~~10.0.26100.1.mum Handle ID: 0xe50 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\WinPE-WindowsUpdate-Package~31bf3856ad364e35~amd64~~10.0.26100.1.cat Handle ID: 0x11e4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-f..-truetype-nirmalaui_31bf3856ad364e35_10.0.26100.1_none_028f0f0bd882852c\Nirmala.ttc Handle ID: 0x778 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-a..oyment-server-winpe_31bf3856ad364e35_10.0.26100.1_none_7d538f74632983f0\AppXApplicabilityBlob.dll Handle ID: 0x123c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..dsetup-rejuvenation_31bf3856ad364e35_10.0.26100.1_none_4f8cc7ff7948385b\AppExtAgent.dll Handle ID: 0x90c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-bits-perf_31bf3856ad364e35_10.0.26100.1_none_301843eb6936b44d\bitsperf.dll Handle ID: 0x10d4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-bits-client-proxy_31bf3856ad364e35_10.0.26100.1_none_63bd44d81f4236cc\BitsProxy.dll Handle ID: 0x118c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-appx-deployment-client_31bf3856ad364e35_10.0.26100.1_none_b2d577cd42e30a68\AppXDeploymentClient.dll Handle ID: 0x920 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..dsetup-rejuvenation_31bf3856ad364e35_10.0.26100.1_none_4f8cc7ff7948385b\cmi2migxml.dll Handle ID: 0x7f0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..dsetup-rejuvenation_31bf3856ad364e35_10.0.26100.1_none_4f8cc7ff7948385b\csiagent.dll Handle ID: 0x8ac Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-c..ent-appxpackagingom_31bf3856ad364e35_10.0.26100.1_none_16a1ef046378c3ab\AppxPackaging.dll Handle ID: 0x818 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-directx-direct3d10_31bf3856ad364e35_10.0.26100.1_none_ecac0dff36389846\d3d10core.dll Handle ID: 0x788 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-directx-direct3d10.1_31bf3856ad364e35_10.0.26100.1_none_4d1d25c6121eb17f\d3d10_1core.dll Handle ID: 0xd00 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-directx-direct3d10.1_31bf3856ad364e35_10.0.26100.1_none_4d1d25c6121eb17f\d3d10_1.dll Handle ID: 0x74c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-directx-direct3d12_31bf3856ad364e35_10.0.26100.1_none_ecabe06f3638cb88\D3D12.dll Handle ID: 0x928 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-directx-direct3d9_31bf3856ad364e35_10.0.26100.1_none_bf411505c952d07e\d3d8thk.dll Handle ID: 0x86c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-directx-d3d10level9_31bf3856ad364e35_10.0.26100.1_none_e0521513081f3126\d3d10level9.dll Handle ID: 0xf58 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-directx-direct3d11on12_31bf3856ad364e35_10.0.26100.1_none_f8cb42cfb0051489\d3d11on12.dll Handle ID: 0x1030 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-wcn-config-registrar_31bf3856ad364e35_10.0.26100.1_none_2a105c312a76612a\dafWCN.dll Handle ID: 0xb84 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-directx-direct3d10_31bf3856ad364e35_10.0.26100.1_none_ecac0dff36389846\d3d10.dll Handle ID: 0xc44 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-dafwfdprovider_31bf3856ad364e35_10.0.26100.1_none_f75b5f34298a3d8a\dafWfdProvider.dll Handle ID: 0xf28 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-storagemanagementwmi_31bf3856ad364e35_10.0.26100.1_none_4ddfac11b31e2664\delegatorprovider.dll Handle ID: 0xba0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-d..einstallationclient_31bf3856ad364e35_10.0.26100.1_none_5333c10e105b7a45\DeviceSoftwareInstallationClient.dll Handle ID: 0xad8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-d..ryoptimization-mgmt_31bf3856ad364e35_10.0.26100.1_none_57bb758831af3700\domgmt.dll Handle ID: 0x1070 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-deliveryoptimization_31bf3856ad364e35_10.0.26100.1_none_c74dc9882f91889c\dosvc.dll Handle ID: 0xc40 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-directx-direct3d9_31bf3856ad364e35_10.0.26100.1_none_bf411505c952d07e\d3d9.dll Handle ID: 0x8d8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-onecore-directx-dxcore_31bf3856ad364e35_10.0.26100.1_none_b0bc4677691423f6\DXCore.dll Handle ID: 0x6c0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-d..txvideoacceleration_31bf3856ad364e35_10.0.26100.1_none_68c85aeeaabf8a9d\dxva2.dll Handle ID: 0xf70 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-directx-direct3d11_31bf3856ad364e35_10.0.26100.1_none_ecabf7373638b1e7\d3d11.dll Handle ID: 0xc04 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-directx-direct3d12_31bf3856ad364e35_10.0.26100.1_none_ecabe06f3638cb88\D3D12Core.dll Handle ID: 0xa30 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-wcn-config-registrar_31bf3856ad364e35_10.0.26100.1_none_2a105c312a76612a\fdWCN.dll Handle ID: 0xc0c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-fmapi_31bf3856ad364e35_10.0.26100.1_none_4fffbe599cc5c616\fmapi.dll Handle ID: 0xc84 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-directx-dxgi_31bf3856ad364e35_10.0.26100.1_none_377220b38719544d\dxgi.dll Handle ID: 0x858 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-deliveryoptimization_31bf3856ad364e35_10.0.26100.1_none_c74dc9882f91889c\doclient.dll Handle ID: 0xbd0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..dsetup-rejuvenation_31bf3856ad364e35_10.0.26100.5059_none_ee8a7a91c09e45ad\icbexclusion.inf Handle ID: 0xdac Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-ie-htmlrendering_31bf3856ad364e35_11.0.26100.1_none_442835d4f58ff378\EdgeManager.dll Handle ID: 0xff4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-ieframe_31bf3856ad364e35_11.0.26100.1_none_95878fd8818581a5\iemigplugin.dll Handle ID: 0xd60 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-a..oyment-server-winpe_31bf3856ad364e35_10.0.26100.1_none_7d538f74632983f0\AppXDeploymentServer.dll Handle ID: 0xfc8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-ieframe_31bf3856ad364e35_11.0.26100.1_none_95878fd8818581a5\IESettingSync.exe Handle ID: 0x9d4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-ie-imagesupport_31bf3856ad364e35_11.0.26100.1_none_6ed9ec0cc674f409\imgutil.dll Handle ID: 0xbc4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-directwrite-fontcache_31bf3856ad364e35_10.0.26100.1_none_019db6ac79dbcfa1\FntCache.dll Handle ID: 0xac0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-mail-comm-dll_31bf3856ad364e35_10.0.26100.1_none_76a4d2cac1193eee\INETRES.dll Handle ID: 0x7ac Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..tmlrendering-legacy_31bf3856ad364e35_11.0.26100.1_none_4317374585bcbe0e\IndexedDbLegacy.dll Handle ID: 0xfd0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..i_initiator_service_31bf3856ad364e35_10.0.26100.1_none_d767539e7da48aca\iscsicli.exe Handle ID: 0xfc0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..i_initiator_service_31bf3856ad364e35_10.0.26100.1_none_d767539e7da48aca\iscsied.dll Handle ID: 0x10c8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..i_initiator_service_31bf3856ad364e35_10.0.26100.1_none_d767539e7da48aca\iscsium.dll Handle ID: 0xb44 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..i_initiator_service_31bf3856ad364e35_10.0.26100.1_none_d767539e7da48aca\iscsidsc.dll Handle ID: 0x107c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..i_initiator_service_31bf3856ad364e35_10.0.26100.1_none_d767539e7da48aca\iscsiwmi.dll Handle ID: 0x12a0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..i_initiator_service_31bf3856ad364e35_10.0.26100.1_none_d767539e7da48aca\iscsiexe.dll Handle ID: 0x968 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..i_initiator_service_31bf3856ad364e35_10.0.26100.1_none_d767539e7da48aca\iscsiwmiv2.dll Handle ID: 0x760 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-directx-d3dcompiler_31bf3856ad364e35_10.0.26100.1_none_e645c2b4849d0349\D3DCompiler_47.dll Handle ID: 0x11b4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-l2na_31bf3856ad364e35_10.0.26100.1_none_a7b789218299932e\l2nacp.dll Handle ID: 0xe88 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-mail-comm-dll_31bf3856ad364e35_10.0.26100.1_none_76a4d2cac1193eee\inetcomm.dll Handle ID: 0xd58 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-s..ementwmi-powershell_31bf3856ad364e35_10.0.26100.1_none_e63d982ff040a6e0\Microsoft.Windows.Storage.Core.dll Handle ID: 0x1264 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-s..ementwmi-powershell_31bf3856ad364e35_10.0.26100.1_none_e63d982ff040a6e0\Microsoft.Windows.Storage.StorageBusCache.dll Handle ID: 0x744 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-directx-warp10_31bf3856ad364e35_10.0.26100.1_none_e7574c44bf38f906\d3d10warp.dll Handle ID: 0x868 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..dsetup-rejuvenation_31bf3856ad364e35_10.0.26100.1_none_4f8cc7ff7948385b\migres.dll Handle ID: 0x1054 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..dsetup-rejuvenation_31bf3856ad364e35_10.0.26100.1_none_4f8cc7ff7948385b\migisol.dll Handle ID: 0x104c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..dsetup-rejuvenation_31bf3856ad364e35_10.0.26100.1_none_4f8cc7ff7948385b\mighost.exe Handle ID: 0x6bc Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..dsetup-rejuvenation_31bf3856ad364e35_10.0.26100.5059_none_ee8a7a91c09e45ad\migapp.xml Handle ID: 0x810 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-onecore-n..bilenetworking-core_31bf3856ad364e35_10.0.26100.1_none_32f4cc6f1e18d8c0\mobilenetworking.dll Handle ID: 0xaf0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-ie-htmlapplication_31bf3856ad364e35_11.0.26100.1_none_8a3f1279dcc4073c\mshta.exe Handle ID: 0x930 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-mlang_31bf3856ad364e35_10.0.26100.1_none_53d2f3d94c8ae8c4\mlang.dll Handle ID: 0xff0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..dsetup-rejuvenation_31bf3856ad364e35_10.0.26100.1_none_4f8cc7ff7948385b\migsys.dll Handle ID: 0x115c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-mlang_31bf3856ad364e35_10.0.26100.1_none_53d2f3d94c8ae8c4\mlang.dat Handle ID: 0xc74 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-t..cesframework-msimtf_31bf3856ad364e35_10.0.26100.1_none_ce792cbd5328ebb7\msimtf.dll Handle ID: 0x764 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-ie-htmlediting_31bf3856ad364e35_11.0.26100.1_none_790e0ca016cb3d50\mshtmled.dll Handle ID: 0xbe8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-ie-ratings_31bf3856ad364e35_11.0.26100.1_none_f877618d3021b323\msrating.dll Handle ID: 0xfe0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-mail-comm-dll_31bf3856ad364e35_10.0.26100.1_none_76a4d2cac1193eee\msoert2.dll Handle ID: 0x1290 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..dsetup-rejuvenation_31bf3856ad364e35_10.0.26100.1_none_4f8cc7ff7948385b\migstore.dll Handle ID: 0xeec Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..dsetup-rejuvenation_31bf3856ad364e35_10.0.26100.1_none_4f8cc7ff7948385b\MXEAgent.dll Handle ID: 0xf34 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-com-oleui_31bf3856ad364e35_10.0.26100.1_none_1d67a260164e141b\oledlg.dll Handle ID: 0x9e0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-onex_31bf3856ad364e35_10.0.26100.1_none_a2bec44d85e83ad7\onex.dll Handle ID: 0xedc Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..dsetup-rejuvenation_31bf3856ad364e35_10.0.26100.5059_none_ee8a7a91c09e45ad\osfilter.inf Handle ID: 0x62c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..ablenetworkgraphics_31bf3856ad364e35_11.0.26100.1_none_1eab9261e6cfec4b\pngfilt.dll Handle ID: 0xd28 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-onecore-u..m-productenumerator_31bf3856ad364e35_10.0.26100.1_none_0329333a655d5a47\ProductEnumerator.dll Handle ID: 0xe90 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..dsetup-rejuvenation_31bf3856ad364e35_10.0.26100.5059_none_ee8a7a91c09e45ad\oscomps.xml Handle ID: 0x8ec Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..dsetup-rejuvenation_31bf3856ad364e35_10.0.26100.1_none_4f8cc7ff7948385b\ReserveManager.dll Handle ID: 0x10b0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..dsetup-rejuvenation_31bf3856ad364e35_10.0.26100.5059_none_ee8a7a91c09e45ad\setupplatform.cfg Handle ID: 0xa2c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..dsetup-rejuvenation_31bf3856ad364e35_10.0.26100.5059_none_ee8a7a91c09e45ad\SFCN.dat Handle ID: 0xefc Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..dsetup-rejuvenation_31bf3856ad364e35_10.0.26100.5059_none_ee8a7a91c09e45ad\SFLCID.dat Handle ID: 0x6f8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-ie-htmlrendering_31bf3856ad364e35_11.0.26100.1_none_442835d4f58ff378\mshtml.tlb Handle ID: 0xf00 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-bits-client-core_31bf3856ad364e35_10.0.26100.1_none_23388537f363783d\qmgr.dll Handle ID: 0xacc Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-component-opcom_31bf3856ad364e35_10.0.26100.1_none_a02aaa341b1d9d2d\OpcServices.dll Handle ID: 0x73c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-ieframe_31bf3856ad364e35_11.0.26100.1_none_95878fd8818581a5\ieframe.dll Handle ID: 0xc5c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..dsetup-rejuvenation_31bf3856ad364e35_10.0.26100.5059_none_ee8a7a91c09e45ad\SFLISTW7.dat Handle ID: 0xbec Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..dsetup-rejuvenation_31bf3856ad364e35_10.0.26100.5059_none_ee8a7a91c09e45ad\SFPAT.inf Handle ID: 0xb40 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..dsetup-rejuvenation_31bf3856ad364e35_10.0.26100.5059_none_ee8a7a91c09e45ad\SFPATRS1.inf Handle ID: 0x704 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..dsetup-rejuvenation_31bf3856ad364e35_10.0.26100.5059_none_ee8a7a91c09e45ad\SFPATW7.inf Handle ID: 0x7b0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..dsetup-rejuvenation_31bf3856ad364e35_10.0.26100.5059_none_ee8a7a91c09e45ad\SFPATW8.inf Handle ID: 0x9e4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..dsetup-rejuvenation_31bf3856ad364e35_10.0.26100.5059_none_ee8a7a91c09e45ad\SFPATWB.inf Handle ID: 0x8c4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..dsetup-rejuvenation_31bf3856ad364e35_10.0.26100.5059_none_ee8a7a91c09e45ad\SFPATWT.inf Handle ID: 0x7fc Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..dsetup-rejuvenation_31bf3856ad364e35_10.0.26100.5059_none_ee8a7a91c09e45ad\SFLISTW8.dat Handle ID: 0xf94 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-storagemanagementwmi_31bf3856ad364e35_10.0.26100.1_none_4ddfac11b31e2664\storagewmi_passthru.dll Handle ID: 0xaa4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..dsetup-rejuvenation_31bf3856ad364e35_10.0.26100.5059_none_ee8a7a91c09e45ad\uninstall.xml Handle ID: 0xafc Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..dsetup-rejuvenation_31bf3856ad364e35_10.0.26100.5059_none_ee8a7a91c09e45ad\uninstall_data.xml Handle ID: 0x820 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..dsetup-rejuvenation_31bf3856ad364e35_10.0.26100.5059_none_ee8a7a91c09e45ad\SFLISTWB.dat Handle ID: 0xae4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-updatepolicy_31bf3856ad364e35_10.0.26100.1_none_597d234dfbcf4cd0\updatepolicy.dll Handle ID: 0xc78 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..dsetup-rejuvenation_31bf3856ad364e35_10.0.26100.5059_none_ee8a7a91c09e45ad\SFLISTRS1.dat Handle ID: 0xc94 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..dsetup-rejuvenation_31bf3856ad364e35_10.0.26100.5059_none_ee8a7a91c09e45ad\upgradeagent.xml Handle ID: 0xd80 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..dsetup-rejuvenation_31bf3856ad364e35_10.0.26100.1_none_4f8cc7ff7948385b\upgrade_bulk.xml Handle ID: 0x8f8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..dsetup-rejuvenation_31bf3856ad364e35_10.0.26100.5059_none_ee8a7a91c09e45ad\upgrade_comp.xml Handle ID: 0x11ac Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..dsetup-rejuvenation_31bf3856ad364e35_10.0.26100.5059_none_ee8a7a91c09e45ad\upgrade_data.xml Handle ID: 0x9bc Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..dsetup-rejuvenation_31bf3856ad364e35_10.0.26100.5059_none_ee8a7a91c09e45ad\upgWow_bulk.xml Handle ID: 0xd6c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-c..cn-config-registrar_31bf3856ad364e35_10.0.26100.1_none_24114ce7feb5a83d\WcnApi.dll Handle ID: 0xcf0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-storagemanagementwmi_31bf3856ad364e35_10.0.26100.1_none_4ddfac11b31e2664\storagewmi.dll Handle ID: 0x998 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-c..cn-config-registrar_31bf3856ad364e35_10.0.26100.1_none_24114ce7feb5a83d\WcnEapAuthProxy.dll Handle ID: 0xe70 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-c..cn-config-registrar_31bf3856ad364e35_10.0.26100.1_none_24114ce7feb5a83d\WcnEapPeerProxy.dll Handle ID: 0x106c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-c..cn-config-registrar_31bf3856ad364e35_10.0.26100.1_none_24114ce7feb5a83d\wcncsvc.dll Handle ID: 0x9e8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-wcn-netsh-helper_31bf3856ad364e35_10.0.26100.1_none_df0da9045becf6b5\WcnNetsh.dll Handle ID: 0xabc Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..dsetup-rejuvenation_31bf3856ad364e35_10.0.26100.5059_none_ee8a7a91c09e45ad\SFLISTWT.dat Handle ID: 0x8fc Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-w..ig-registrar-wizard_31bf3856ad364e35_10.0.26100.1_none_3a26605d67eeb910\wcnwiz.dll Handle ID: 0x7cc Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-onecoreuap-wlansvc_31bf3856ad364e35_10.0.26100.1_none_3fd362665ade9a4f\wfdprov.dll Handle ID: 0xa28 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-onecoreuap-wlansvc_31bf3856ad364e35_10.0.26100.1_none_3fd362665ade9a4f\WiFiConfigSP.dll Handle ID: 0xb60 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..dsetup-rejuvenation_31bf3856ad364e35_10.0.26100.1_none_4f8cc7ff7948385b\migcore.dll Handle ID: 0xbd8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-wifidisplay_31bf3856ad364e35_10.0.26100.1_none_eecf051b49914482\WiFiDisplay.dll Handle ID: 0xcf8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..dsetup-rejuvenation_31bf3856ad364e35_10.0.26100.1_none_4f8cc7ff7948385b\upgradeagent.dll Handle ID: 0x1164 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-onecore-u..latform-updateagent_31bf3856ad364e35_10.0.26100.1_none_10f04bf171fff950\UpdateAgent.dll Handle ID: 0x900 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-webapi_31bf3856ad364e35_10.0.26100.1_none_0a181be6a11ee893\Windows.Web.dll Handle ID: 0xe2c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-ie-htmlrendering_31bf3856ad364e35_11.0.26100.1_none_442835d4f58ff378\webplatstorageserver.dll Handle ID: 0x10b8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-wlan-extension_31bf3856ad364e35_10.0.26100.1_none_f6d6d78e8be62381\wlanext.exe Handle ID: 0xcb0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-onecoreuap-wlansvc_31bf3856ad364e35_10.0.26100.1_none_3fd362665ade9a4f\wlanhlp.dll Handle ID: 0xb58 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-wlan-dialog_31bf3856ad364e35_10.0.26100.1_none_0ca21d765631869a\wlandlg.dll Handle ID: 0x948 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-wlan-netsh-helper_31bf3856ad364e35_10.0.26100.1_none_11919092ccd12e03\wlancfg.dll Handle ID: 0x1104 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-onecoreuap-wlansvc_31bf3856ad364e35_10.0.26100.1_none_3fd362665ade9a4f\wlansvcpal.dll Handle ID: 0x8dc Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-onecoreuap-wlansvc_31bf3856ad364e35_10.0.26100.1_none_3fd362665ade9a4f\wlanapi.dll Handle ID: 0x614 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-onecoreuap-wlansvc_31bf3856ad364e35_10.0.26100.1_none_3fd362665ade9a4f\wlanmsm.dll Handle ID: 0xf68 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-w..wsupdateclient-core_31bf3856ad364e35_10.0.26100.1_none_abd60549122613b6\wuauclt.exe Handle ID: 0x1124 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-wlanui_31bf3856ad364e35_10.0.26100.1_none_697fc8a7555ff455\wlanui.dll Handle ID: 0x850 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-w..owsupdateclient-aux_31bf3856ad364e35_10.0.26100.1_none_91e73f9525e66cb9\wuapi.dll Handle ID: 0x9f0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-w..owsupdateclient-aux_31bf3856ad364e35_10.0.26100.1_none_91e73f9525e66cb9\wups.dll Handle ID: 0x718 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-w..wsupdateclient-core_31bf3856ad364e35_10.0.26100.1_none_abd60549122613b6\wuaueng.dll Handle ID: 0x11b0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-wlanpref_31bf3856ad364e35_10.0.26100.1_none_36814a89778e6d84\wlanpref.dll Handle ID: 0x1178 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-onecoreuap-wlansvc_31bf3856ad364e35_10.0.26100.1_none_3fd362665ade9a4f\wlansec.dll Handle ID: 0x748 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-w..wsupdateclient-core_31bf3856ad364e35_10.0.26100.1_none_abd60549122613b6\wups2.dll Handle ID: 0x78c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-w..owsupdateclient-aux_31bf3856ad364e35_10.0.26100.1_none_91e73f9525e66cb9\wusys.dll Handle ID: 0x888 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-c..-nightswatchdesktop_31bf3856ad364e35_10.0.26100.1_none_c1500c34289abbfa\{0939ED82-BFD5-4D32-B58E-D31D3C49715A}.cip Handle ID: 0xcc4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-c..-nightswatchdesktop_31bf3856ad364e35_10.0.26100.1_none_c1500c34289abbfa\{1678656C-05EF-481F-BC5B-EBD8C991502D}.cip Handle ID: 0xebc Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-c..-nightswatchdesktop_31bf3856ad364e35_10.0.26100.1_none_c1500c34289abbfa\{0283AC0F-FFF1-49AE-ADA1-8A933130CAD6}.cip Handle ID: 0xba8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-c..-nightswatchdesktop_31bf3856ad364e35_10.0.26100.1_none_c1500c34289abbfa\{1939ED82-BFD5-4D32-B58E-D31D3C49715A}.cip Handle ID: 0x75c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-c..-nightswatchdesktop_31bf3856ad364e35_10.0.26100.1_none_c1500c34289abbfa\{2678656C-05EF-481F-BC5B-EBD8C991502D}.cip Handle ID: 0xb68 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-c..-nightswatchdesktop_31bf3856ad364e35_10.0.26100.1_none_c1500c34289abbfa\{1283AC0F-FFF1-49AE-ADA1-8A933130CAD6}.cip Handle ID: 0x6e4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-onecoreuap-wlansvc_31bf3856ad364e35_10.0.26100.1_none_3fd362665ade9a4f\wlansvc.dll Handle ID: 0xb1c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-mshidumdf_31bf3856ad364e35_10.0.26100.1_none_3d6f08ecd9b644bc\mshidumdf.sys Handle ID: 0xa68 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-native-80211_31bf3856ad364e35_10.0.26100.1_none_4bfc5170f77f20c5\nwifi.sys Handle ID: 0x9a8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-vwifi_31bf3856ad364e35_10.0.26100.1_none_5c8856832c1199be\vwififlt.sys Handle ID: 0x1108 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-mshidumdf.resources_31bf3856ad364e35_10.0.26100.1_en-us_43bc60d6756ebcdb\mshidumdf.sys.mui Handle ID: 0x10e8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-nwifi.resources_31bf3856ad364e35_10.0.26100.1_en-us_0f099f116b54a4d7\nwifi.sys.mui Handle ID: 0x122c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_netnwifi.inf.resources_31bf3856ad364e35_10.0.26100.1_en-us_4000bcf2c99c2ea2\netnwifi.inf_loc Handle ID: 0xfa4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-wifi-classextension_31bf3856ad364e35_10.0.26100.1_none_dd9214b808ec664a\WifiCx.sys Handle ID: 0xdec Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-native-80211_31bf3856ad364e35_10.0.26100.1_none_4bfc5170f77f20c5\WdiWiFi.sys Handle ID: 0xf84 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-a..nt-client.resources_31bf3856ad364e35_10.0.26100.1_en-us_cafeb035275416b7\AppXDeploymentClient.dll.mui Handle ID: 0x8e4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-c..ckagingom.resources_31bf3856ad364e35_10.0.26100.1_en-us_cfaa869ea73401aa\AppxPackaging.dll.mui Handle ID: 0x9dc Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-a..ver-winpe.resources_31bf3856ad364e35_10.0.26100.1_en-us_5a961c81b2edcb0d\AppXDeploymentServer.dll.mui Handle ID: 0xfdc Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-d..tion-mgmt.resources_31bf3856ad364e35_10.0.26100.1_en-us_df6896f1db4a8e5f\domgmt.dll.mui Handle ID: 0xdcc Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-d..imization.resources_31bf3856ad364e35_10.0.26100.1_en-us_895dd2e09a6e1b81\dosvc.dll.mui Handle ID: 0xe1c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-d..fontcache.resources_31bf3856ad364e35_10.0.26100.1_en-us_cdd15d43f9c7e404\FntCache.dll.mui Handle ID: 0xa6c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-m..-comm-dll.resources_31bf3856ad364e35_10.0.26100.1_en-us_baa392c78a97ca1d\inetres.dll.mui Handle ID: 0xa58 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..r_service.resources_31bf3856ad364e35_10.0.26100.1_en-us_afa92a9b1448fc05\iscsicli.exe.mui Handle ID: 0x6c4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..r_service.resources_31bf3856ad364e35_10.0.26100.1_en-us_afa92a9b1448fc05\iscsidsc.dll.mui Handle ID: 0x98c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..r_service.resources_31bf3856ad364e35_10.0.26100.1_en-us_afa92a9b1448fc05\iscsiexe.dll.mui Handle ID: 0x77c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-l2na.resources_31bf3856ad364e35_10.0.26100.1_en-us_a33eba1b40ce2273\l2nacp.dll.mui Handle ID: 0xd34 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..uvenation.resources_31bf3856ad364e35_10.0.26100.1_en-us_40d47957b5a0a4be\migres.dll.mui Handle ID: 0x694 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..plication.resources_31bf3856ad364e35_11.0.26100.1_en-us_86428ff2e2f34939\mshta.exe.mui Handle ID: 0xa5c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..rendering.resources_31bf3856ad364e35_11.0.26100.1_en-us_3dcd8ebfd6d39e51\edgehtml.dll.mui Handle ID: 0x790 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-t..rk-msimtf.resources_31bf3856ad364e35_10.0.26100.1_en-us_e1f1befcc7cdf898\msimtf.dll.mui Handle ID: 0xab0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-m..-comm-dll.resources_31bf3856ad364e35_10.0.26100.1_en-us_baa392c78a97ca1d\msoert2.dll.mui Handle ID: 0xbbc Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-com-oleui.resources_31bf3856ad364e35_10.0.26100.1_en-us_c5031252488a2384\oledlg.dll.mui Handle ID: 0xc38 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..ng-legacy.resources_31bf3856ad364e35_11.0.26100.1_en-us_1cfb543095dbe96d\mshtml.dll.mui Handle ID: 0x798 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-onex.resources_31bf3856ad364e35_10.0.26100.1_en-us_59b59001aa01a254\onex.dll.mui Handle ID: 0xcc8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-bits-client.resources_31bf3856ad364e35_10.0.26100.1_en-us_8f1f460fd3105196\qmgr.dll.mui Handle ID: 0x6b0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-updatepolicy.resources_31bf3856ad364e35_10.0.26100.1_en-us_f49f420cee4f7243\UpdatePolicy.dll.mui Handle ID: 0x1254 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\wow64_microsoft-windows-c..registrar.resources_31bf3856ad364e35_10.0.26100.1_en-us_eaedbef0fce55e55\wcncsvc.dll.mui Handle ID: 0xf1c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-w..sh-helper.resources_31bf3856ad364e35_10.0.26100.1_en-us_ea9016d7b1eee1c4\WcnNetsh.dll.mui Handle ID: 0x70c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-ieframe.resources_31bf3856ad364e35_11.0.26100.1_en-us_c0ab6b69a114cf44\ieframe.dll.mui Handle ID: 0xca4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\wow64_microsoft-windows-w..ar-wizard.resources_31bf3856ad364e35_10.0.26100.1_en-us_eb4ead494e43dee6\wcnwiz.dll.mui Handle ID: 0xbc0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-wifidisplay.resources_31bf3856ad364e35_10.0.26100.1_en-us_0e006fb6e8113a85\WiFiDisplay.dll.mui Handle ID: 0xdd0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-wlansvc.resources_31bf3856ad364e35_10.0.26100.1_en-us_3ab9325afea77d36\wlanapi.dll.mui Handle ID: 0x71c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-wlan-dialog.resources_31bf3856ad364e35_10.0.26100.1_en-us_7fec080ac89d62f7\wlandlg.dll.mui Handle ID: 0xe18 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-w..extension.resources_31bf3856ad364e35_10.0.26100.1_en-us_3b6819fbe8bdbb5c\wlanext.exe.mui Handle ID: 0x8a8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-webapi.resources_31bf3856ad364e35_10.0.26100.1_en-us_5d6966155f9569ca\Windows.Web.dll.mui Handle ID: 0xb0c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-wlanpref.resources_31bf3856ad364e35_10.0.26100.1_en-us_f1bf96454ffcddd3\wlanpref.dll.mui Handle ID: 0x72c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-wlanui.resources_31bf3856ad364e35_10.0.26100.1_en-us_23eeb67e4b130244\wlanui.dll.mui Handle ID: 0x1014 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-w..lient-aux.resources_31bf3856ad364e35_10.0.26100.1_en-us_ab77d27ec1677c82\wuapi.dll.mui Handle ID: 0xcd4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-w..ient-core.resources_31bf3856ad364e35_10.0.26100.1_en-us_014a72d046bfc37d\wuaueng.dll.mui Handle ID: 0xb04 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-wlansvc.resources_31bf3856ad364e35_10.0.26100.1_en-us_3ab9325afea77d36\wlansvc.dll.mui Handle ID: 0x828 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-w..sh-helper.resources_31bf3856ad364e35_10.0.26100.1_en-us_bde51143a3008ea0\wlancfg.dll.mui Handle ID: 0xda8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-s..gementwmi.resources_31bf3856ad364e35_10.0.26100.1_en-us_769af521b18ff477\storagewmi.dll.mui Handle ID: 0xeac Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-cbmr-uefi-winre_31bf3856ad364e35_10.0.26100.1_none_848cdad36ab7e893\cbmr.ini Handle ID: 0x81c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-cbmr-uefi-winre_31bf3856ad364e35_10.0.26100.1_none_848cdad36ab7e893\cbmr_driver.efi Handle ID: 0x124c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..itiator_service_mof_31bf3856ad364e35_10.0.26100.1_none_a66107111e59b449\iscsidsc.mof Handle ID: 0xe40 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..itiator_service_mof_31bf3856ad364e35_10.0.26100.1_none_a66107111e59b449\iscsirem.mof Handle ID: 0x11d8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..itiator_service_mof_31bf3856ad364e35_10.0.26100.1_none_a66107111e59b449\iscsiprf.mof Handle ID: 0xc3c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..itiator_service_mof_31bf3856ad364e35_10.0.26100.1_none_a66107111e59b449\iscsiwmiv2_uninstall.mof Handle ID: 0x1294 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..itiator_service_mof_31bf3856ad364e35_10.0.26100.1_none_a66107111e59b449\iscsiwmiv2.mof Handle ID: 0xae8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..itiator_service_mof_31bf3856ad364e35_10.0.26100.1_none_a66107111e59b449\iscsihba.mof Handle ID: 0xf44 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..itiator_service_mof_31bf3856ad364e35_10.0.26100.1_none_a66107111e59b449\msiscsi.mof Handle ID: 0x10f8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-storagemanagementwmi_31bf3856ad364e35_10.0.26100.1_none_4ddfac11b31e2664\storagewmi_passthru.mof Handle ID: 0x94c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-storagemanagementwmi_31bf3856ad364e35_10.0.26100.1_none_4ddfac11b31e2664\storagewmi_passthru_uninstall.mof Handle ID: 0xf50 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-storagemanagementwmi_31bf3856ad364e35_10.0.26100.1_none_4ddfac11b31e2664\storagewmi_uninstall.mof Handle ID: 0xdb0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-wcn-config-registrar_31bf3856ad364e35_10.0.26100.1_none_2a105c312a76612a\wcncsvc.mof Handle ID: 0xfec Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-onecoreuap-wlansvc_31bf3856ad364e35_10.0.26100.1_none_3fd362665ade9a4f\wlan.mof Handle ID: 0xab4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-storagemanagementwmi_31bf3856ad364e35_10.0.26100.1_none_4ddfac11b31e2664\storagewmi.mof Handle ID: 0x11a4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..rvice_mof.resources_31bf3856ad364e35_10.0.26100.1_en-us_22254a795a120bd2\iscsiwmiv2_uninstall.mfl Handle ID: 0xa54 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..rvice_mof.resources_31bf3856ad364e35_10.0.26100.1_en-us_22254a795a120bd2\iscsiprf.mfl Handle ID: 0x874 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..rvice_mof.resources_31bf3856ad364e35_10.0.26100.1_en-us_22254a795a120bd2\iscsidsc.mfl Handle ID: 0x1098 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-s..gementwmi.resources_31bf3856ad364e35_10.0.26100.1_en-us_769af521b18ff477\storagewmi_passthru.mfl Handle ID: 0x8f0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-s..gementwmi.resources_31bf3856ad364e35_10.0.26100.1_en-us_769af521b18ff477\storagewmi_uninstall.mfl Handle ID: 0xc20 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-w..registrar.resources_31bf3856ad364e35_10.0.26100.1_en-us_196b649512390aff\wcncsvc.mfl Handle ID: 0x990 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..rvice_mof.resources_31bf3856ad364e35_10.0.26100.1_en-us_22254a795a120bd2\iscsiwmiv2.mfl Handle ID: 0x9c4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-ie-htmlrendering_31bf3856ad364e35_11.0.26100.1_none_442835d4f58ff378\edgehtml.dll Handle ID: 0xc14 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-d..optimization-cmdlet_31bf3856ad364e35_10.0.26100.1_none_a4fd382bad9de6a8\DeliveryOptimization.psd1 Handle ID: 0x910 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-d..optimization-cmdlet_31bf3856ad364e35_10.0.26100.1_none_a4fd382bad9de6a8\DeliveryOptimizationSettings.psm1 Handle ID: 0xe30 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-d..optimization-cmdlet_31bf3856ad364e35_10.0.26100.1_none_a4fd382bad9de6a8\DeliveryOptimizationVerboseLogs.psm1 Handle ID: 0xe98 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-d..optimization-cmdlet_31bf3856ad364e35_10.0.26100.1_none_a4fd382bad9de6a8\DeliveryOptimizationStatus.psm1 Handle ID: 0x778 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..i_initiator_service_31bf3856ad364e35_10.0.26100.1_none_d767539e7da48aca\iSCSI.psd1 Handle ID: 0x970 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..i_initiator_service_31bf3856ad364e35_10.0.26100.1_none_d767539e7da48aca\iSCSIConnection.cdxml Handle ID: 0x10d4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..i_initiator_service_31bf3856ad364e35_10.0.26100.1_none_d767539e7da48aca\iSCSISession.cdxml Handle ID: 0x118c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-d..optimization-cmdlet_31bf3856ad364e35_10.0.26100.1_none_a4fd382bad9de6a8\Microsoft.Windows.DeliveryOptimization.AdminCommands.dll Handle ID: 0x90c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..i_initiator_service_31bf3856ad364e35_10.0.26100.1_none_d767539e7da48aca\iSCSITargetPortal.cdxml Handle ID: 0x11e4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..i_initiator_service_31bf3856ad364e35_10.0.26100.1_none_d767539e7da48aca\iSCSITarget.cdxml Handle ID: 0xe50 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-s..ementwmi-powershell_31bf3856ad364e35_10.0.26100.1_none_e63d982ff040a6e0\DiskImage.cdxml Handle ID: 0xfd8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-s..ementwmi-powershell_31bf3856ad364e35_10.0.26100.1_none_e63d982ff040a6e0\FileIntegrity.cdxml Handle ID: 0x1180 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-s..ementwmi-powershell_31bf3856ad364e35_10.0.26100.1_none_e63d982ff040a6e0\FileServer.cdxml Handle ID: 0x74c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-s..ementwmi-powershell_31bf3856ad364e35_10.0.26100.1_none_e63d982ff040a6e0\Disk.cdxml Handle ID: 0x123c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-s..ementwmi-powershell_31bf3856ad364e35_10.0.26100.1_none_e63d982ff040a6e0\FileStorageTier.cdxml Handle ID: 0xeb8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-s..ementwmi-powershell_31bf3856ad364e35_10.0.26100.1_none_e63d982ff040a6e0\FileShare.cdxml Handle ID: 0xf58 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-s..ementwmi-powershell_31bf3856ad364e35_10.0.26100.1_none_e63d982ff040a6e0\InitiatorId.cdxml Handle ID: 0x8d0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-s..ementwmi-powershell_31bf3856ad364e35_10.0.26100.1_none_e63d982ff040a6e0\InitiatorPort.cdxml Handle ID: 0xc44 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-s..ementwmi-powershell_31bf3856ad364e35_10.0.26100.1_none_e63d982ff040a6e0\OffloadDataTransferSetting.cdxml Handle ID: 0xb84 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-s..ementwmi-powershell_31bf3856ad364e35_10.0.26100.1_none_e63d982ff040a6e0\Partition.cdxml Handle ID: 0x1030 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-s..ementwmi-powershell_31bf3856ad364e35_10.0.26100.1_none_e63d982ff040a6e0\PhysicalDisk.cdxml Handle ID: 0x86c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-s..ementwmi-powershell_31bf3856ad364e35_10.0.26100.1_none_e63d982ff040a6e0\MaskingSet.cdxml Handle ID: 0x928 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-s..ementwmi-powershell_31bf3856ad364e35_10.0.26100.1_none_e63d982ff040a6e0\ResiliencySetting.cdxml Handle ID: 0x1070 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-s..ementwmi-powershell_31bf3856ad364e35_10.0.26100.1_none_e63d982ff040a6e0\Storage.psd1 Handle ID: 0xd00 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-s..ementwmi-powershell_31bf3856ad364e35_10.0.26100.1_none_e63d982ff040a6e0\Storage.format.ps1xml Handle ID: 0x788 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-s..ementwmi-powershell_31bf3856ad364e35_10.0.26100.1_none_e63d982ff040a6e0\Storage.types.ps1xml Handle ID: 0x818 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-s..ementwmi-powershell_31bf3856ad364e35_10.0.26100.1_none_e63d982ff040a6e0\StorageEnclosure.cdxml Handle ID: 0x8ac Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-s..ementwmi-powershell_31bf3856ad364e35_10.0.26100.1_none_e63d982ff040a6e0\StorageHealth.cdxml Handle ID: 0xc40 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-s..ementwmi-powershell_31bf3856ad364e35_10.0.26100.1_none_e63d982ff040a6e0\StorageJob.cdxml Handle ID: 0xc0c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-s..ementwmi-powershell_31bf3856ad364e35_10.0.26100.1_none_e63d982ff040a6e0\StorageNode.cdxml Handle ID: 0x920 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-s..ementwmi-powershell_31bf3856ad364e35_10.0.26100.1_none_e63d982ff040a6e0\StorageCmdlets.cdxml Handle ID: 0x858 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-s..ementwmi-powershell_31bf3856ad364e35_10.0.26100.1_none_e63d982ff040a6e0\StoragePool.cdxml Handle ID: 0xc84 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-s..ementwmi-powershell_31bf3856ad364e35_10.0.26100.1_none_e63d982ff040a6e0\StorageReliabilityCounter.cdxml Handle ID: 0x7f0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-s..ementwmi-powershell_31bf3856ad364e35_10.0.26100.1_none_e63d982ff040a6e0\StorageProvider.cdxml Handle ID: 0xa30 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-s..ementwmi-powershell_31bf3856ad364e35_10.0.26100.1_none_e63d982ff040a6e0\StorageSetting.cdxml Handle ID: 0xff4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-s..ementwmi-powershell_31bf3856ad364e35_10.0.26100.1_none_e63d982ff040a6e0\StorageSubSystem.cdxml Handle ID: 0x9d4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-s..ementwmi-powershell_31bf3856ad364e35_10.0.26100.1_none_e63d982ff040a6e0\StorageTier.cdxml Handle ID: 0xfc8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-s..ementwmi-powershell_31bf3856ad364e35_10.0.26100.1_none_e63d982ff040a6e0\TargetPort.cdxml Handle ID: 0xac0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-s..ementwmi-powershell_31bf3856ad364e35_10.0.26100.1_none_e63d982ff040a6e0\TargetPortal.cdxml Handle ID: 0xbc4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-s..ementwmi-powershell_31bf3856ad364e35_10.0.26100.1_none_e63d982ff040a6e0\VirtualDisk.cdxml Handle ID: 0xdac Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-s..ementwmi-powershell_31bf3856ad364e35_10.0.26100.1_none_e63d982ff040a6e0\StorageBusCache.format.ps1xml Handle ID: 0x1084 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-s..ementwmi-powershell_31bf3856ad364e35_10.0.26100.1_none_e63d982ff040a6e0\StorageBusCache.psd1 Handle ID: 0xfd0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-s..ementwmi-powershell_31bf3856ad364e35_10.0.26100.1_none_e63d982ff040a6e0\Volume.cdxml Handle ID: 0x1110 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-s..ementwmi-powershell_31bf3856ad364e35_10.0.26100.1_none_e63d982ff040a6e0\StorageBusCache.types.ps1xml Handle ID: 0x107c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-s..ementwmi-powershell_31bf3856ad364e35_10.0.26100.1_none_e63d982ff040a6e0\StorageBusClientDevice.cdxml Handle ID: 0xb44 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-s..ementwmi-powershell_31bf3856ad364e35_10.0.26100.1_none_e63d982ff040a6e0\StorageBusTargetCacheStoresInstance.cdxml Handle ID: 0x10c8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-s..ementwmi-powershell_31bf3856ad364e35_10.0.26100.1_none_e63d982ff040a6e0\StorageBusTargetDeviceInstance.cdxml Handle ID: 0xfc0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-s..gementwmi.resources_31bf3856ad364e35_10.0.26100.1_en-us_769af521b18ff477\storagewmi.mfl Handle ID: 0x728 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-s..ementwmi-powershell_31bf3856ad364e35_10.0.26100.1_none_e63d982ff040a6e0\StorageBusCache.psm1 Handle ID: 0x11c4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..i_initiator_service_31bf3856ad364e35_10.0.26100.1_none_d767539e7da48aca\iscsicli.exe.mun Handle ID: 0x1220 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-s..ementwmi-powershell_31bf3856ad364e35_10.0.26100.1_none_e63d982ff040a6e0\StorageScripts.psm1 Handle ID: 0x7f8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..tmlrendering-legacy_31bf3856ad364e35_11.0.26100.1_none_4317374585bcbe0e\mshtml.dll Handle ID: 0xd58 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-ie-htmlrendering_31bf3856ad364e35_11.0.26100.1_none_442835d4f58ff378\edgehtml.dll.mun Handle ID: 0x104c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..tmlrendering-legacy_31bf3856ad364e35_11.0.26100.1_none_4317374585bcbe0e\mshtml.dll.mun Handle ID: 0xd84 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-w..ig-registrar-wizard_31bf3856ad364e35_10.0.26100.1_none_3a26605d67eeb910\wcnwiz.dll.mun Handle ID: 0x10a4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\wow64_microsoft-windows-wcn-config-registrar_31bf3856ad364e35_10.0.26100.1_none_346506835ed72325\fdWCN.dll Handle ID: 0x1240 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\wow64_microsoft-windows-c..cn-config-registrar_31bf3856ad364e35_10.0.26100.1_none_2e65f73a33166a38\WcnApi.dll Handle ID: 0x6bc Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\wow64_microsoft-windows-w..ig-registrar-wizard_31bf3856ad364e35_10.0.26100.1_none_447b0aaf9c4f7b0b\wcnwiz.dll Handle ID: 0x1038 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-update-uus-stable_31bf3856ad364e35_10.0.26100.1_none_1006e40fd0afa9c6\uusp.json Handle ID: 0x7ac Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-updatepolicy_31bf3856ad364e35_10.0.26100.1_none_597d234dfbcf4cd0\updatepolicycore.dll Handle ID: 0x115c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-w..wsupdateclient-core_31bf3856ad364e35_10.0.26100.1_none_abd60549122613b6\wuaucltcore.exe Handle ID: 0xff0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-update-uus-stable_31bf3856ad364e35_10.0.26100.1_none_1006e40fd0afa9c6\UusBrain.dll Handle ID: 0x11ec Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-w..wsupdateclient-core_31bf3856ad364e35_10.0.26100.1_none_abd60549122613b6\wups2core.dll Handle ID: 0xbe8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-w..wsupdateclient-core_31bf3856ad364e35_10.0.26100.1_none_abd60549122613b6\UpdateDeploy.dll Handle ID: 0x764 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-w..owsupdateclient-aux_31bf3856ad364e35_10.0.26100.1_none_91e73f9525e66cb9\wupscore.dll Handle ID: 0xc74 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-w..owsupdateclient-aux_31bf3856ad364e35_10.0.26100.1_none_91e73f9525e66cb9\wutrust.dll Handle ID: 0xe88 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-updatepolicy.resources_31bf3856ad364e35_10.0.26100.1_en-us_f49f420cee4f7243\UpdatePolicyCore.dll.mui Handle ID: 0x11b4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-w..lient-aux.resources_31bf3856ad364e35_10.0.26100.1_en-us_ab77d27ec1677c82\wuapicore.dll.mui Handle ID: 0xf34 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-w..ient-core.resources_31bf3856ad364e35_10.0.26100.1_en-us_014a72d046bfc37d\wuauengcore.dll.mui Handle ID: 0x1290 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-w..wsupdateclient-core_31bf3856ad364e35_10.0.26100.1_none_abd60549122613b6\004c9a69d6903d92746f7670fcbc4e3dd4716681.xml Handle ID: 0xfe0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-w..wsupdateclient-core_31bf3856ad364e35_10.0.26100.1_none_abd60549122613b6\021ace09768704303e8cd92cc2d7c5ea94b53731.xml Handle ID: 0xd38 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-w..wsupdateclient-core_31bf3856ad364e35_10.0.26100.1_none_abd60549122613b6\0cf49350999533e06203e66617b9a479c64e3b98.xml Handle ID: 0x760 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-w..wsupdateclient-core_31bf3856ad364e35_10.0.26100.1_none_abd60549122613b6\116da488502c96511736970b304a7e240fc0ba8b.xml Handle ID: 0x968 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-w..wsupdateclient-core_31bf3856ad364e35_10.0.26100.1_none_abd60549122613b6\24a2f8789b154b699940ad9ab7d39aaa2e9892f2.xml Handle ID: 0x12a0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-w..wsupdateclient-core_31bf3856ad364e35_10.0.26100.1_none_abd60549122613b6\37c83a61220fca54f4cc65a0ff815d308fbddba2.xml Handle ID: 0x11a8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-w..wsupdateclient-core_31bf3856ad364e35_10.0.26100.1_none_abd60549122613b6\4b53860889d3f3c448fc514d2ea0120100076816.xml Handle ID: 0x80c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-w..wsupdateclient-core_31bf3856ad364e35_10.0.26100.1_none_abd60549122613b6\4ce89f83f5d24acf7f9e6396fb5d65851e57bd8b.xml Handle ID: 0x940 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-w..wsupdateclient-core_31bf3856ad364e35_10.0.26100.1_none_abd60549122613b6\500b17b3dff5e249f7fa450bb272a5c0938ade70.xml Handle ID: 0xda4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-w..wsupdateclient-core_31bf3856ad364e35_10.0.26100.1_none_abd60549122613b6\52b78fa9544605e886641d0eb008d4faf901c673.xml Handle ID: 0xaac Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-w..wsupdateclient-core_31bf3856ad364e35_10.0.26100.1_none_abd60549122613b6\582d25b6760e7c9f0771f88c3b89cb14b708df42.xml Handle ID: 0xa44 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-w..wsupdateclient-core_31bf3856ad364e35_10.0.26100.1_none_abd60549122613b6\74461450967a334ea27548db66c8db015e4c4b86.xml Handle ID: 0x128c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-deliveryoptimization_31bf3856ad364e35_10.0.26100.1_none_c74dc9882f91889c\7b9b1ea12d1b4fc12ccbc5aeda559b08838bf86a.xml Handle ID: 0x73c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-w..wsupdateclient-core_31bf3856ad364e35_10.0.26100.1_none_abd60549122613b6\7d06486ae99beb45ced199480ddff358d347c849.xml Handle ID: 0xacc Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-deliveryoptimization_31bf3856ad364e35_10.0.26100.1_none_c74dc9882f91889c\8921b5587b25ac906f6851660e78916b20b2b8d6.xml Handle ID: 0xf00 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-w..wsupdateclient-core_31bf3856ad364e35_10.0.26100.1_none_abd60549122613b6\9393330d1e6341c9b25e57fc21d87a9cba313d8a.xml Handle ID: 0x6f8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-w..wsupdateclient-core_31bf3856ad364e35_10.0.26100.1_none_abd60549122613b6\975b69eb30393cebd6885b635d2336e84c986366.xml Handle ID: 0xefc Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-w..wsupdateclient-core_31bf3856ad364e35_10.0.26100.1_none_abd60549122613b6\9a00328f787b0683a05c2e7a16ef7858adfa8068.xml Handle ID: 0xa2c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-w..wsupdateclient-core_31bf3856ad364e35_10.0.26100.1_none_abd60549122613b6\a1026e97d46e89c55e97134de3823210f59708cb.xml Handle ID: 0x704 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-w..wsupdateclient-core_31bf3856ad364e35_10.0.26100.1_none_abd60549122613b6\b3bb6b55513607cc90be39c910e062da5f216e15.xml Handle ID: 0xb40 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-w..wsupdateclient-core_31bf3856ad364e35_10.0.26100.1_none_abd60549122613b6\b4c45249d60a77639b177e565616ae1d11f9e3d5.xml Handle ID: 0x1188 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-w..wsupdateclient-core_31bf3856ad364e35_10.0.26100.1_none_abd60549122613b6\b7815cc1f204e86977f8af4ac2e1db35a3785601.xml Handle ID: 0xc18 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-w..wsupdateclient-core_31bf3856ad364e35_10.0.26100.1_none_abd60549122613b6\c85a6c184c03a4fd97b09fa8d3b2686d19f086b7.xml Handle ID: 0x8c4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-w..wsupdateclient-core_31bf3856ad364e35_10.0.26100.1_none_abd60549122613b6\cedc3b4fce38a37147e150db36103e809d106cbb.xml Handle ID: 0x7b0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-w..wsupdateclient-core_31bf3856ad364e35_10.0.26100.1_none_abd60549122613b6\d9514f22230add819ddde709de315f0165b36a8e.xml Handle ID: 0x7fc Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-w..wsupdateclient-core_31bf3856ad364e35_10.0.26100.1_none_abd60549122613b6\dfd9063b031c70d0c87310b16c4132522b447dda.xml Handle ID: 0xa34 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-w..wsupdateclient-core_31bf3856ad364e35_10.0.26100.1_none_abd60549122613b6\eb8a9128946e6df63483662e5eab8367dfcb7a1e.xml Handle ID: 0xc5c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-w..wsupdateclient-core_31bf3856ad364e35_10.0.26100.1_none_abd60549122613b6\fc310fd3e8f7901e37586b5e985d8c86a827a838.xml Handle ID: 0x964 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-w..wsupdateclient-core_31bf3856ad364e35_10.0.26100.1_none_abd60549122613b6\fd6598122489ab56bffaf7f6676165c57428611a.xml Handle ID: 0x7dc Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-w..wsupdateclient-core_31bf3856ad364e35_10.0.26100.1_none_abd60549122613b6\fe879c763d5196b26d4907df181c4357c07c5aaa.xml Handle ID: 0x820 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-w..wsupdateclient-core_31bf3856ad364e35_10.0.26100.1_none_abd60549122613b6\14a3f9e824793931d34f7f786a538bbc9ef1f0d6.xml Handle ID: 0x840 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-deliveryoptimization_31bf3856ad364e35_10.0.26100.1_none_c74dc9882f91889c\2213703c9c64cc61ba900531652e23c84728d2a2.xml Handle ID: 0xafc Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-bits-client-core_31bf3856ad364e35_10.0.26100.1_none_23388537f363783d\315818c03ccc2b10070df2d4ebd09eb6c4c66e58.xml Handle ID: 0xc78 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-w..driverupdatesupport_31bf3856ad364e35_10.0.26100.1_none_24e14f2cad3dc1b5\wuuhdrv.dll Handle ID: 0xae4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-w..owsupdateclient-aux_31bf3856ad364e35_10.0.26100.1_none_91e73f9525e66cb9\wuapicore.dll Handle ID: 0xc94 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-ieframe_31bf3856ad364e35_11.0.26100.1_none_95878fd8818581a5\ieframe.dll.mun Handle ID: 0xaa4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-w..osdeploymentsupport_31bf3856ad364e35_10.0.26100.1_none_0516e586c03c9127\wuuhosdeployment.dll Handle ID: 0xf94 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-w..wsupdateclient-core_31bf3856ad364e35_10.0.26100.1_none_abd60549122613b6\wuauengcore.dll Handle ID: 0x9e4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_boot_efi_cipolicies_active_8937710587dbb730.cdf-ms Handle ID: 0xd6c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_imaging_b3298c7e56e1caea.cdf-ms Handle ID: 0x9bc Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_l2schemas_d7bb5637381de58c.cdf-ms Handle ID: 0x11ac Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_pla_reports_a2604845b2b380ca.cdf-ms Handle ID: 0x8f8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_pla_reports_en-us_04eb81229a78dfb4.cdf-ms Handle ID: 0x1198 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_pla_rules_0bde462ce96f215e.cdf-ms Handle ID: 0xa04 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_pla_rules_en-us_8cd2a7c250e636a2.cdf-ms Handle ID: 0x1008 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_policydefinitions_89130cdfc4d9c27c.cdf-ms Handle ID: 0x1164 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_policydefinitions_en-us_3b1c5b998da0d4ae.cdf-ms Handle ID: 0x11cc Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_fonts_40104ba9a1d20dac.cdf-ms Handle ID: 0xa80 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_system32_driverstore_en-us_f6b4aaeeda14a371.cdf-ms Handle ID: 0xe2c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_system32_wcn_06656d8dd047aafe.cdf-ms Handle ID: 0x900 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_system32_wcn_en-us_f42897ed07859b3c.cdf-ms Handle ID: 0xcb0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_system32_windowspowershell_v1.0_modules_deliveryoptimization_11eaf13926d935e3.cdf-ms Handle ID: 0x948 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_system32_windowspowershell_v1.0_modules_iscsi_6a82841e51a4df9f.cdf-ms Handle ID: 0xb58 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_system32_wbem_en-us_4555b1beb1c13883.cdf-ms Handle ID: 0x10b8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_system32_windowspowershell_v1.0_modules_storagebuscache_f8ef06c6464c2279.cdf-ms Handle ID: 0x8dc Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_system32_windowspowershell_v1.0_modules_storage_fcdb4bda9a6da24d.cdf-ms Handle ID: 0x1104 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_system32_wbem_06656d9fdf2f8577.cdf-ms Handle ID: 0xf68 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_systemresources_0307ca33e1cd9708.cdf-ms Handle ID: 0x614 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_syswow64_en-us_9e576ab077991fe8.cdf-ms Handle ID: 0xdc0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_syswow64_wcn_1bf25cffa7664032.cdf-ms Handle ID: 0x720 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_syswow64_wcn_en-us_1f7e1a8c7448ffe8.cdf-ms Handle ID: 0x1018 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_uus_3f582921a4c8b86f.cdf-ms Handle ID: 0xf5c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_uus_amd64_en-us_ce2cd76bb8f04153.cdf-ms Handle ID: 0x978 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_waas_401032e7a18c2040.cdf-ms Handle ID: 0x11d4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\programdata_microsoft_network_downloader_7fafaef6d33e4371.cdf-ms Handle ID: 0x1a8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\programdata_softwaredistribution_ae0bdc9bb1bbdfab.cdf-ms Handle ID: 0x11c0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-winre-tools.resources_31bf3856ad364e35_10.0.26100.5059_en-us_1c582dec78d426dd\StartRep.exe.mui Handle ID: 0x62c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-winre-tools.resources_31bf3856ad364e35_10.0.26100.5059_en-us_1c582dec78d426dd\RecEnv.exe.mui Handle ID: 0xd28 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-winre-tools_31bf3856ad364e35_10.0.26100.5059_none_65eef8a71ff4d806\RecHost.exe Handle ID: 0x704 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-b..ore-bootmanager-efi_31bf3856ad364e35_10.0.26100.5059_none_237243ca4c4282ef\boot.pnd.stl Handle ID: 0xa2c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-b..ore-bootmanager-efi_31bf3856ad364e35_10.0.26100.5059_none_237243ca4c4282ef\bootmgfw.efi Handle ID: 0xefc Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-winre-tools_31bf3856ad364e35_10.0.26100.5059_none_65eef8a71ff4d806\RecEnv.exe Handle ID: 0x6f8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-b..ore-bootmanager-efi_31bf3856ad364e35_10.0.26100.5059_none_237243ca4c4282ef\SecureBootRecovery.efi Handle ID: 0xf00 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.26100.5059_bg-bg_2c698dd8c44d5dbd\bootmgfw_EX.efi.mui Handle ID: 0x70c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.26100.5059_bg-bg_2c698dd8c44d5dbd\bootmgfw.efi.mui Handle ID: 0xf1c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.26100.5059_bg-bg_2c698dd8c44d5dbd\bootmgr_EX.efi.mui Handle ID: 0xd34 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.26100.5059_bg-bg_2c698dd8c44d5dbd\bootmgr.efi.mui Handle ID: 0xeac Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.26100.5059_cs-cz_d7730473b1d539e8\bootmgfw_EX.efi.mui Handle ID: 0x124c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.26100.5059_cs-cz_d7730473b1d539e8\bootmgfw.efi.mui Handle ID: 0x8a8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.26100.5059_cs-cz_d7730473b1d539e8\bootmgr_EX.efi.mui Handle ID: 0xb0c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.26100.5059_cs-cz_d7730473b1d539e8\bootmgr.efi.mui Handle ID: 0x72c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.26100.5059_da-dk_74ace49aa81b35e7\bootmgfw_EX.efi.mui Handle ID: 0xe0c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.26100.5059_da-dk_74ace49aa81b35e7\bootmgfw.efi.mui Handle ID: 0xae8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-b..ironment-dvd-efisys_31bf3856ad364e35_10.0.26100.5059_none_fe92426e92bf65bd\efisys.bin Handle ID: 0x71c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.26100.5059_da-dk_74ace49aa81b35e7\bootmgr_EX.efi.mui Handle ID: 0xe40 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.26100.5059_da-dk_74ace49aa81b35e7\bootmgr.efi.mui Handle ID: 0xc10 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-winre-tools_31bf3856ad364e35_10.0.26100.5059_none_65eef8a71ff4d806\StartRep.exe Handle ID: 0x1014 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-b..ironment-dvd-efisys_31bf3856ad364e35_10.0.26100.5059_none_fe92426e92bf65bd\efisys_noprompt.bin Handle ID: 0x750 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-b..ironment-dvd-efisys_31bf3856ad364e35_10.0.26100.5059_none_fe92426e92bf65bd\efisys_EX.bin Handle ID: 0xcd4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-b..ironment-dvd-efisys_31bf3856ad364e35_10.0.26100.5059_none_fe92426e92bf65bd\efisys_noprompt_EX.bin Handle ID: 0x9c4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.26100.5059_de-de_71d879d6a9f18a81\bootmgr_EX.efi.mui Handle ID: 0xeb8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.26100.5059_de-de_71d879d6a9f18a81\bootmgr.efi.mui Handle ID: 0x86c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.26100.5059_de-de_71d879d6a9f18a81\bootmgfw_EX.efi.mui Handle ID: 0x1070 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.26100.5059_de-de_71d879d6a9f18a81\bootmgfw.efi.mui Handle ID: 0x74c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.26100.5059_el-gr_1a6ea7699906f30f\bootmgr_EX.efi.mui Handle ID: 0x990 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.26100.5059_el-gr_1a6ea7699906f30f\bootmgr.efi.mui Handle ID: 0x9dc Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.26100.5059_el-gr_1a6ea7699906f30f\bootmgfw_EX.efi.mui Handle ID: 0x8e4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.26100.5059_el-gr_1a6ea7699906f30f\bootmgfw.efi.mui Handle ID: 0x970 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.26100.5059_en-gb_134094b19da6e281\bootmgfw_EX.efi.mui Handle ID: 0x1178 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.26100.5059_en-gb_134094b19da6e281\bootmgfw.efi.mui Handle ID: 0xa6c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.26100.5059_en-gb_134094b19da6e281\bootmgr_EX.efi.mui Handle ID: 0xbe4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.26100.5059_en-gb_134094b19da6e281\bootmgr.efi.mui Handle ID: 0xb68 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.26100.5059_en-us_1ac94fcf98cf9646\bootmgfw_EX.efi.mui Handle ID: 0xfd0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.26100.5059_en-us_1ac94fcf98cf9646\bootmgfw.efi.mui Handle ID: 0x1004 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.26100.5059_en-us_1ac94fcf98cf9646\bootmgr_EX.efi.mui Handle ID: 0xe10 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.26100.5059_en-us_1ac94fcf98cf9646\bootmgr.efi.mui Handle ID: 0xba4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.26100.5059_es-es_1a94acb398f687eb\bootmgfw_EX.efi.mui Handle ID: 0x118c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.26100.5059_es-es_1a94acb398f687eb\bootmgfw.efi.mui Handle ID: 0xfc0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.26100.5059_es-es_1a94acb398f687eb\bootmgr_EX.efi.mui Handle ID: 0xa0c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.26100.5059_es-es_1a94acb398f687eb\bootmgr.efi.mui Handle ID: 0xa30 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.26100.5059_es-mx_1ccb9a59978a6b96\bootmgr_EX.efi.mui Handle ID: 0x760 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.26100.5059_es-mx_1ccb9a59978a6b96\bootmgr.efi.mui Handle ID: 0xff4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.26100.5059_es-mx_1ccb9a59978a6b96\bootmgfw_EX.efi.mui Handle ID: 0xd84 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.26100.5059_es-mx_1ccb9a59978a6b96\bootmgfw.efi.mui Handle ID: 0xfc8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.26100.5059_et-ee_145478439cfc647a\bootmgfw_EX.efi.mui Handle ID: 0x104c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.26100.5059_et-ee_145478439cfc647a\bootmgfw.efi.mui Handle ID: 0x764 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.26100.5059_et-ee_145478439cfc647a\bootmgr_EX.efi.mui Handle ID: 0xc74 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.26100.5059_et-ee_145478439cfc647a\bootmgr.efi.mui Handle ID: 0xe88 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.26100.5059_fi-fi_b9afb1608e107a15\bootmgfw_EX.efi.mui Handle ID: 0xf30 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.26100.5059_fi-fi_b9afb1608e107a15\bootmgfw.efi.mui Handle ID: 0x8d4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.26100.5059_fi-fi_b9afb1608e107a15\bootmgr_EX.efi.mui Handle ID: 0x7ac Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.26100.5059_fi-fi_b9afb1608e107a15\bootmgr.efi.mui Handle ID: 0x7dc Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.26100.5059_fr-ca_b5c26cfc90a10473\bootmgfw_EX.efi.mui Handle ID: 0x7b0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.26100.5059_fr-ca_b5c26cfc90a10473\bootmgfw.efi.mui Handle ID: 0x964 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.26100.5059_fr-ca_b5c26cfc90a10473\bootmgr_EX.efi.mui Handle ID: 0x8f8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.26100.5059_fr-ca_b5c26cfc90a10473\bootmgr.efi.mui Handle ID: 0x7fc Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.26100.5059_fr-fr_bd4c22b28bc89e4d\bootmgr_EX.efi.mui Handle ID: 0x8ec Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.26100.5059_fr-fr_bd4c22b28bc89e4d\bootmgr.efi.mui Handle ID: 0x116c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.26100.5059_fr-fr_bd4c22b28bc89e4d\bootmgfw_EX.efi.mui Handle ID: 0x11c0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.26100.5059_fr-fr_bd4c22b28bc89e4d\bootmgfw.efi.mui Handle ID: 0x720 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.26100.5059_hr-hr_03887d3470eb0c01\bootmgr_EX.efi.mui Handle ID: 0xf94 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.26100.5059_hr-hr_03887d3470eb0c01\bootmgr.efi.mui Handle ID: 0xba8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.26100.5059_hr-hr_03887d3470eb0c01\bootmgfw_EX.efi.mui Handle ID: 0x7c0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.26100.5059_hr-hr_03887d3470eb0c01\bootmgfw.efi.mui Handle ID: 0xa5c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.26100.5059_hu-hu_04bca2fa70286d69\bootmgfw_EX.efi.mui Handle ID: 0xcc4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.26100.5059_hu-hu_04bca2fa70286d69\bootmgfw.efi.mui Handle ID: 0x1104 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.26100.5059_hu-hu_04bca2fa70286d69\bootmgr_EX.efi.mui Handle ID: 0xbd8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.26100.5059_hu-hu_04bca2fa70286d69\bootmgr.efi.mui Handle ID: 0xb60 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.26100.5059_ja-jp_49999806561595a6\bootmgfw_EX.efi.mui Handle ID: 0x694 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.26100.5059_ja-jp_49999806561595a6\bootmgfw.efi.mui Handle ID: 0xab0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.26100.5059_it-it_a77418f962fa83cb\bootmgfw_EX.efi.mui Handle ID: 0xc38 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.26100.5059_it-it_a77418f962fa83cb\bootmgfw.efi.mui Handle ID: 0x790 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.26100.5059_it-it_a77418f962fa83cb\bootmgr_EX.efi.mui Handle ID: 0x798 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.26100.5059_it-it_a77418f962fa83cb\bootmgr.efi.mui Handle ID: 0x77c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-winre-tools_31bf3856ad364e35_10.0.26100.5059_none_65eef8a71ff4d806\SrtTel.dll Handle ID: 0x740 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.26100.5059_ja-jp_49999806561595a6\bootmgr_EX.efi.mui Handle ID: 0x1124 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.26100.5059_ja-jp_49999806561595a6\bootmgr.efi.mui Handle ID: 0x1060 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.26100.5059_ko-kr_ed0374bb48865cbc\bootmgfw_EX.efi.mui Handle ID: 0x1008 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.26100.5059_ko-kr_ed0374bb48865cbc\bootmgfw.efi.mui Handle ID: 0x1164 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.26100.5059_ko-kr_ed0374bb48865cbc\bootmgr_EX.efi.mui Handle ID: 0x11cc Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.26100.5059_ko-kr_ed0374bb48865cbc\bootmgr.efi.mui Handle ID: 0xa80 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.26100.5059_lt-lt_90cea0bc3aae2859\bootmgr_EX.efi.mui Handle ID: 0x998 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.26100.5059_lt-lt_90cea0bc3aae2859\bootmgr.efi.mui Handle ID: 0xb40 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.26100.5059_lt-lt_90cea0bc3aae2859\bootmgfw_EX.efi.mui Handle ID: 0xe90 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.26100.5059_lt-lt_90cea0bc3aae2859\bootmgfw.efi.mui Handle ID: 0xd28 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.26100.5059_lv-lv_919c0f403a2c6949\bootmgfw_EX.efi.mui Handle ID: 0xe2c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.26100.5059_lv-lv_919c0f403a2c6949\bootmgfw.efi.mui Handle ID: 0xa2c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.26100.5059_lv-lv_919c0f403a2c6949\bootmgr_EX.efi.mui Handle ID: 0xefc Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.26100.5059_lv-lv_919c0f403a2c6949\bootmgr.efi.mui Handle ID: 0xf00 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.26100.5059_nb-no_d595f5f020ab8878\bootmgfw_EX.efi.mui Handle ID: 0x70c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.26100.5059_nb-no_d595f5f020ab8878\bootmgfw.efi.mui Handle ID: 0x62c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.26100.5059_nb-no_d595f5f020ab8878\bootmgr_EX.efi.mui Handle ID: 0x704 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.26100.5059_nb-no_d595f5f020ab8878\bootmgr.efi.mui Handle ID: 0xcb0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.26100.5059_nl-nl_d3d5412e21d7924d\bootmgr_EX.efi.mui Handle ID: 0x948 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.26100.5059_nl-nl_d3d5412e21d7924d\bootmgr.efi.mui Handle ID: 0x10b8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.26100.5059_pl-pl_1a119bb006fa0001\bootmgr_EX.efi.mui Handle ID: 0x8dc Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.26100.5059_pl-pl_1a119bb006fa0001\bootmgr.efi.mui Handle ID: 0xf5c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.26100.5059_pl-pl_1a119bb006fa0001\bootmgfw_EX.efi.mui Handle ID: 0x978 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.26100.5059_pl-pl_1a119bb006fa0001\bootmgfw.efi.mui Handle ID: 0xd80 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.26100.5059_nl-nl_d3d5412e21d7924d\bootmgfw_EX.efi.mui Handle ID: 0xcf0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.26100.5059_nl-nl_d3d5412e21d7924d\bootmgfw.efi.mui Handle ID: 0xd6c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.26100.5059_pt-br_1c658654058393e5\bootmgfw_EX.efi.mui Handle ID: 0x11d4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.26100.5059_pt-br_1c658654058393e5\bootmgfw.efi.mui Handle ID: 0x1014 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.26100.5059_pt-br_1c658654058393e5\bootmgr_EX.efi.mui Handle ID: 0xc10 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.26100.5059_pt-br_1c658654058393e5\bootmgr.efi.mui Handle ID: 0xe40 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.26100.5059_pt-pt_1d4755c004f303c1\bootmgfw_EX.efi.mui Handle ID: 0x750 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.26100.5059_pt-pt_1d4755c004f303c1\bootmgfw.efi.mui Handle ID: 0x86c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.26100.5059_pt-pt_1d4755c004f303c1\bootmgr_EX.efi.mui Handle ID: 0x71c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.26100.5059_pt-pt_1d4755c004f303c1\bootmgr.efi.mui Handle ID: 0xae8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.26100.5059_ro-ro_61821bf7eb59cf1d\bootmgfw_EX.efi.mui Handle ID: 0xe0c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.26100.5059_ro-ro_61821bf7eb59cf1d\bootmgfw.efi.mui Handle ID: 0x72c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.26100.5059_ro-ro_61821bf7eb59cf1d\bootmgr_EX.efi.mui Handle ID: 0xb0c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.26100.5059_ro-ro_61821bf7eb59cf1d\bootmgr.efi.mui Handle ID: 0x8a8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.26100.5059_ru-ru_63ea6783e9d491ed\bootmgr_EX.efi.mui Handle ID: 0x124c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.26100.5059_ru-ru_63ea6783e9d491ed\bootmgr.efi.mui Handle ID: 0x8e4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.26100.5059_sk-sk_03056c30deee8417\bootmgfw_EX.efi.mui Handle ID: 0x1178 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.26100.5059_sk-sk_03056c30deee8417\bootmgfw.efi.mui Handle ID: 0xa6c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.26100.5059_ru-ru_63ea6783e9d491ed\bootmgfw_EX.efi.mui Handle ID: 0xeac Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.26100.5059_ru-ru_63ea6783e9d491ed\bootmgfw.efi.mui Handle ID: 0xd34 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.26100.5059_sk-sk_03056c30deee8417\bootmgr_EX.efi.mui Handle ID: 0xf1c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.26100.5059_sk-sk_03056c30deee8417\bootmgr.efi.mui Handle ID: 0x6f8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.26100.5059_sl-si_02178de8df8896fa\bootmgfw_EX.efi.mui Handle ID: 0x900 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.26100.5059_sl-si_02178de8df8896fa\bootmgfw.efi.mui Handle ID: 0xe10 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.26100.5059_sl-si_02178de8df8896fa\bootmgr_EX.efi.mui Handle ID: 0x118c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.26100.5059_sl-si_02178de8df8896fa\bootmgr.efi.mui Handle ID: 0xba4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.26100.5059_sr-..-rs_a847f62d549a3e2b\bootmgfw_EX.efi.mui Handle ID: 0xbbc Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.26100.5059_sr-..-rs_a847f62d549a3e2b\bootmgfw.efi.mui Handle ID: 0x6b0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.26100.5059_sv-se_ffe551f8e0fd9c48\bootmgfw_EX.efi.mui Handle ID: 0xe1c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.26100.5059_sv-se_ffe551f8e0fd9c48\bootmgfw.efi.mui Handle ID: 0xa30 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.26100.5059_sr-..-rs_a847f62d549a3e2b\bootmgr_EX.efi.mui Handle ID: 0xfc0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.26100.5059_sr-..-rs_a847f62d549a3e2b\bootmgr.efi.mui Handle ID: 0xa0c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.26100.5059_sv-se_ffe551f8e0fd9c48\bootmgr_EX.efi.mui Handle ID: 0x1004 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.26100.5059_sv-se_ffe551f8e0fd9c48\bootmgr.efi.mui Handle ID: 0xc74 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.26100.5059_tr-tr_a8f29c3fcfb99e39\bootmgfw_EX.efi.mui Handle ID: 0xfd0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.26100.5059_tr-tr_a8f29c3fcfb99e39\bootmgfw.efi.mui Handle ID: 0xb68 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.26100.5059_zh-cn_7a4fba3d7ff17058\bootmgfw_EX.efi.mui Handle ID: 0xbe4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.26100.5059_zh-cn_7a4fba3d7ff17058\bootmgfw.efi.mui Handle ID: 0x970 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.26100.5059_tr-tr_a8f29c3fcfb99e39\bootmgr_EX.efi.mui Handle ID: 0x11ac Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.26100.5059_tr-tr_a8f29c3fcfb99e39\bootmgr.efi.mui Handle ID: 0x1198 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.26100.5059_zh-tw_7e4bf7937d624cc8\bootmgfw_EX.efi.mui Handle ID: 0xa04 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.26100.5059_zh-tw_7e4bf7937d624cc8\bootmgfw.efi.mui Handle ID: 0x8ec Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.26100.5059_uk-ua_44d27ee6c6eac485\bootmgfw_EX.efi.mui Handle ID: 0x7fc Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.26100.5059_uk-ua_44d27ee6c6eac485\bootmgfw.efi.mui Handle ID: 0x11c0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.26100.5059_uk-ua_44d27ee6c6eac485\bootmgr_EX.efi.mui Handle ID: 0x8f8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.26100.5059_uk-ua_44d27ee6c6eac485\bootmgr.efi.mui Handle ID: 0x964 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.26100.5059_zh-tw_7e4bf7937d624cc8\bootmgr_EX.efi.mui Handle ID: 0x7b0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.26100.5059_zh-tw_7e4bf7937d624cc8\bootmgr.efi.mui Handle ID: 0x116c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.26100.5059_zh-cn_7a4fba3d7ff17058\bootmgr_EX.efi.mui Handle ID: 0x6c4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.26100.5059_zh-cn_7a4fba3d7ff17058\bootmgr.efi.mui Handle ID: 0xa58 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-b..ore-bootmanager-efi_31bf3856ad364e35_10.0.26100.5059_none_237243ca4c4282ef\bootmgr_EX.efi Handle ID: 0x7c0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-b..ore-bootmanager-efi_31bf3856ad364e35_10.0.26100.5059_none_237243ca4c4282ef\bootmgr.efi Handle ID: 0xcc4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-b..core-fonts-kor-boot_31bf3856ad364e35_10.0.26100.5059_none_f6b8db3e450333f1\malgunn_boot.ttf Handle ID: 0xa5c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-b..core-fonts-kor-boot_31bf3856ad364e35_10.0.26100.5059_none_f6b8db3e450333f1\malgun_boot.ttf Handle ID: 0x7dc Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-b..core-fonts-jpn-boot_31bf3856ad364e35_10.0.26100.5059_none_250d855ed994558f\meiryon_boot.ttf Handle ID: 0xbd8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-b..core-fonts-jpn-boot_31bf3856ad364e35_10.0.26100.5059_none_250d855ed994558f\meiryo_boot.ttf Handle ID: 0xab0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-b..core-fonts-cht-boot_31bf3856ad364e35_10.0.26100.5059_none_5a077db9d8ff27d8\msjhn_boot.ttf Handle ID: 0xba8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-b..core-fonts-cht-boot_31bf3856ad364e35_10.0.26100.5059_none_5a077db9d8ff27d8\msjh_boot.ttf Handle ID: 0x10b0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-b..core-fonts-eng-boot_31bf3856ad364e35_10.0.26100.5059_none_e08476b75e1554d9\segmono_boot.ttf Handle ID: 0xf94 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-b..core-fonts-chs-boot_31bf3856ad364e35_10.0.26100.5059_none_70d518f1bf57d939\msyhn_boot.ttf Handle ID: 0x720 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-b..core-fonts-chs-boot_31bf3856ad364e35_10.0.26100.5059_none_70d518f1bf57d939\msyh_boot.ttf Handle ID: 0xf30 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-b..core-fonts-eng-boot_31bf3856ad364e35_10.0.26100.5059_none_e08476b75e1554d9\segoen_slboot.ttf Handle ID: 0xb58 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-b..core-fonts-eng-boot_31bf3856ad364e35_10.0.26100.5059_none_e08476b75e1554d9\wgl4_boot.ttf Handle ID: 0x1124 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-b..core-fonts-eng-boot_31bf3856ad364e35_10.0.26100.5059_none_e08476b75e1554d9\segoe_slboot.ttf Handle ID: 0x740 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-b..core-fonts-jpn-boot_31bf3856ad364e35_10.0.26100.5059_none_250d855ed994558f\jpn_boot.ttf Handle ID: 0x77c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-b..ore-bootmanager-efi_31bf3856ad364e35_10.0.26100.5059_none_237243ca4c4282ef\bootmgfw_EX.efi Handle ID: 0xa80 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-b..core-fonts-jpn-boot_31bf3856ad364e35_10.0.26100.5059_none_250d855ed994558f\jpn_boot_EX.ttf Handle ID: 0x11cc Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-b..core-fonts-kor-boot_31bf3856ad364e35_10.0.26100.5059_none_f6b8db3e450333f1\malgunn_boot_EX.ttf Handle ID: 0xc94 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-b..core-fonts-kor-boot_31bf3856ad364e35_10.0.26100.5059_none_f6b8db3e450333f1\malgun_boot_EX.ttf Handle ID: 0xaa4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-b..core-fonts-chs-boot_31bf3856ad364e35_10.0.26100.5059_none_70d518f1bf57d939\chs_boot.ttf Handle ID: 0x110c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-b..core-fonts-jpn-boot_31bf3856ad364e35_10.0.26100.5059_none_250d855ed994558f\meiryon_boot_EX.ttf Handle ID: 0x5cc Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-b..core-fonts-cht-boot_31bf3856ad364e35_10.0.26100.5059_none_5a077db9d8ff27d8\cht_boot.ttf Handle ID: 0xff0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-b..core-fonts-jpn-boot_31bf3856ad364e35_10.0.26100.5059_none_250d855ed994558f\meiryo_boot_EX.ttf Handle ID: 0x11ec Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-b..core-fonts-kor-boot_31bf3856ad364e35_10.0.26100.5059_none_f6b8db3e450333f1\kor_boot.ttf Handle ID: 0xbe8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-b..core-fonts-eng-boot_31bf3856ad364e35_10.0.26100.5059_none_e08476b75e1554d9\segmono_boot_EX.ttf Handle ID: 0x11b4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-b..core-fonts-cht-boot_31bf3856ad364e35_10.0.26100.5059_none_5a077db9d8ff27d8\msjhn_boot_EX.ttf Handle ID: 0x1164 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-b..core-fonts-cht-boot_31bf3856ad364e35_10.0.26100.5059_none_5a077db9d8ff27d8\msjh_boot_EX.ttf Handle ID: 0xfe0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-b..core-fonts-chs-boot_31bf3856ad364e35_10.0.26100.5059_none_70d518f1bf57d939\msyhn_boot_EX.ttf Handle ID: 0x1008 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-b..core-fonts-eng-boot_31bf3856ad364e35_10.0.26100.5059_none_e08476b75e1554d9\segoen_slboot_EX.ttf Handle ID: 0x1060 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-b..core-fonts-eng-boot_31bf3856ad364e35_10.0.26100.5059_none_e08476b75e1554d9\segoe_slboot_EX.ttf Handle ID: 0xe88 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-b..core-fonts-chs-boot_31bf3856ad364e35_10.0.26100.5059_none_70d518f1bf57d939\msyh_boot_EX.ttf Handle ID: 0xd84 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-b..core-fonts-eng-boot_31bf3856ad364e35_10.0.26100.5059_none_e08476b75e1554d9\wgl4_boot_EX.ttf Handle ID: 0xff4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\Language-00816435615F13A79DE24CE5C46EEED13BDFDEDAEAE45D3C267FE08B3031EC33~31bf3856ad364e35~amd64~en-US~10.0.26100.5059.mum Handle ID: 0x858 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\Language-1D7BB005245F5C4AC6BF127D978669E269FA8D374A5A36899D9F4EA813E3D532~31bf3856ad364e35~amd64~en-US~10.0.26100.5059.mum Handle ID: 0xb44 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Language-00816435615F13A79DE24CE5C46EEED13BDFDEDAEAE45D3C267FE08B3031EC33~31bf3856ad364e35~amd64~en-US~10.0.26100.5059.cat Handle ID: 0x760 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\Language-BAEE1F89655E17706CD0A5CE9571203942067DEFE16E854A9A9E66F27A214405~31bf3856ad364e35~amd64~en-US~10.0.26100.5059.mum Handle ID: 0x9dc Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\Language-E62E8E856BC935800E7D55FFF1DE080FECFDFC9F1C5E6CF4FB15DE93FCA964D8~31bf3856ad364e35~amd64~en-US~10.0.26100.5059.mum Handle ID: 0xcf0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Language-E62E8E856BC935800E7D55FFF1DE080FECFDFC9F1C5E6CF4FB15DE93FCA964D8~31bf3856ad364e35~amd64~en-US~10.0.26100.5059.cat Handle ID: 0xe40 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\Microsoft-Windows-Ge-Client-Server-26200-Version-Enablement-Package~31bf3856ad364e35~amd64~~10.0.26100.5503.mum Handle ID: 0xc10 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\Microsoft-Windows-Ge-Client-Server-26200-Version-Enablement-Payload-Package~31bf3856ad364e35~amd64~~10.0.26100.5503.mum Handle ID: 0x7d0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Ge-Client-Server-26200-Version-Enablement-Package~31bf3856ad364e35~amd64~~10.0.26100.5503.cat Handle ID: 0x71c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-b..core-fonts-cht-boot_31bf3856ad364e35_10.0.26100.5059_none_5a077db9d8ff27d8\cht_boot_EX.ttf Handle ID: 0x750 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-b..core-fonts-chs-boot_31bf3856ad364e35_10.0.26100.5059_none_70d518f1bf57d939\chs_boot_EX.ttf Handle ID: 0x978 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\Package-0ADD83C089AC5184A9C44B662FFDFECDE4811389BC9B5ED7388761E5107E2579~31bf3856ad364e35~amd64~~10.0.26100.5059.mum Handle ID: 0xf5c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\Package-40EF8EC574B3B4235FABD6555DDCB057CB8A7A5D1DFA51FBC66C5024800C70F0~31bf3856ad364e35~amd64~~10.0.26100.5059.mum Handle ID: 0x8dc Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\Package-51D318826FA91389900D0D7699B2BB45565E45B3182265C5F0F1B3E000C94D3A~31bf3856ad364e35~amd64~~10.0.26100.5059.mum Handle ID: 0x10b8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\Package-55BA3732A20872FF989A6CF310F9DFE2CAAEB931A81CF74B16C7F76AAF4684F5~31bf3856ad364e35~amd64~en-US~10.0.26100.5059.mum Handle ID: 0x948 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\Package-8098005153239E21CE7139456A12C6C423AB350540B9FC813CFB3FA1B32031DF~31bf3856ad364e35~amd64~en-US~10.0.26100.5059.mum Handle ID: 0x704 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\Package-8ADA81636E71B6B6E9EC41ABB39809449262728839513A997473F8D555DF3159~31bf3856ad364e35~amd64~en-US~10.0.26100.5059.mum Handle ID: 0x9bc Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\Package-9BF398C92405870DBFEEFC4055260B1446387F317E14A6BBF7B8B7E3205C14E2~31bf3856ad364e35~amd64~en-US~10.0.26100.5059.mum Handle ID: 0xa6c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\Package-A3E79A8A0C116175C30E0F02A1DFB79477E3D031CA2D74C6077B9220B12A7B6C~31bf3856ad364e35~amd64~~10.0.26100.5059.mum Handle ID: 0x900 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\Package-C7EFF55C42B2F199027F1BF592B677CDECA14065296969A3E4BD06949203E0E1~31bf3856ad364e35~amd64~~10.0.26100.5059.mum Handle ID: 0xd34 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\Package-CEA7105E5168DA9342892833403E0C075AD33DF172ECE6F948FB257B39FA8EE9~31bf3856ad364e35~amd64~~10.0.26100.5059.mum Handle ID: 0xf00 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\Package-F1E6C66AC7D3E46AFA5EDE98971587DA5F9934A1429416E6F68FA909FD980683~31bf3856ad364e35~amd64~~10.0.26100.5059.mum Handle ID: 0xfc0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\Package_for_KB5054156~31bf3856ad364e35~amd64~~26100.5503.1.1.mum Handle ID: 0x1004 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Package_for_KB5054156~31bf3856ad364e35~amd64~~26100.5503.1.1.cat Handle ID: 0xa30 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Package_for_SafeOSDU~31bf3856ad364e35~amd64~~26100.5059.1.3.cat Handle ID: 0xe1c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\Shared-1E0DCC26E09F94713110E58A9FCF8110E95E5D2A4AF36FEDCB5292DA07BA15ED~31bf3856ad364e35~amd64~~10.0.26100.5074.mum Handle ID: 0xa0c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Package_for_ServicingStack_5074~31bf3856ad364e35~amd64~~26100.5074.1.7.cat Handle ID: 0xbbc Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\Package_for_SafeOSDU~31bf3856ad364e35~amd64~~26100.5059.1.3.mum Handle ID: 0xba4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\Package_for_ServicingStack_5074~31bf3856ad364e35~amd64~~26100.5074.1.7.mum Handle ID: 0x118c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\Shared-C35C451B528AC523A573769E54593A7712C82C99A3FBCECB2C0D02A3B8BD10B1~31bf3856ad364e35~amd64~~10.0.26100.5059.mum Handle ID: 0x1198 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\Wrapper-4085F963BF5ECF2BE5315156F62F60707D2A70EC24B5453B46570F752012A7C3~31bf3856ad364e35~amd64~~10.0.26100.5074.mum Handle ID: 0x970 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Wrapper-4085F963BF5ECF2BE5315156F62F60707D2A70EC24B5453B46570F752012A7C3~31bf3856ad364e35~amd64~~10.0.26100.5074.cat Handle ID: 0xbe4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Wrapper-661FDBF43BA4922DE63CF3C72A3D5E981E58E152A0176283AEDFA66872B24A92~31bf3856ad364e35~amd64~~10.0.26100.5059.cat Handle ID: 0xe10 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Wrapper-C847039CF8F6C1127DECBFFE0D47F59830091D00B0BBD0D8CCC6B5457B84A7CF~31bf3856ad364e35~amd64~~10.0.26100.5059.cat Handle ID: 0x990 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\Wrapper-661FDBF43BA4922DE63CF3C72A3D5E981E58E152A0176283AEDFA66872B24A92~31bf3856ad364e35~amd64~~10.0.26100.5059.mum Handle ID: 0x74c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\Wrapper-96382338A5225D2BF8309DA8392FA6A1512BB739DD40FC20E1606E40778298D3~31bf3856ad364e35~amd64~~10.0.26100.5059.mum Handle ID: 0x964 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\Wrapper-C847039CF8F6C1127DECBFFE0D47F59830091D00B0BBD0D8CCC6B5457B84A7CF~31bf3856ad364e35~amd64~~10.0.26100.5059.mum Handle ID: 0x7fc Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Wrapper-EBACE71981A2048680937CD1C82D41DF6CF85FC8F9FEDDE2935E227BC625AC7F~31bf3856ad364e35~amd64~~10.0.26100.5059.cat Handle ID: 0xeb8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\Wrapper-AE48F4500838F08A8E41A789B132000FD27A4816FF0CCF22309DECBD89FF7E17~31bf3856ad364e35~amd64~~10.0.26100.5059.mum Handle ID: 0xa58 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\Wrapper-EBACE71981A2048680937CD1C82D41DF6CF85FC8F9FEDDE2935E227BC625AC7F~31bf3856ad364e35~amd64~~10.0.26100.5059.mum Handle ID: 0x9c4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-b..core-fonts-kor-boot_31bf3856ad364e35_10.0.26100.5059_none_f6b8db3e450333f1\kor_boot_EX.ttf Handle ID: 0xa5c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-bcrypt-dll_31bf3856ad364e35_10.0.26100.5059_none_8a7dee5f9f485066\bcrypt.dll Handle ID: 0xcc4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-apisetschema-windows_31bf3856ad364e35_10.0.26100.5059_none_c61dea7b0a8ccfda\apisetschema.dll Handle ID: 0x7c0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-bootmenuux_31bf3856ad364e35_10.0.26100.5059_none_90d2ef9ac5408d13\BootMenuUX.dll Handle ID: 0x1a8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-winre-tools_31bf3856ad364e35_10.0.26100.5059_none_65eef8a71ff4d806\BootRec.exe Handle ID: 0xab0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-winre-cloudrec_31bf3856ad364e35_10.0.26100.5059_none_e2e36b16885a70f2\CloudRecApi.dll Handle ID: 0xbd8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-winre-cloudrec_31bf3856ad364e35_10.0.26100.5059_none_e2e36b16885a70f2\CloudRecSvc.exe Handle ID: 0x7dc Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-cryptbase_31bf3856ad364e35_10.0.26100.5059_none_0157306b5ddc9f0c\cryptbase.dll Handle ID: 0x8ec Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-lddmcore_31bf3856ad364e35_10.0.26100.5059_none_47b9f391936f6d53\cdd.dll Handle ID: 0xa04 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-cryptsp-dll_31bf3856ad364e35_10.0.26100.5059_none_c54ec8ffb6af2a3f\cryptsp.dll Handle ID: 0x124c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..dsetup-rejuvenation_31bf3856ad364e35_10.0.26100.5059_none_ee8a7a91c09e45ad\AppExtAgent.dll Handle ID: 0x888 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-bcrypt-primitives-dll_31bf3856ad364e35_10.0.26100.5059_none_ae22d457c6ecf4b3\bcryptprimitives.dll Handle ID: 0xa68 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..dsetup-rejuvenation_31bf3856ad364e35_10.0.26100.5059_none_ee8a7a91c09e45ad\cmi2migxml.dll Handle ID: 0x8a8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-dhcp-client-dll-minwin_31bf3856ad364e35_10.0.26100.5059_none_08e60c8108ed5ff6\dhcpcsvc.dll Handle ID: 0x77c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-dhcp-client-dll-minwin_31bf3856ad364e35_10.0.26100.5059_none_08e60c8108ed5ff6\dhcpcsvc6.dll Handle ID: 0x740 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..dsetup-rejuvenation_31bf3856ad364e35_10.0.26100.5059_none_ee8a7a91c09e45ad\diagER.dll Handle ID: 0x1124 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-telemetrypermission_31bf3856ad364e35_10.0.26100.5059_none_8b2e5dd6c455cc4f\DiagnosticDataSettings.dll Handle ID: 0xf30 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-dhcp-client-dll-minwin_31bf3856ad364e35_10.0.26100.5059_none_08e60c8108ed5ff6\dhcpcore6.dll Handle ID: 0xb58 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-update-ducsps_31bf3856ad364e35_10.0.26100.5059_none_68831e3aed40822b\DuCsps.dll Handle ID: 0x720 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-dhcp-client-dll-minwin_31bf3856ad364e35_10.0.26100.5059_none_08e60c8108ed5ff6\dhcpcore.dll Handle ID: 0xc94 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-codeintegrity_31bf3856ad364e35_10.0.26100.5059_none_3c694c30b4a28c1d\ci.dll Handle ID: 0x718 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..dsetup-rejuvenation_31bf3856ad364e35_10.0.26100.5059_none_ee8a7a91c09e45ad\hwcompat.dll Handle ID: 0x5cc Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-errorreportingfaults_31bf3856ad364e35_10.0.26100.5059_none_0bf87794ecabf910\Faultrep.dll Handle ID: 0x110c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..dsetup-rejuvenation_31bf3856ad364e35_10.0.26100.5059_none_ee8a7a91c09e45ad\csiagent.dll Handle ID: 0xaa4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-security-kerberos_31bf3856ad364e35_10.0.26100.5059_none_82c8381e60b037cf\kerb3961.dll Handle ID: 0x11cc Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-s..ty-kerbclientshared_31bf3856ad364e35_10.0.26100.5059_none_7dea0da26bd1f4f6\KerbClientShared.dll Handle ID: 0x1008 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-securestartup-core_31bf3856ad364e35_10.0.26100.5059_none_d0cc00dba201a0a9\fveapibase.dll Handle ID: 0xfe0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-onecore-u..latform-facilitator_31bf3856ad364e35_10.0.26100.5059_none_2e598c9710ce6160\Facilitator.dll Handle ID: 0x1164 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-securestartup-core_31bf3856ad364e35_10.0.26100.5059_none_d0cc00dba201a0a9\fveapi.dll Handle ID: 0xd84 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..dsetup-rejuvenation_31bf3856ad364e35_10.0.26100.5059_none_ee8a7a91c09e45ad\migisol.dll Handle ID: 0xff4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..dsetup-rejuvenation_31bf3856ad364e35_10.0.26100.5059_none_ee8a7a91c09e45ad\migres.dll Handle ID: 0x11b4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..dsetup-rejuvenation_31bf3856ad364e35_10.0.26100.5059_none_ee8a7a91c09e45ad\mighost.exe Handle ID: 0xbe8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-security-kerberos_31bf3856ad364e35_10.0.26100.5059_none_82c8381e60b037cf\localkdcsvc.dll Handle ID: 0x968 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-msasn1_31bf3856ad364e35_10.0.26100.5059_none_634b70bd55440b02\msasn1.dll Handle ID: 0xe88 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-security-kerberos_31bf3856ad364e35_10.0.26100.5059_none_82c8381e60b037cf\kerberos.dll Handle ID: 0x1060 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..dsetup-rejuvenation_31bf3856ad364e35_10.0.26100.5059_none_ee8a7a91c09e45ad\migsys.dll Handle ID: 0xb0c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-ucrt_31bf3856ad364e35_10.0.26100.5059_none_47b29039c962915f\msvcp_win.dll Handle ID: 0x1014 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..dsetup-rejuvenation_31bf3856ad364e35_10.0.26100.5059_none_ee8a7a91c09e45ad\hwcompat.txt Handle ID: 0x9dc Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-msvcrt_31bf3856ad364e35_10.0.26100.5059_none_6d4691134ec8c584\msvcrt.dll Handle ID: 0x760 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-networkprofile_31bf3856ad364e35_10.0.26100.5059_none_148cac4d26086fac\nlaapi.dll Handle ID: 0x9f0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..dsetup-rejuvenation_31bf3856ad364e35_10.0.26100.5059_none_ee8a7a91c09e45ad\MXEAgent.dll Handle ID: 0xcf8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-networkprofile_31bf3856ad364e35_10.0.26100.5059_none_148cac4d26086fac\nlmproxy.dll Handle ID: 0xf84 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-networkprofile_31bf3856ad364e35_10.0.26100.5059_none_148cac4d26086fac\nlmsprep.dll Handle ID: 0xd80 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-usermodensi_31bf3856ad364e35_10.0.26100.5059_none_0e537dd277568879\nsi.dll Handle ID: 0xcf0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-usermodensi_31bf3856ad364e35_10.0.26100.5059_none_0e537dd277568879\nsisvc.dll Handle ID: 0xd6c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-security-ntlmshared_31bf3856ad364e35_10.0.26100.5059_none_59494e6b2188a912\NtlmShared.dll Handle ID: 0xb44 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..dsetup-rejuvenation_31bf3856ad364e35_10.0.26100.5059_none_ee8a7a91c09e45ad\migstore.dll Handle ID: 0x858 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..dsetup-rejuvenation_31bf3856ad364e35_10.0.26100.5059_none_ee8a7a91c09e45ad\offline.xml Handle ID: 0x11ec Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..dsetup-rejuvenation_31bf3856ad364e35_10.0.26100.5059_none_ee8a7a91c09e45ad\pnppropmig.dll Handle ID: 0xff0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-networkprofile_31bf3856ad364e35_10.0.26100.5059_none_148cac4d26086fac\ncsi.dll Handle ID: 0xf94 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.5074_none_a5532eb7772ad4c4\poqexec.exe Handle ID: 0x11d4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-winre-recoveryagent_31bf3856ad364e35_10.0.26100.5059_none_56bdf8d71fc621df\ReInfo.dll Handle ID: 0xe40 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-b..ux-winre.deployment_31bf3856ad364e35_10.0.26100.5059_none_027184adf0d45fed\bootux.dll Handle ID: 0x750 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-winre-recoveryagent_31bf3856ad364e35_10.0.26100.5059_none_56bdf8d71fc621df\ReAgent.dll Handle ID: 0x86c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-sysreset_31bf3856ad364e35_10.0.26100.5059_none_d81376042e59a095\ResetEngine.exe Handle ID: 0xfa4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-sysreset_31bf3856ad364e35_10.0.26100.5059_none_d81376042e59a095\ResetPluginHost.exe Handle ID: 0x122c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..dsetup-rejuvenation_31bf3856ad364e35_10.0.26100.5059_none_ee8a7a91c09e45ad\ReserveManager.dll Handle ID: 0x10e8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-networkprofile_31bf3856ad364e35_10.0.26100.5059_none_148cac4d26086fac\netprofmsvc.dll Handle ID: 0x1108 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-sysreset_31bf3856ad364e35_10.0.26100.5059_none_d81376042e59a095\ResetTelemetry.dll Handle ID: 0x948 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-ntdll_31bf3856ad364e35_10.0.26100.5059_none_f4c83934ac1053ed\ntdll.dll Handle ID: 0x704 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-kernelbase_31bf3856ad364e35_10.0.26100.5059_none_c2f3d3466476b871\KernelBase.dll Handle ID: 0xcb0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..dsetup-rejuvenation_31bf3856ad364e35_10.0.26100.5059_none_ee8a7a91c09e45ad\setupplatform.exe Handle ID: 0x8dc Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-cryptography-symcrypt_31bf3856ad364e35_10.0.26100.5059_none_afc0b0e68c37fb83\symcryptk.dll Handle ID: 0xf5c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-sechost_31bf3856ad364e35_10.0.26100.5059_none_23b437d07cd8de96\sechost.dll Handle ID: 0x70c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-tpm-tbs_31bf3856ad364e35_10.0.26100.5059_none_8aa92fe82836f5fe\tbs.dll Handle ID: 0x978 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-rpc-local_31bf3856ad364e35_10.0.26100.5059_none_4febfa09f4f6f736\rpcrt4.dll Handle ID: 0x10b8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-servicingcommon_31bf3856ad364e35_10.0.26100.5059_none_d74e7df2cbc14912\ServicingCommon.dll Handle ID: 0x10b0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-sysreset_31bf3856ad364e35_10.0.26100.5059_none_d81376042e59a095\sysreset.exe Handle ID: 0xba8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..dsetup-rejuvenation_31bf3856ad364e35_10.0.26100.5059_none_ee8a7a91c09e45ad\upgrade_bulk.xml Handle ID: 0xa6c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-update-orchestratorapi_31bf3856ad364e35_10.0.26100.5059_none_d59cf9e1f818d727\usoapi.dll Handle ID: 0x9bc Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-update-usocoreps_31bf3856ad364e35_10.0.26100.5059_none_d411732e9dd076ec\usocoreps.dll Handle ID: 0xeac Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-u..-orchestratordocked_31bf3856ad364e35_10.0.26100.5059_none_aa2232db2c4b5cfd\usodocked.dll Handle ID: 0x62c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..dsetup-rejuvenation_31bf3856ad364e35_10.0.26100.5059_none_ee8a7a91c09e45ad\unbcl.dll Handle ID: 0xd38 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-u..te-orchestratorcore_31bf3856ad364e35_10.0.26100.5059_none_22c3ae983455c3ee\usosvc.dll Handle ID: 0x72c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-ucrt_31bf3856ad364e35_10.0.26100.5059_none_47b29039c962915f\ucrtbase.dll Handle ID: 0xe0c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.26100.5059_none_635635a330fcf5b2\ucrtbase.dll Handle ID: 0xf00 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-errorreportingcore_31bf3856ad364e35_10.0.26100.5059_none_bc680d08b5c6e3c0\werdiagcontroller.dll Handle ID: 0xd34 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-errorreportingfaults_31bf3856ad364e35_10.0.26100.5059_none_0bf87794ecabf910\WerEnc.dll Handle ID: 0xae8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..dsetup-rejuvenation_31bf3856ad364e35_10.0.26100.5059_none_ee8a7a91c09e45ad\wdsutil.dll Handle ID: 0x98c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-errorreportingcore_31bf3856ad364e35_10.0.26100.5059_none_bc680d08b5c6e3c0\weretw.dll Handle ID: 0x11e4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-sysreset_31bf3856ad364e35_10.0.26100.5059_none_d81376042e59a095\ResetEngine.dll Handle ID: 0xe50 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-errorreportingfaults_31bf3856ad364e35_10.0.26100.5059_none_0bf87794ecabf910\WerFaultSecure.exe Handle ID: 0x778 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-errorreportingfaults_31bf3856ad364e35_10.0.26100.5059_none_0bf87794ecabf910\WerFault.exe Handle ID: 0xb84 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-errorreportingcore_31bf3856ad364e35_10.0.26100.5059_none_bc680d08b5c6e3c0\wer.dll Handle ID: 0x928 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-errorreportingcore_31bf3856ad364e35_10.0.26100.5059_none_bc680d08b5c6e3c0\wermgr.exe Handle ID: 0xa2c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-win32kbasers_31bf3856ad364e35_10.0.26100.5059_none_8c454f5cd78aa039\win32kbase_rs.sys Handle ID: 0xefc Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-win32k_31bf3856ad364e35_10.0.26100.5059_none_54e4d4ad4a697197\win32u.dll Handle ID: 0x7d0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-update-winrt_31bf3856ad364e35_10.0.26100.5059_none_b9bf37b1b23da303\Windows.Management.Update.dll Handle ID: 0xc10 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-win32k_31bf3856ad364e35_10.0.26100.5059_none_54e4d4ad4a697197\win32k.sys Handle ID: 0x6e4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..dsetup-rejuvenation_31bf3856ad364e35_10.0.26100.5059_none_ee8a7a91c09e45ad\upgradeagent.dll Handle ID: 0xcd0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-usermodensi_31bf3856ad364e35_10.0.26100.5059_none_0e537dd277568879\winnsi.dll Handle ID: 0x118c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-winpe_tools_31bf3856ad364e35_10.0.26100.5059_none_96f0fdd3e6c27276\winpeshl.exe Handle ID: 0xba4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-winre-tools_31bf3856ad364e35_10.0.26100.5059_none_65eef8a71ff4d806\WinSetupBak.hiv Handle ID: 0x1198 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-winre-tools_31bf3856ad364e35_10.0.26100.5059_none_65eef8a71ff4d806\WinSetupBak.sys Handle ID: 0x1030 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..dsetup-rejuvenation_31bf3856ad364e35_10.0.26100.5059_none_ee8a7a91c09e45ad\WinSetupMon.hiv Handle ID: 0xfd8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-b..vironment-os-loader_31bf3856ad364e35_10.0.26100.5059_none_f71815251c89881f\winload.exe Handle ID: 0x10d4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-winpe_tools_31bf3856ad364e35_10.0.26100.5059_none_96f0fdd3e6c27276\wpeinit.exe Handle ID: 0x950 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..dsetup-rejuvenation_31bf3856ad364e35_10.0.26100.5059_none_ee8a7a91c09e45ad\WinSetupMon.sys Handle ID: 0xdec Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-winpe_tools_31bf3856ad364e35_10.0.26100.5059_none_96f0fdd3e6c27276\wpeutil.exe Handle ID: 0x850 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-winpe_tools_31bf3856ad364e35_10.0.26100.5059_none_96f0fdd3e6c27276\wpeutil.dll Handle ID: 0xdcc Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-win32kbase_31bf3856ad364e35_10.0.26100.5059_none_4a67a0bb16a00466\win32kbase.sys Handle ID: 0x74c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-b..vironment-os-loader_31bf3856ad364e35_10.0.26100.5059_none_f71815251c89881f\winload.efi Handle ID: 0x990 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-w..nfrastructure-ws232_31bf3856ad364e35_10.0.26100.5059_none_8ea90bb57e38ad9b\ws2_32.dll Handle ID: 0xe10 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-codeintegrity_31bf3856ad364e35_10.0.26100.5059_none_3c694c30b4a28c1d\previous.driver.stl Handle ID: 0xbe4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-codeintegrity_31bf3856ad364e35_10.0.26100.5059_none_3c694c30b4a28c1d\driver.stl Handle ID: 0x11ac Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-c..egrity-driverpolicy_31bf3856ad364e35_10.0.26100.5059_none_5027585793f3d626\driversipolicy.p7b Handle ID: 0x748 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-win32k_31bf3856ad364e35_10.0.26100.5059_none_54e4d4ad4a697197\win32kfull.sys Handle ID: 0x7fc Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..dsetup-rejuvenation_31bf3856ad364e35_10.0.26100.5059_none_ee8a7a91c09e45ad\migcore.dll Handle ID: 0x1188 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-d..ing-management-core_31bf3856ad364e35_10.0.26100.5059_none_c72580f7daa1c30b\DismCore.dll Handle ID: 0xbd8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-d..ing-management-core_31bf3856ad364e35_10.0.26100.5059_none_c72580f7daa1c30b\DismCorePS.dll Handle ID: 0xab0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-d..ing-management-core_31bf3856ad364e35_10.0.26100.5059_none_c72580f7daa1c30b\DismProv.dll Handle ID: 0x1a8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-d..ing-management-core_31bf3856ad364e35_10.0.26100.5059_none_c72580f7daa1c30b\FolderProvider.dll Handle ID: 0x7c0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-winre-tools_31bf3856ad364e35_10.0.26100.5059_none_65eef8a71ff4d806\DUTProvider.dll Handle ID: 0xcc4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-winre-tools.resources_31bf3856ad364e35_10.0.26100.5059_en-us_1c582dec78d426dd\DUTProvider.dll.mui Handle ID: 0x8a8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.26100.5059_none_635635a330fcf5b2\api-ms-win-core-comm-l1-1-0.dll Handle ID: 0xa68 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-d..ing-management-core_31bf3856ad364e35_10.0.26100.5059_none_c72580f7daa1c30b\LogProvider.dll Handle ID: 0x740 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.26100.5059_none_635635a330fcf5b2\api-ms-win-core-console-l1-1-0.dll Handle ID: 0x77c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.26100.5059_none_635635a330fcf5b2\api-ms-win-core-datetime-l1-1-0.dll Handle ID: 0x888 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.26100.5059_none_635635a330fcf5b2\api-ms-win-core-datetime-l1-1-1.dll Handle ID: 0x124c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.26100.5059_none_635635a330fcf5b2\api-ms-win-core-debug-l1-1-0.dll Handle ID: 0xf30 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.26100.5059_none_635635a330fcf5b2\api-ms-win-core-debug-l1-1-1.dll Handle ID: 0x720 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.26100.5059_none_635635a330fcf5b2\api-ms-win-core-delayload-l1-1-0.dll Handle ID: 0xb58 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.26100.5059_none_635635a330fcf5b2\api-ms-win-core-errorhandling-l1-1-0.dll Handle ID: 0xa80 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.26100.5059_none_635635a330fcf5b2\api-ms-win-core-errorhandling-l1-1-1.dll Handle ID: 0x1124 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.26100.5059_none_635635a330fcf5b2\api-ms-win-core-fibers-l1-1-0.dll Handle ID: 0xa04 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.26100.5059_none_635635a330fcf5b2\api-ms-win-core-fibers-l1-1-1.dll Handle ID: 0x8ec Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.26100.5059_none_635635a330fcf5b2\api-ms-win-core-file-l1-1-0.dll Handle ID: 0x110c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.26100.5059_none_635635a330fcf5b2\api-ms-win-core-file-l1-2-0.dll Handle ID: 0x7dc Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.26100.5059_none_635635a330fcf5b2\api-ms-win-core-file-l1-2-1.dll Handle ID: 0x964 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.26100.5059_none_635635a330fcf5b2\api-ms-win-core-handle-l1-1-0.dll Handle ID: 0x5cc Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.26100.5059_none_635635a330fcf5b2\api-ms-win-core-heap-l1-1-0.dll Handle ID: 0x718 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.26100.5059_none_635635a330fcf5b2\api-ms-win-core-interlocked-l1-1-0.dll Handle ID: 0xc94 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.26100.5059_none_635635a330fcf5b2\api-ms-win-core-io-l1-1-0.dll Handle ID: 0x11b4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.26100.5059_none_635635a330fcf5b2\api-ms-win-core-io-l1-1-1.dll Handle ID: 0x840 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.26100.5059_none_635635a330fcf5b2\api-ms-win-core-libraryloader-l1-1-0.dll Handle ID: 0xe98 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.26100.5059_none_635635a330fcf5b2\api-ms-win-core-libraryloader-l1-1-1.dll Handle ID: 0xf44 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.26100.5059_none_635635a330fcf5b2\api-ms-win-core-localization-l1-2-0.dll Handle ID: 0x10f8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.26100.5059_none_635635a330fcf5b2\api-ms-win-core-localization-l1-2-1.dll Handle ID: 0xe6c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.26100.5059_none_635635a330fcf5b2\API-MS-Win-core-localization-obsolete-l1-2-0.dll Handle ID: 0xc30 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.26100.5059_none_635635a330fcf5b2\api-ms-win-core-memory-l1-1-0.dll Handle ID: 0xc3c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.26100.5059_none_635635a330fcf5b2\api-ms-win-core-memory-l1-1-1.dll Handle ID: 0xafc Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.26100.5059_none_635635a330fcf5b2\api-ms-win-core-memory-l1-1-2.dll Handle ID: 0x9f0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.26100.5059_none_635635a330fcf5b2\api-ms-win-core-namedpipe-l1-1-0.dll Handle ID: 0x760 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.26100.5059_none_635635a330fcf5b2\api-ms-win-core-processenvironment-l1-1-0.dll Handle ID: 0x9dc Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.26100.5059_none_635635a330fcf5b2\api-ms-win-core-processenvironment-l1-2-0.dll Handle ID: 0x1014 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.26100.5059_none_635635a330fcf5b2\api-ms-win-core-processthreads-l1-1-0.dll Handle ID: 0xcf0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.26100.5059_none_635635a330fcf5b2\api-ms-win-core-processthreads-l1-1-1.dll Handle ID: 0xd80 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.26100.5059_none_635635a330fcf5b2\api-ms-win-core-processthreads-l1-1-2.dll Handle ID: 0xcf8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.26100.5059_none_635635a330fcf5b2\api-ms-win-core-profile-l1-1-0.dll Handle ID: 0x1294 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.26100.5059_none_635635a330fcf5b2\api-ms-win-core-realtime-l1-1-0.dll Handle ID: 0xdd0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.26100.5059_none_635635a330fcf5b2\api-ms-win-core-registry-l1-1-0.dll Handle ID: 0xff0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.26100.5059_none_635635a330fcf5b2\api-ms-win-core-rtlsupport-l1-1-0.dll Handle ID: 0x11ec Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.26100.5059_none_635635a330fcf5b2\api-ms-win-core-string-l1-1-0.dll Handle ID: 0xf84 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.26100.5059_none_635635a330fcf5b2\api-ms-win-core-stringloader-l1-1-1.dll Handle ID: 0xc78 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.26100.5059_none_635635a330fcf5b2\api-ms-win-core-synch-l1-1-0.dll Handle ID: 0x750 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.26100.5059_none_635635a330fcf5b2\api-ms-win-core-synch-l1-2-0.dll Handle ID: 0x820 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.26100.5059_none_635635a330fcf5b2\api-ms-win-core-sysinfo-l1-1-0.dll Handle ID: 0x11d4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.26100.5059_none_635635a330fcf5b2\api-ms-win-core-sysinfo-l1-2-0.dll Handle ID: 0xf94 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.26100.5059_none_635635a330fcf5b2\api-ms-win-core-sysinfo-l1-2-1.dll Handle ID: 0xda8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.26100.5059_none_635635a330fcf5b2\api-ms-win-core-threadpool-l1-2-0.dll Handle ID: 0xdc0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.26100.5059_none_635635a330fcf5b2\api-ms-win-core-threadpool-legacy-l1-1-0.dll Handle ID: 0x948 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.26100.5059_none_635635a330fcf5b2\api-ms-win-core-threadpool-private-l1-1-0.dll Handle ID: 0x614 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.26100.5059_none_635635a330fcf5b2\api-ms-win-core-timezone-l1-1-0.dll Handle ID: 0x1108 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.26100.5059_none_635635a330fcf5b2\api-ms-win-core-util-l1-1-0.dll Handle ID: 0x10e8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.26100.5059_none_635635a330fcf5b2\api-ms-win-core-wow64-l1-1-0.dll Handle ID: 0xf5c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.26100.5059_none_635635a330fcf5b2\api-ms-win-core-xstate-l1-1-0.dll Handle ID: 0x8dc Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.26100.5059_none_635635a330fcf5b2\api-ms-win-crt-conio-l1-1-0.dll Handle ID: 0xcb0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.26100.5059_none_635635a330fcf5b2\api-ms-win-crt-environment-l1-1-0.dll Handle ID: 0xf68 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.26100.5059_none_635635a330fcf5b2\api-ms-win-crt-convert-l1-1-0.dll Handle ID: 0xba8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.26100.5059_none_635635a330fcf5b2\api-ms-win-crt-filesystem-l1-1-0.dll Handle ID: 0x10b8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.26100.5059_none_635635a330fcf5b2\api-ms-win-crt-heap-l1-1-0.dll Handle ID: 0x978 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.26100.5059_none_635635a330fcf5b2\api-ms-win-crt-locale-l1-1-0.dll Handle ID: 0x70c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.26100.5059_none_635635a330fcf5b2\api-ms-win-crt-math-l1-1-0.dll Handle ID: 0x122c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.26100.5059_none_635635a330fcf5b2\api-ms-win-crt-multibyte-l1-1-0.dll Handle ID: 0xa6c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.26100.5059_none_635635a330fcf5b2\api-ms-win-crt-process-l1-1-0.dll Handle ID: 0xae4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.26100.5059_none_635635a330fcf5b2\api-ms-win-crt-runtime-l1-1-0.dll Handle ID: 0xc5c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-os-kernel_31bf3856ad364e35_10.0.26100.5059_none_0821bc936405ba3f\ntoskrnl.exe Handle ID: 0x8f4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.26100.5059_none_635635a330fcf5b2\api-ms-win-crt-stdio-l1-1-0.dll Handle ID: 0xe28 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.26100.5059_none_635635a330fcf5b2\api-ms-win-crt-string-l1-1-0.dll Handle ID: 0xef4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.26100.5059_none_635635a330fcf5b2\api-ms-win-crt-time-l1-1-0.dll Handle ID: 0xb74 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.26100.5059_none_635635a330fcf5b2\api-ms-win-crt-utility-l1-1-0.dll Handle ID: 0xe20 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.26100.5059_none_635635a330fcf5b2\api-ms-win-crt-private-l1-1-0.dll Handle ID: 0x11e4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.26100.5059_none_635635a330fcf5b2\api-ms-win-service-core-l1-1-0.dll Handle ID: 0x778 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.26100.5059_none_635635a330fcf5b2\api-ms-win-security-base-l1-1-0.dll Handle ID: 0xe50 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.26100.5059_none_635635a330fcf5b2\api-ms-win-service-core-l1-1-1.dll Handle ID: 0x10dc Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.26100.5059_none_635635a330fcf5b2\api-ms-win-service-management-l1-1-0.dll Handle ID: 0xc08 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.26100.5059_none_635635a330fcf5b2\api-ms-win-service-management-l2-1-0.dll Handle ID: 0xc58 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.26100.5059_none_635635a330fcf5b2\api-ms-win-service-private-l1-1-0.dll Handle ID: 0xdc4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.26100.5059_none_635635a330fcf5b2\api-ms-win-service-private-l1-1-1.dll Handle ID: 0x7d0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.26100.5059_none_635635a330fcf5b2\api-ms-win-service-winsvc-l1-1-0.dll Handle ID: 0xe94 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_product-onecore__mi..tartup-filterdriver_31bf3856ad364e35_10.0.26100.5059_none_00d2b373e9ab4a2d\dumpfve.sys Handle ID: 0x10d0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-lddmcore_31bf3856ad364e35_10.0.26100.5059_none_47b9f391936f6d53\dxgmms1.sys Handle ID: 0xc90 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-filebasedwritefilter_31bf3856ad364e35_10.0.26100.5059_none_5a51ae79a05714ed\fbwf.sys Handle ID: 0x830 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-cng_31bf3856ad364e35_10.0.26100.5059_none_44dc80170aff9703\cng.sys Handle ID: 0xc10 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-lddmcore_31bf3856ad364e35_10.0.26100.5059_none_47b9f391936f6d53\dxgmms2.sys Handle ID: 0xba4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-tcpip-driver_31bf3856ad364e35_10.0.26100.5059_none_73e9e0a4671141ee\FWPKCLNT.SYS Handle ID: 0x118c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-usermodensi_31bf3856ad364e35_10.0.26100.5059_none_0e537dd277568879\nsiproxy.sys Handle ID: 0xcd0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-tpm-tbs_31bf3856ad364e35_10.0.26100.5059_none_8aa92fe82836f5fe\tbs.sys Handle ID: 0xefc Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_product-onecore__mi..tartup-filterdriver_31bf3856ad364e35_10.0.26100.5059_none_00d2b373e9ab4a2d\fvevol.sys Handle ID: 0xa2c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-tcpip-driver_31bf3856ad364e35_10.0.26100.5059_none_73e9e0a4671141ee\tcpipreg.sys Handle ID: 0x928 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-netio-infrastructure_31bf3856ad364e35_10.0.26100.5059_none_f28cc7c865302f36\netio.sys Handle ID: 0x98c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..dsetup-rejuvenation_31bf3856ad364e35_10.0.26100.5059_none_ee8a7a91c09e45ad\setupplatform.dll Handle ID: 0xd34 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-tcpip-driver.resources_31bf3856ad364e35_10.0.26100.5059_en-us_24f565477230ad59\tcpip.sys.mui Handle ID: 0xf00 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-winre-tools.resources_31bf3856ad364e35_10.0.26100.5059_en-us_1c582dec78d426dd\BootRec.exe.mui Handle ID: 0xe0c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-e..ingfaults.resources_31bf3856ad364e35_10.0.26100.5059_en-us_127dbabdde9ff0f5\faultrep.dll.mui Handle ID: 0x72c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-bootux-winre.resources_31bf3856ad364e35_10.0.26100.5059_en-us_da34a5c3eb7c77f3\bootux.dll.mui Handle ID: 0xd38 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..uvenation.resources_31bf3856ad364e35_10.0.26100.5059_en-us_dfd22be9fcf6b210\migres.dll.mui Handle ID: 0xfa4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-i..uvenation.resources_31bf3856ad364e35_10.0.26100.5059_en-us_dfd22be9fcf6b210\setupplatform.exe.mui Handle ID: 0x86c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-u..ratorcore.resources_31bf3856ad364e35_10.0.26100.5059_en-us_f2bdc870881fb239\usosvc.dll.mui Handle ID: 0x11ac Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-e..ingfaults.resources_31bf3856ad364e35_10.0.26100.5059_en-us_127dbabdde9ff0f5\WerFaultSecure.exe.mui Handle ID: 0xbe4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-winpe_tools.resources_31bf3856ad364e35_10.0.26100.5059_en-us_c1fdaeebb9e79751\winpeshl.exe.mui Handle ID: 0xe10 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-e..rtingcore.resources_31bf3856ad364e35_10.0.26100.5059_en-us_9f04e608e6af2fa9\wer.dll.mui Handle ID: 0xfdc Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-e..ingfaults.resources_31bf3856ad364e35_10.0.26100.5059_en-us_127dbabdde9ff0f5\WerFault.exe.mui Handle ID: 0x1070 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-winpe_tools.resources_31bf3856ad364e35_10.0.26100.5059_en-us_c1fdaeebb9e79751\wpeutil.dll.mui Handle ID: 0xe40 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\wow64_microsoft-windows-bcrypt-dll_31bf3856ad364e35_10.0.26100.5059_none_94d298b1d3a91261\bcrypt.dll Handle ID: 0x858 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\wow64_microsoft-windows-cryptsp-dll_31bf3856ad364e35_10.0.26100.5059_none_cfa37351eb0fec3a\cryptsp.dll Handle ID: 0x74c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\wow64_microsoft-windows-bcrypt-primitives-dll_31bf3856ad364e35_10.0.26100.5059_none_b8777ea9fb4db6ae\bcryptprimitives.dll Handle ID: 0xc18 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\wow64_microsoft-windows-dhcp-client-dll-minwin_31bf3856ad364e35_10.0.26100.5059_none_133ab6d33d4e21f1\dhcpcore.dll Handle ID: 0x1a8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\wow64_microsoft-windows-dhcp-client-dll-minwin_31bf3856ad364e35_10.0.26100.5059_none_133ab6d33d4e21f1\dhcpcsvc.dll Handle ID: 0xab0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\wow64_microsoft-windows-dhcp-client-dll-minwin_31bf3856ad364e35_10.0.26100.5059_none_133ab6d33d4e21f1\dhcpcore6.dll Handle ID: 0x8c4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\wow64_microsoft-windows-dhcp-client-dll-minwin_31bf3856ad364e35_10.0.26100.5059_none_133ab6d33d4e21f1\dhcpcsvc6.dll Handle ID: 0xbd8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\wow64_microsoft-windows-telemetrypermission_31bf3856ad364e35_10.0.26100.5059_none_95830828f8b68e4a\DiagnosticDataSettings.dll Handle ID: 0xd6c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\wow64_microsoft-windows-errorreportingfaults_31bf3856ad364e35_10.0.26100.5059_none_164d21e7210cbb0b\Faultrep.dll Handle ID: 0xb0c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\wow64_microsoft-windows-securestartup-core_31bf3856ad364e35_10.0.26100.5059_none_db20ab2dd66262a4\fveapibase.dll Handle ID: 0x1060 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\wow64_microsoft-windows-securestartup-core_31bf3856ad364e35_10.0.26100.5059_none_db20ab2dd66262a4\fveapi.dll Handle ID: 0x77c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\wow64_microsoft-windows-security-kerberos_31bf3856ad364e35_10.0.26100.5059_none_8d1ce2709510f9ca\kerb3961.dll Handle ID: 0x7c0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\wow64_microsoft-windows-s..ty-kerbclientshared_31bf3856ad364e35_10.0.26100.5059_none_883eb7f4a032b6f1\KerbClientShared.dll Handle ID: 0xdcc Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-tcpip-driver_31bf3856ad364e35_10.0.26100.5059_none_73e9e0a4671141ee\tcpip.sys Handle ID: 0x850 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\wow64_microsoft-windows-msasn1_31bf3856ad364e35_10.0.26100.5059_none_6da01b0f89a4ccfd\msasn1.dll Handle ID: 0x950 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-lddmcore_31bf3856ad364e35_10.0.26100.5059_none_47b9f391936f6d53\dxgkrnl.sys Handle ID: 0x740 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\wow64_microsoft-windows-usermodensi_31bf3856ad364e35_10.0.26100.5059_none_18a82824abb74a74\nsi.dll Handle ID: 0xa68 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\wow64_microsoft-windows-security-kerberos_31bf3856ad364e35_10.0.26100.5059_none_8d1ce2709510f9ca\kerberos.dll Handle ID: 0x8a8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\wow64_microsoft-windows-ucrt_31bf3856ad364e35_10.0.26100.5059_none_52073a8bfdc3535a\msvcp_win.dll Handle ID: 0xcc4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\wow64_microsoft-windows-security-ntlmshared_31bf3856ad364e35_10.0.26100.5059_none_639df8bd55e96b0d\NtlmShared.dll Handle ID: 0x1188 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\x86_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.5074_none_49349333becd638e\poqexec.exe Handle ID: 0x9e4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\wow64_microsoft-windows-errorreportingcore_31bf3856ad364e35_10.0.26100.5059_none_c6bcb75aea27a5bb\werdiagcontroller.dll Handle ID: 0x6c4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\wow64_microsoft-windows-servicingcommon_31bf3856ad364e35_10.0.26100.5059_none_e1a3284500220b0d\ServicingCommon.dll Handle ID: 0x5cc Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\wow64_microsoft-windows-errorreportingfaults_31bf3856ad364e35_10.0.26100.5059_none_164d21e7210cbb0b\WerEnc.dll Handle ID: 0x964 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\wow64_microsoft-windows-errorreportingcore_31bf3856ad364e35_10.0.26100.5059_none_c6bcb75aea27a5bb\weretw.dll Handle ID: 0x7dc Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\wow64_microsoft-windows-errorreportingfaults_31bf3856ad364e35_10.0.26100.5059_none_164d21e7210cbb0b\WerFaultSecure.exe Handle ID: 0xca4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\wow64_microsoft-windows-ucrt_31bf3856ad364e35_10.0.26100.5059_none_52073a8bfdc3535a\ucrtbase.dll Handle ID: 0x840 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\wow64_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.26100.5059_none_6daadff5655db7ad\ucrtbase.dll Handle ID: 0x110c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\wow64_microsoft-windows-win32k_31bf3856ad364e35_10.0.26100.5059_none_5f397eff7eca3392\win32u.dll Handle ID: 0x8ec Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\wow64_microsoft-windows-errorreportingfaults_31bf3856ad364e35_10.0.26100.5059_none_164d21e7210cbb0b\WerFault.exe Handle ID: 0xa04 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\wow64_microsoft-windows-usermodensi_31bf3856ad364e35_10.0.26100.5059_none_18a82824abb74a74\winnsi.dll Handle ID: 0x1124 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\wow64_microsoft-windows-errorreportingcore_31bf3856ad364e35_10.0.26100.5059_none_c6bcb75aea27a5bb\wermgr.exe Handle ID: 0xa80 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\wow64_microsoft-windows-errorreportingcore_31bf3856ad364e35_10.0.26100.5059_none_c6bcb75aea27a5bb\wer.dll Handle ID: 0xb58 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\wow64_microsoft-windows-d..ing-management-core_31bf3856ad364e35_10.0.26100.5059_none_d17a2b4a0f028506\DismCorePS.dll Handle ID: 0xc3c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\wow64_microsoft-windows-d..ing-management-core_31bf3856ad364e35_10.0.26100.5059_none_d17a2b4a0f028506\FolderProvider.dll Handle ID: 0xafc Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\wow64_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.26100.5059_none_6daadff5655db7ad\api-ms-win-core-comm-l1-1-0.dll Handle ID: 0x720 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\wow64_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.26100.5059_none_6daadff5655db7ad\api-ms-win-core-console-l1-1-0.dll Handle ID: 0xf30 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\wow64_microsoft-windows-d..ing-management-core_31bf3856ad364e35_10.0.26100.5059_none_d17a2b4a0f028506\LogProvider.dll Handle ID: 0x124c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\wow64_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.26100.5059_none_6daadff5655db7ad\api-ms-win-core-datetime-l1-1-0.dll Handle ID: 0x760 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\wow64_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.26100.5059_none_6daadff5655db7ad\api-ms-win-core-datetime-l1-1-1.dll Handle ID: 0x9dc Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\wow64_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.26100.5059_none_6daadff5655db7ad\api-ms-win-core-debug-l1-1-0.dll Handle ID: 0xf44 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\wow64_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.26100.5059_none_6daadff5655db7ad\api-ms-win-core-debug-l1-1-1.dll Handle ID: 0xe98 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\wow64_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.26100.5059_none_6daadff5655db7ad\api-ms-win-core-delayload-l1-1-0.dll Handle ID: 0xcf8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\wow64_microsoft-windows-d..ing-management-core_31bf3856ad364e35_10.0.26100.5059_none_d17a2b4a0f028506\DismProv.dll Handle ID: 0x9f0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\wow64_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.26100.5059_none_6daadff5655db7ad\api-ms-win-core-errorhandling-l1-1-0.dll Handle ID: 0xc30 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\wow64_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.26100.5059_none_6daadff5655db7ad\api-ms-win-core-errorhandling-l1-1-1.dll Handle ID: 0x11b4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\wow64_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.26100.5059_none_6daadff5655db7ad\api-ms-win-core-fibers-l1-1-0.dll Handle ID: 0xc94 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\wow64_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.26100.5059_none_6daadff5655db7ad\api-ms-win-core-fibers-l1-1-1.dll Handle ID: 0x718 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\wow64_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.26100.5059_none_6daadff5655db7ad\api-ms-win-core-file-l1-2-0.dll Handle ID: 0xf84 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\wow64_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.26100.5059_none_6daadff5655db7ad\api-ms-win-core-file-l1-2-1.dll Handle ID: 0x11ec Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\wow64_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.26100.5059_none_6daadff5655db7ad\api-ms-win-core-file-l1-1-0.dll Handle ID: 0x9bc Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\wow64_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.26100.5059_none_6daadff5655db7ad\api-ms-win-core-handle-l1-1-0.dll Handle ID: 0xff0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\wow64_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.26100.5059_none_6daadff5655db7ad\api-ms-win-core-heap-l1-1-0.dll Handle ID: 0x820 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\wow64_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.26100.5059_none_6daadff5655db7ad\api-ms-win-core-interlocked-l1-1-0.dll Handle ID: 0x750 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\wow64_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.26100.5059_none_6daadff5655db7ad\api-ms-win-core-io-l1-1-0.dll Handle ID: 0xf94 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\wow64_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.26100.5059_none_6daadff5655db7ad\api-ms-win-core-io-l1-1-1.dll Handle ID: 0x11d4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\wow64_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.26100.5059_none_6daadff5655db7ad\api-ms-win-core-libraryloader-l1-1-0.dll Handle ID: 0xc78 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\wow64_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.26100.5059_none_6daadff5655db7ad\api-ms-win-core-libraryloader-l1-1-1.dll Handle ID: 0xdd0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\wow64_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.26100.5059_none_6daadff5655db7ad\api-ms-win-core-localization-l1-2-0.dll Handle ID: 0xe6c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\wow64_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.26100.5059_none_6daadff5655db7ad\api-ms-win-core-localization-l1-2-1.dll Handle ID: 0x10f8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\wow64_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.26100.5059_none_6daadff5655db7ad\API-MS-Win-core-localization-obsolete-l1-2-0.dll Handle ID: 0x970 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\wow64_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.26100.5059_none_6daadff5655db7ad\api-ms-win-core-memory-l1-1-0.dll Handle ID: 0x10e8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\wow64_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.26100.5059_none_6daadff5655db7ad\api-ms-win-core-memory-l1-1-1.dll Handle ID: 0x1108 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\wow64_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.26100.5059_none_6daadff5655db7ad\api-ms-win-core-memory-l1-1-2.dll Handle ID: 0x1294 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\wow64_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.26100.5059_none_6daadff5655db7ad\api-ms-win-core-namedpipe-l1-1-0.dll Handle ID: 0xd80 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\wow64_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.26100.5059_none_6daadff5655db7ad\api-ms-win-core-processenvironment-l1-1-0.dll Handle ID: 0xcf0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\wow64_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.26100.5059_none_6daadff5655db7ad\api-ms-win-core-processenvironment-l1-2-0.dll Handle ID: 0xbec Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\wow64_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.26100.5059_none_6daadff5655db7ad\api-ms-win-core-processthreads-l1-1-0.dll Handle ID: 0x618 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\wow64_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.26100.5059_none_6daadff5655db7ad\api-ms-win-core-processthreads-l1-1-1.dll Handle ID: 0x10b8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\wow64_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.26100.5059_none_6daadff5655db7ad\api-ms-win-core-processthreads-l1-1-2.dll Handle ID: 0xba8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\wow64_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.26100.5059_none_6daadff5655db7ad\api-ms-win-core-profile-l1-1-0.dll Handle ID: 0x122c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\wow64_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.26100.5059_none_6daadff5655db7ad\api-ms-win-core-realtime-l1-1-0.dll Handle ID: 0x70c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\wow64_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.26100.5059_none_6daadff5655db7ad\api-ms-win-core-registry-l1-1-0.dll Handle ID: 0x978 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\wow64_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.26100.5059_none_6daadff5655db7ad\api-ms-win-core-rtlsupport-l1-1-0.dll Handle ID: 0x1014 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\wow64_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.26100.5059_none_6daadff5655db7ad\api-ms-win-core-string-l1-1-0.dll Handle ID: 0xf68 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\wow64_microsoft-windows-d..ing-management-core_31bf3856ad364e35_10.0.26100.5059_none_d17a2b4a0f028506\DismCore.dll Handle ID: 0xcb0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\wow64_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.26100.5059_none_6daadff5655db7ad\api-ms-win-core-stringloader-l1-1-1.dll Handle ID: 0x8dc Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\wow64_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.26100.5059_none_6daadff5655db7ad\api-ms-win-core-synch-l1-1-0.dll Handle ID: 0xf5c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\wow64_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.26100.5059_none_6daadff5655db7ad\api-ms-win-core-synch-l1-2-0.dll Handle ID: 0xb74 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\wow64_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.26100.5059_none_6daadff5655db7ad\api-ms-win-core-sysinfo-l1-2-0.dll Handle ID: 0xef4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\wow64_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.26100.5059_none_6daadff5655db7ad\api-ms-win-core-sysinfo-l1-1-0.dll Handle ID: 0xe28 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\wow64_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.26100.5059_none_6daadff5655db7ad\api-ms-win-core-sysinfo-l1-2-1.dll Handle ID: 0x888 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\wow64_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.26100.5059_none_6daadff5655db7ad\api-ms-win-core-threadpool-legacy-l1-1-0.dll Handle ID: 0xe50 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\wow64_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.26100.5059_none_6daadff5655db7ad\api-ms-win-core-threadpool-private-l1-1-0.dll Handle ID: 0x778 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\wow64_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.26100.5059_none_6daadff5655db7ad\api-ms-win-core-threadpool-l1-2-0.dll Handle ID: 0x11e4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\wow64_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.26100.5059_none_6daadff5655db7ad\api-ms-win-core-timezone-l1-1-0.dll Handle ID: 0xeb8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\wow64_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.26100.5059_none_6daadff5655db7ad\api-ms-win-core-util-l1-1-0.dll Handle ID: 0xa58 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\wow64_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.26100.5059_none_6daadff5655db7ad\api-ms-win-core-wow64-l1-1-0.dll Handle ID: 0xe20 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\wow64_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.26100.5059_none_6daadff5655db7ad\api-ms-win-core-xstate-l1-1-0.dll Handle ID: 0xdec Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\wow64_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.26100.5059_none_6daadff5655db7ad\api-ms-win-crt-conio-l1-1-0.dll Handle ID: 0x10d4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\wow64_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.26100.5059_none_6daadff5655db7ad\api-ms-win-crt-environment-l1-1-0.dll Handle ID: 0xb84 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\wow64_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.26100.5059_none_6daadff5655db7ad\api-ms-win-crt-convert-l1-1-0.dll Handle ID: 0xfd8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\wow64_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.26100.5059_none_6daadff5655db7ad\api-ms-win-crt-locale-l1-1-0.dll Handle ID: 0x1030 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\wow64_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.26100.5059_none_6daadff5655db7ad\api-ms-win-crt-heap-l1-1-0.dll Handle ID: 0x1198 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\wow64_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.26100.5059_none_6daadff5655db7ad\api-ms-win-crt-filesystem-l1-1-0.dll Handle ID: 0xd1c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\wow64_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.26100.5059_none_6daadff5655db7ad\api-ms-win-crt-process-l1-1-0.dll Handle ID: 0x8f4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\wow64_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.26100.5059_none_6daadff5655db7ad\api-ms-win-crt-math-l1-1-0.dll Handle ID: 0xfb8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\wow64_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.26100.5059_none_6daadff5655db7ad\api-ms-win-crt-multibyte-l1-1-0.dll Handle ID: 0x1210 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\wow64_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.26100.5059_none_6daadff5655db7ad\api-ms-win-crt-runtime-l1-1-0.dll Handle ID: 0x6e4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\wow64_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.26100.5059_none_6daadff5655db7ad\api-ms-win-crt-stdio-l1-1-0.dll Handle ID: 0xcd0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\wow64_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.26100.5059_none_6daadff5655db7ad\api-ms-win-crt-string-l1-1-0.dll Handle ID: 0xc5c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\wow64_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.26100.5059_none_6daadff5655db7ad\api-ms-win-crt-time-l1-1-0.dll Handle ID: 0x928 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\wow64_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.26100.5059_none_6daadff5655db7ad\api-ms-win-crt-utility-l1-1-0.dll Handle ID: 0xa2c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\wow64_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.26100.5059_none_6daadff5655db7ad\api-ms-win-crt-private-l1-1-0.dll Handle ID: 0x98c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\wow64_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.26100.5059_none_6daadff5655db7ad\api-ms-win-service-core-l1-1-0.dll Handle ID: 0x118c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\wow64_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.26100.5059_none_6daadff5655db7ad\api-ms-win-service-core-l1-1-1.dll Handle ID: 0xba4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\wow64_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.26100.5059_none_6daadff5655db7ad\api-ms-win-service-management-l1-1-0.dll Handle ID: 0xe0c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\wow64_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.26100.5059_none_6daadff5655db7ad\api-ms-win-security-base-l1-1-0.dll Handle ID: 0xf00 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\wow64_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.26100.5059_none_6daadff5655db7ad\api-ms-win-service-management-l2-1-0.dll Handle ID: 0xd38 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\wow64_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.26100.5059_none_6daadff5655db7ad\api-ms-win-service-private-l1-1-0.dll Handle ID: 0x72c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\wow64_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.26100.5059_none_6daadff5655db7ad\api-ms-win-service-private-l1-1-1.dll Handle ID: 0xae4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\wow64_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.26100.5059_none_6daadff5655db7ad\api-ms-win-service-winsvc-l1-1-0.dll Handle ID: 0xc10 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\wow64_microsoft-windows-ntdll_31bf3856ad364e35_10.0.26100.5059_none_ff1ce386e07115e8\ntdll.dll Handle ID: 0x830 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-u..stratorcore-regkeys_31bf3856ad364e35_10.0.26100.5059_none_3dafdf69b51c8409\0690201f6b392ef45758aa8180e54b80d4ff1a6a.xml Handle ID: 0xc90 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-u..stratorcore-regkeys_31bf3856ad364e35_10.0.26100.5059_none_3dafdf69b51c8409\23d343cca2905f5a9d8ed56e2f7308cf612ba7ec.xml Handle ID: 0xfdc Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-u..stratorcore-regkeys_31bf3856ad364e35_10.0.26100.5059_none_3dafdf69b51c8409\0e0337eedd34f1bed8e9bc3202a2754e48b705af.xml Handle ID: 0xa6c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-u..stratorcore-regkeys_31bf3856ad364e35_10.0.26100.5059_none_3dafdf69b51c8409\3332a645bfab2f45c96ade4c05630863cbdcfbd1.xml Handle ID: 0xe10 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-u..stratorcore-regkeys_31bf3856ad364e35_10.0.26100.5059_none_3dafdf69b51c8409\3cee7b10553edccb79ba709ba53630469cb48843.xml Handle ID: 0x748 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-u..stratorcore-regkeys_31bf3856ad364e35_10.0.26100.5059_none_3dafdf69b51c8409\465bb23da8d1bea1a024758ba463bc1a7c487362.xml Handle ID: 0xbe4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-u..stratorcore-regkeys_31bf3856ad364e35_10.0.26100.5059_none_3dafdf69b51c8409\4ba05104f3d293466a50d8de04318624ab592070.xml Handle ID: 0x11ac Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-u..stratorcore-regkeys_31bf3856ad364e35_10.0.26100.5059_none_3dafdf69b51c8409\518f3ea9dc67aa5af7eb2840a6f77c874c2b2a17.xml Handle ID: 0x86c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-u..stratorcore-regkeys_31bf3856ad364e35_10.0.26100.5059_none_3dafdf69b51c8409\56a7d507d06f3d51821e1124e642fa74ff3397af.xml Handle ID: 0xfa4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-u..stratorcore-regkeys_31bf3856ad364e35_10.0.26100.5059_none_3dafdf69b51c8409\5c7e9e098d198f0114f76066999378607084a638.xml Handle ID: 0xb44 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-u..stratorcore-regkeys_31bf3856ad364e35_10.0.26100.5059_none_3dafdf69b51c8409\68feea34ca8e40dee5faab63604db4cd1d7a3e77.xml Handle ID: 0xefc Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-u..stratorcore-regkeys_31bf3856ad364e35_10.0.26100.5059_none_3dafdf69b51c8409\7106fe8ce0b33cfdfee8b58e7e1b0a812935905e.xml Handle ID: 0x948 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-u..stratorcore-regkeys_31bf3856ad364e35_10.0.26100.5059_none_3dafdf69b51c8409\72aceda3d9ebaa195b776ea9042fdf4dc3d29834.xml Handle ID: 0xdc0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-u..stratorcore-regkeys_31bf3856ad364e35_10.0.26100.5059_none_3dafdf69b51c8409\7bc20c224f17145165aedb3fce9bda4f3c563cd7.xml Handle ID: 0xda8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-u..stratorcore-regkeys_31bf3856ad364e35_10.0.26100.5059_none_3dafdf69b51c8409\90eaab3b92938b566b871d11d7a2c86b081b26d4.xml Handle ID: 0xbd8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-u..stratorcore-regkeys_31bf3856ad364e35_10.0.26100.5059_none_3dafdf69b51c8409\81d5c60cdaa2f6bac600452c12eac91e3823d9ef.xml Handle ID: 0x8c4 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-u..stratorcore-regkeys_31bf3856ad364e35_10.0.26100.5059_none_3dafdf69b51c8409\8acdd7e8a35f165b675b664e7ef8753ef4782f32.xml Handle ID: 0xab0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-u..stratorcore-regkeys_31bf3856ad364e35_10.0.26100.5059_none_3dafdf69b51c8409\b2617fe77af0e357462c58cb9ab1bbc2a243ab95.xml Handle ID: 0x77c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-u..stratorcore-regkeys_31bf3856ad364e35_10.0.26100.5059_none_3dafdf69b51c8409\99c5248bd8c3356e9a42f332cab9b22eae3856df.xml Handle ID: 0xd6c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-u..stratorcore-regkeys_31bf3856ad364e35_10.0.26100.5059_none_3dafdf69b51c8409\c20df1ed8df28c31d513bd896b58980c00c8b298.xml Handle ID: 0xe9c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-u..stratorcore-regkeys_31bf3856ad364e35_10.0.26100.5059_none_3dafdf69b51c8409\e4c1f6f26bc4ae6ba77734b6aa93d400b87278bb.xml Handle ID: 0x850 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-u..stratorcore-regkeys_31bf3856ad364e35_10.0.26100.5059_none_3dafdf69b51c8409\ef338bad6c4b025dc9c8f4f87a98276b2139d403.xml Handle ID: 0x7c0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\wow64_microsoft-windows-kernelbase_31bf3856ad364e35_10.0.26100.5059_none_cd487d9898d77a6c\KernelBase.dll Handle ID: 0x1a8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-u..stratorcore-service_31bf3856ad364e35_10.0.26100.5059_none_39df80b13ec82764\43ee7b2a373632f9a701249fd96d0edec2ff1279.xml Handle ID: 0x1170 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-u..te-orchestratorcore_31bf3856ad364e35_10.0.26100.5059_none_22c3ae983455c3ee\usosvcimpl.dll Handle ID: 0xafc Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-u..te-orchestratorcore_31bf3856ad364e35_10.0.26100.5059_none_22c3ae983455c3ee\MoUsoCoreWorker.exe Handle ID: 0x6f8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_boot_dvd_efi_de3c4ceb52549e1c.cdf-ms Handle ID: 0xf70 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_boot_dvd_efi_en-us_8245c3aed97c0844.cdf-ms Handle ID: 0x6c0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_boot_dvd_ex_efi_en-us_91aa4a0627c21b4a.cdf-ms Handle ID: 0x8d8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_boot_efi_bg-bg_bf6512730a586be9.cdf-ms Handle ID: 0xc40 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_boot_efi_cs-cz_c14bac6f077e8634.cdf-ms Handle ID: 0xc0c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_boot_efi_da-dk_c3320a1704a4f7d3.cdf-ms Handle ID: 0xc40 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_boot_efi_de-de_c331fe2304a50a2d.cdf-ms Handle ID: 0xad8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_boot_efi_0f890f82be247f42.cdf-ms Handle ID: 0xba0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_boot_efi_el-gr_c5188d6f01cb33fb.cdf-ms Handle ID: 0xf28 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_boot_efi_en-gb_c5186ec701cb622d.cdf-ms Handle ID: 0xc64 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_boot_efi_en-us_c5188f0d01cb31d2.cdf-ms Handle ID: 0xf28 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_boot_efi_es-es_c5188e5901cb3357.cdf-ms Handle ID: 0xba0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_boot_efi_es-mx_c51897d701cb2522.cdf-ms Handle ID: 0xf28 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_boot_efi_et-ee_c51873a101cb5b86.cdf-ms Handle ID: 0xc64 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_boot_efi_ex_797e466ba2705b86.cdf-ms Handle ID: 0xad8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_boot_efi_ex_bg-bg_0d0c35b328a6e44f.cdf-ms Handle ID: 0xc40 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_boot_efi_ex_cs-cz_0d0c4c7d28a7c26c.cdf-ms Handle ID: 0xc0c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_boot_efi_ex_da-dk_0d0c2a5328a8f5d5.cdf-ms Handle ID: 0x8d8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_boot_efi_ex_de-de_0d0c31eb28a8ea6b.cdf-ms Handle ID: 0x6c0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_boot_efi_ex_el-gr_0d0c3f3b28a9d6ad.cdf-ms Handle ID: 0xf70 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_boot_efi_ex_en-gb_0d0c430728a9d0eb.cdf-ms Handle ID: 0xc04 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_boot_efi_ex_en-us_0d0c432328a9d07e.cdf-ms Handle ID: 0xf70 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_boot_efi_ex_es-es_0d0c4c8128a9c2d1.cdf-ms Handle ID: 0x6c0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_boot_efi_ex_es-mx_0d0c4c9128a9c28e.cdf-ms Handle ID: 0xf70 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_boot_efi_ex_et-ee_0d0c4e6728a9bfea.cdf-ms Handle ID: 0xc04 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_boot_efi_ex_fi-fi_0d0c398728aadf77.cdf-ms Handle ID: 0xf70 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_boot_efi_ex_fr-ca_0d0c4a9728aac5e9.cdf-ms Handle ID: 0x6c0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_boot_efi_ex_fr-fr_0d0c4a9d28aac5df.cdf-ms Handle ID: 0x8d8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_boot_efi_ex_hr-hr_0d0c4aa128acc64b.cdf-ms Handle ID: 0xc0c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_boot_efi_ex_hu-hu_0d0c505328acbdc3.cdf-ms Handle ID: 0xc0c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_boot_efi_ex_it-it_0d0c4e6f28adc0d1.cdf-ms Handle ID: 0x8d8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_boot_efi_ex_ja-jp_0d0c2a5f28aef71e.cdf-ms Handle ID: 0xf70 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_boot_efi_ex_ko-kr_0d0c44f528afcf78.cdf-ms Handle ID: 0xc04 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_boot_efi_ex_lt-lt_0d0c4e7528b0c173.cdf-ms Handle ID: 0x8d8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_boot_efi_ex_lv-lv_0d0c524128b0bbc3.cdf-ms Handle ID: 0xc0c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_boot_efi_ex_nb-no_0d0c2c4d28b2f51c.cdf-ms Handle ID: 0x8d8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_boot_efi_ex_nl-nl_0d0c3f4928b2d89f.cdf-ms Handle ID: 0x8d8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_boot_efi_ex_pl-pl_0d0c3f4d28b4d90b.cdf-ms Handle ID: 0x8d8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_boot_efi_ex_pt-br_0d0c4e6128b4c2c7.cdf-ms Handle ID: 0x8d8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_boot_efi_ex_pt-pt_0d0c4e7d28b4c24b.cdf-ms Handle ID: 0x8d8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_boot_efi_ex_ro-ro_0d0c450328b6d0ef.cdf-ms Handle ID: 0x8d8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_boot_efi_ex_ru-ru_0d0c506728b6bfdf.cdf-ms Handle ID: 0xc0c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_boot_efi_ex_sk-sk_0d0c3d6d28b7dc85.cdf-ms Handle ID: 0x6c0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_boot_efi_ex_sl-si_0d0c3f5328b7d9aa.cdf-ms Handle ID: 0xd60 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_boot_efi_ex_sr-latn-rs_495dabcc2134885b.cdf-ms Handle ID: 0xd60 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_boot_efi_ex_sv-se_0d0c524f28b7bd2c.cdf-ms Handle ID: 0x1264 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_boot_efi_ex_tr-tr_0d0c4ab928b8c8d3.cdf-ms Handle ID: 0x1264 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_boot_efi_ex_uk-ua_0d0c3d7128b9dce7.cdf-ms Handle ID: 0x1264 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_boot_efi_ex_zh-cn_0d0c379b28bee75c.cdf-ms Handle ID: 0x6c0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_boot_efi_ex_zh-tw_0d0c37bd28bee6cc.cdf-ms Handle ID: 0x6c0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_boot_efi_fi-fi_c6fef45efef19941.cdf-ms Handle ID: 0xc0c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_boot_efi_fr-ca_c6fee3eafef1b2df.cdf-ms Handle ID: 0x6c0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_boot_efi_fr-fr_c6ff0430fef18279.cdf-ms Handle ID: 0x8d8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_boot_efi_hr-hr_cacbf364f93e1bad.cdf-ms Handle ID: 0x6c0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_boot_efi_hu-hu_cacbf8aaf93e1415.cdf-ms Handle ID: 0xc0c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_boot_efi_it-it_ccb26e82f6646337.cdf-ms Handle ID: 0xc0c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_boot_efi_ja-jp_ce98e130f38ab532.cdf-ms Handle ID: 0xc0c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_boot_efi_ko-kr_d07f5a9ef0b10088.cdf-ms Handle ID: 0xc0c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_boot_efi_lt-lt_d265d550edd74905.cdf-ms Handle ID: 0xc04 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_boot_efi_lv-lv_d265d8d4edd743f5.cdf-ms Handle ID: 0xf70 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_boot_efi_nb-no_d632bd8ee823eac4.cdf-ms Handle ID: 0xc0c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_boot_efi_nl-nl_d632b674e823f679.cdf-ms Handle ID: 0xc0c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_boot_efi_pl-pl_d9ffa5a8e2708fad.cdf-ms Handle ID: 0xc40 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_boot_efi_pt-br_d9ffafece2708111.cdf-ms Handle ID: 0xad8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_boot_efi_pt-pt_d9ffb3b8e2707b6d.cdf-ms Handle ID: 0xc64 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_boot_efi_ro-ro_ddcc9a22dcbd2149.cdf-ms Handle ID: 0xc0c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_boot_efi_ru-ru_ddcca4aedcbd1219.cdf-ms Handle ID: 0xc0c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_boot_efi_sk-sk_dfb30ab4d9e37803.cdf-ms Handle ID: 0xc64 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_boot_efi_sl-si_dfb306c4d9e37e06.cdf-ms Handle ID: 0xad8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_boot_efi_sr-latn-rs_175a7056497f1cbd.cdf-ms Handle ID: 0xc40 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_boot_efi_sv-se_dfb2fdc4d9e38c94.cdf-ms Handle ID: 0xc40 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_boot_efi_tr-tr_e1998e9cd709b2e5.cdf-ms Handle ID: 0xc40 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_boot_efi_uk-ua_e37fe6ecd4302db1.cdf-ms Handle ID: 0xad8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_boot_efi_zh-cn_ed005608c5ef86a4.cdf-ms Handle ID: 0xf28 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_boot_efi_zh-tw_ed00671ec5ef6d14.cdf-ms Handle ID: 0xba0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_boot_fonts_ex_e31996175596d82a.cdf-ms Handle ID: 0xc40 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_boot_fonts_fee710f4f7b180e0.cdf-ms Handle ID: 0xba0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_livekernelreports_13126bbee8c1252a.cdf-ms Handle ID: 0xf28 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_logs_cbs_10a752bcbbaee88b.cdf-ms Handle ID: 0xad8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_logs_measuredboot_ab1fadc53c86b337.cdf-ms Handle ID: 0xad8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_servicing_packages_46c20bc5f833cc43.cdf-ms Handle ID: 0xad8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_servicing_fc2045b9046cc796.cdf-ms Handle ID: 0xad8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_servicing_sessions_5591aee9e2456a35.cdf-ms Handle ID: 0xad8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_servicing_sqm_51d9d5f9de5a2fa5.cdf-ms Handle ID: 0xad8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_servicing_version_10.0.26100.5074_8bf0011b831ea0ae.cdf-ms Handle ID: 0xad8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_system32_advancedinstallers_dfe2cf200b391371.cdf-ms Handle ID: 0xc64 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_system32_boot_06654401df2fc50e.cdf-ms Handle ID: 0xad8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_system32_catroot_dcafaffa24ca18cc.cdf-ms Handle ID: 0xad8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_system32_catroot_f750e6c3-38ee-11d1-85e5-00c04fc295ee__0f6ee2e4c9b287a4.cdf-ms Handle ID: 0xad8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_system32_codeintegrity_cipolicies_internal_c92a000dc3e74fc1.cdf-ms Handle ID: 0xad8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_system32_codeintegrity_cipolicies_staged_276d48e6ef8844ae.cdf-ms Handle ID: 0xad8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_system32_codeintegrity_cipolicies_active_29d3e16aea6e0340.cdf-ms Handle ID: 0xf28 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_system32_codeintegrity_update_previous_ad580ee945408ddc.cdf-ms Handle ID: 0xba0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_system32_codeintegrity_e9af9308cfc26dc2.cdf-ms Handle ID: 0xc40 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_system32_dism_en-us_064f3ab06d0848d3.cdf-ms Handle ID: 0xf28 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_system32_dism_066548addf2fbd4b.cdf-ms Handle ID: 0xf28 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_system32_downlevel_3ccc30959b90736e.cdf-ms Handle ID: 0xf28 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_system32_drivers_en-us_4bb913fc5eb96bcf.cdf-ms Handle ID: 0xc40 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_syswow64_advancedinstallers_0c6bb4866bff02f7.cdf-ms Handle ID: 0xc40 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_syswow64_dism_1bf2381fbb30eb13.cdf-ms Handle ID: 0xc40 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_system32_drivers_dc1b782427b5ee1b.cdf-ms Handle ID: 0xc40 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_uus_amd64_1a6fccf0d7e0978b.cdf-ms Handle ID: 0xf28 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_waas_regkeys_dbffc348a6fab71c.cdf-ms Handle ID: 0xba0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_syswow64_21ffbdd2a2dd92e0.cdf-ms Handle ID: 0xad8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_waas_services_ddfc4ae175ff1678.cdf-ms Handle ID: 0xc64 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\programdata_microsoft_crypto_pcpksp_windowsaik_cb9775b914a8e5a2.cdf-ms Handle ID: 0xc0c Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\programdata_microsoft_windows_wer_reportarchive_5449504010b82c41.cdf-ms Handle ID: 0xf70 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\programdata_microsoft_windows_wer_reportqueue_9ca35f30fc68b178.cdf-ms Handle ID: 0xc04 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_syswow64_downlevel_6821b3350853d81a.cdf-ms Handle ID: 0x6c0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\programdata_microsoft_windows_wer_temp_783673b09e921b6b.cdf-ms Handle ID: 0x8d8 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\programdata_usoprivate_f18983166baec8e8.cdf-ms Handle ID: 0x1264 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\programdata_usoshared_logs_system_1d654048a9eadf5a.cdf-ms Handle ID: 0xd60 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\programdata_usoshared_logs_user_cc47ba2ac1c4ac78.cdf-ms Handle ID: 0x744 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\sources.cdf-ms Handle ID: 0x868 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\sources_en-us_2e88d920877a69ae.cdf-ms Handle ID: 0x1054 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\sources_recovery_en-us_38d0190271db68af.cdf-ms Handle ID: 0x810 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\sources_recovery_fa3a0fbfbc08eda1.cdf-ms Handle ID: 0xaf0 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_system32_en-us_429cd25484dc6f94.cdf-ms Handle ID: 0x810 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_system32_21f9a9c4a2f8b514.cdf-ms Handle ID: 0x1054 Process Information: Process ID: 0x15a8 Process Name: C:\Windows\UUS\amd64\wuaucltcore.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:58 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\Package_for_ServicingStack_7010~31bf3856ad364e35~amd64~~26100.7010.1.8.cat Handle ID: 0x4fc Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:58 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\Package_for_ServicingStack_7010~31bf3856ad364e35~amd64~~26100.7010.1.8.mum Handle ID: 0x4fc Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:58 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\Wrapper-9B2169EE8DE90026633B242CDE4F47D1E3047CD3CB7CF0535CBDBD7FD8F12F95~31bf3856ad364e35~amd64~~10.0.26100.7010.cat Handle ID: 0x4fc Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:58 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\Wrapper-9B2169EE8DE90026633B242CDE4F47D1E3047CD3CB7CF0535CBDBD7FD8F12F95~31bf3856ad364e35~amd64~~10.0.26100.7010.mum Handle ID: 0x4fc Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:58 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\Shared-C96391D8C1EC2830A050B58DD4D67986A7CFF6A951051505C179DAA7C19FAC17~31bf3856ad364e35~amd64~~10.0.26100.7010.cat Handle ID: 0x4fc Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:58 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\Shared-C96391D8C1EC2830A050B58DD4D67986A7CFF6A951051505C179DAA7C19FAC17~31bf3856ad364e35~amd64~~10.0.26100.7010.mum Handle ID: 0x4fc Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:29:59 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\Shared-C96391D8C1EC2830A050B58DD4D67986A7CFF6A951051505C179DAA7C19FAC17~31bf3856ad364e35~amd64~~10.0.26100.7010.cat Handle ID: 0x5b4 Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:00 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\_0000000000000000.cdf-ms Handle ID: 0x8b0 Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:00 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$.cdf-ms Handle ID: 0x8b0 Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:00 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_syswow64_21ffbdd2a2dd92e0.cdf-ms Handle ID: 0x8b0 Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:00 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_syswow64_advancedinstallers_0c6bb4866bff02f7.cdf-ms Handle ID: 0x8b0 Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:00 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_system32_21f9a9c4a2f8b514.cdf-ms Handle ID: 0x8b0 Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:00 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_system32_advancedinstallers_dfe2cf200b391371.cdf-ms Handle ID: 0x8b0 Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:00 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_servicing_fc2045b9046cc796.cdf-ms Handle ID: 0x8b0 Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:00 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_servicing_version_10.0.26100.7010_8bf004db831e9b2e.cdf-ms Handle ID: 0x8b4 Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:00 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_servicing_sqm_51d9d5f9de5a2fa5.cdf-ms Handle ID: 0x8b4 Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:00 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_servicing_sessions_5591aee9e2456a35.cdf-ms Handle ID: 0x8b4 Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:00 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_servicing_packages_46c20bc5f833cc43.cdf-ms Handle ID: 0x8b4 Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:00 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_logs_cbs_10a752bcbbaee88b.cdf-ms Handle ID: 0x8b4 Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:00 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\System32\poqexec.exe Handle ID: 0x8b4 Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:00 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\SysWOW64\poqexec.exe Handle ID: 0x8b4 Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:18 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\Package_for_SafeOSDU~31bf3856ad364e35~amd64~~26100.7149.1.5.cat Handle ID: 0x618 Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:18 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\Package_for_SafeOSDU~31bf3856ad364e35~amd64~~26100.7149.1.5.mum Handle ID: 0x618 Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:18 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\Wrapper-661FDBF43BA4922DE63CF3C72A3D5E981E58E152A0176283AEDFA66872B24A92~31bf3856ad364e35~amd64~~10.0.26100.7149.cat Handle ID: 0x618 Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:18 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\Wrapper-661FDBF43BA4922DE63CF3C72A3D5E981E58E152A0176283AEDFA66872B24A92~31bf3856ad364e35~amd64~~10.0.26100.7149.mum Handle ID: 0x618 Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:18 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\Package-A3E79A8A0C116175C30E0F02A1DFB79477E3D031CA2D74C6077B9220B12A7B6C~31bf3856ad364e35~amd64~~10.0.26100.7149.cat Handle ID: 0x618 Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:18 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\Package-A3E79A8A0C116175C30E0F02A1DFB79477E3D031CA2D74C6077B9220B12A7B6C~31bf3856ad364e35~amd64~~10.0.26100.7149.mum Handle ID: 0x618 Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:18 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\Language-E62E8E856BC935800E7D55FFF1DE080FECFDFC9F1C5E6CF4FB15DE93FCA964D8~31bf3856ad364e35~amd64~en-US~10.0.26100.7149.cat Handle ID: 0x618 Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:18 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\Language-E62E8E856BC935800E7D55FFF1DE080FECFDFC9F1C5E6CF4FB15DE93FCA964D8~31bf3856ad364e35~amd64~en-US~10.0.26100.7149.mum Handle ID: 0x618 Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:18 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\Package-8ADA81636E71B6B6E9EC41ABB39809449262728839513A997473F8D555DF3159~31bf3856ad364e35~amd64~en-US~10.0.26100.7149.cat Handle ID: 0x618 Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:18 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\Package-8ADA81636E71B6B6E9EC41ABB39809449262728839513A997473F8D555DF3159~31bf3856ad364e35~amd64~en-US~10.0.26100.7149.mum Handle ID: 0x618 Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:18 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\Wrapper-84FFE732012D6E212082614F6688BD121294AB672E1C15BEA34D8C32CA4B22BE~31bf3856ad364e35~amd64~~10.0.26100.7149.cat Handle ID: 0x618 Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:18 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\Wrapper-84FFE732012D6E212082614F6688BD121294AB672E1C15BEA34D8C32CA4B22BE~31bf3856ad364e35~amd64~~10.0.26100.7149.mum Handle ID: 0x618 Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:18 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\Wrapper-96382338A5225D2BF8309DA8392FA6A1512BB739DD40FC20E1606E40778298D3~31bf3856ad364e35~amd64~~10.0.26100.7149.cat Handle ID: 0x618 Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:18 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\Wrapper-96382338A5225D2BF8309DA8392FA6A1512BB739DD40FC20E1606E40778298D3~31bf3856ad364e35~amd64~~10.0.26100.7149.mum Handle ID: 0x618 Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:18 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\Language-1D7BB005245F5C4AC6BF127D978669E269FA8D374A5A36899D9F4EA813E3D532~31bf3856ad364e35~amd64~en-US~10.0.26100.7149.cat Handle ID: 0x618 Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:18 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\Language-1D7BB005245F5C4AC6BF127D978669E269FA8D374A5A36899D9F4EA813E3D532~31bf3856ad364e35~amd64~en-US~10.0.26100.7149.mum Handle ID: 0x618 Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:18 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\Wrapper-AE48F4500838F08A8E41A789B132000FD27A4816FF0CCF22309DECBD89FF7E17~31bf3856ad364e35~amd64~~10.0.26100.7149.cat Handle ID: 0x618 Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:18 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\Wrapper-AE48F4500838F08A8E41A789B132000FD27A4816FF0CCF22309DECBD89FF7E17~31bf3856ad364e35~amd64~~10.0.26100.7149.mum Handle ID: 0x618 Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:18 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\Shared-C35C451B528AC523A573769E54593A7712C82C99A3FBCECB2C0D02A3B8BD10B1~31bf3856ad364e35~amd64~~10.0.26100.7149.cat Handle ID: 0x618 Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:18 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\Shared-C35C451B528AC523A573769E54593A7712C82C99A3FBCECB2C0D02A3B8BD10B1~31bf3856ad364e35~amd64~~10.0.26100.7149.mum Handle ID: 0x618 Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:18 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\Language-BAEE1F89655E17706CD0A5CE9571203942067DEFE16E854A9A9E66F27A214405~31bf3856ad364e35~amd64~en-US~10.0.26100.7149.cat Handle ID: 0x618 Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:18 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\Language-BAEE1F89655E17706CD0A5CE9571203942067DEFE16E854A9A9E66F27A214405~31bf3856ad364e35~amd64~en-US~10.0.26100.7149.mum Handle ID: 0x618 Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:18 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\Wrapper-BF839EDD8103CD914E1707E360B85677B1FE78B8054ABC03AAAB12787C8E7F4B~31bf3856ad364e35~amd64~~10.0.26100.7149.cat Handle ID: 0x618 Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:18 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\Wrapper-BF839EDD8103CD914E1707E360B85677B1FE78B8054ABC03AAAB12787C8E7F4B~31bf3856ad364e35~amd64~~10.0.26100.7149.mum Handle ID: 0x618 Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:18 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\Package-6989F5AB1C96444FA205D6195C1B1C26FFAACCC7CB097B27C85937BA65B41A7B~31bf3856ad364e35~amd64~~10.0.26100.7149.cat Handle ID: 0x7b0 Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:18 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\Package-6989F5AB1C96444FA205D6195C1B1C26FFAACCC7CB097B27C85937BA65B41A7B~31bf3856ad364e35~amd64~~10.0.26100.7149.mum Handle ID: 0x7b0 Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:18 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\Wrapper-C847039CF8F6C1127DECBFFE0D47F59830091D00B0BBD0D8CCC6B5457B84A7CF~31bf3856ad364e35~amd64~~10.0.26100.7149.cat Handle ID: 0xa54 Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:18 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\Wrapper-C847039CF8F6C1127DECBFFE0D47F59830091D00B0BBD0D8CCC6B5457B84A7CF~31bf3856ad364e35~amd64~~10.0.26100.7149.mum Handle ID: 0xa54 Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:18 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\Package-CEA7105E5168DA9342892833403E0C075AD33DF172ECE6F948FB257B39FA8EE9~31bf3856ad364e35~amd64~~10.0.26100.7149.cat Handle ID: 0xa54 Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:18 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\Package-CEA7105E5168DA9342892833403E0C075AD33DF172ECE6F948FB257B39FA8EE9~31bf3856ad364e35~amd64~~10.0.26100.7149.mum Handle ID: 0xa54 Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:18 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\Wrapper-EBACE71981A2048680937CD1C82D41DF6CF85FC8F9FEDDE2935E227BC625AC7F~31bf3856ad364e35~amd64~~10.0.26100.7149.cat Handle ID: 0xa54 Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:18 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\Wrapper-EBACE71981A2048680937CD1C82D41DF6CF85FC8F9FEDDE2935E227BC625AC7F~31bf3856ad364e35~amd64~~10.0.26100.7149.mum Handle ID: 0xa54 Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:18 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\Package-0ADD83C089AC5184A9C44B662FFDFECDE4811389BC9B5ED7388761E5107E2579~31bf3856ad364e35~amd64~~10.0.26100.7149.cat Handle ID: 0xa54 Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:18 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\Package-0ADD83C089AC5184A9C44B662FFDFECDE4811389BC9B5ED7388761E5107E2579~31bf3856ad364e35~amd64~~10.0.26100.7149.mum Handle ID: 0xa54 Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:18 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\Package-40EF8EC574B3B4235FABD6555DDCB057CB8A7A5D1DFA51FBC66C5024800C70F0~31bf3856ad364e35~amd64~~10.0.26100.7149.cat Handle ID: 0xa54 Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:18 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\Package-40EF8EC574B3B4235FABD6555DDCB057CB8A7A5D1DFA51FBC66C5024800C70F0~31bf3856ad364e35~amd64~~10.0.26100.7149.mum Handle ID: 0xa54 Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:18 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\Package-51D318826FA91389900D0D7699B2BB45565E45B3182265C5F0F1B3E000C94D3A~31bf3856ad364e35~amd64~~10.0.26100.7149.cat Handle ID: 0xa54 Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:18 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\Package-51D318826FA91389900D0D7699B2BB45565E45B3182265C5F0F1B3E000C94D3A~31bf3856ad364e35~amd64~~10.0.26100.7149.mum Handle ID: 0xa54 Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:18 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\Package-C7EFF55C42B2F199027F1BF592B677CDECA14065296969A3E4BD06949203E0E1~31bf3856ad364e35~amd64~~10.0.26100.7149.cat Handle ID: 0xa54 Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:18 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\Package-C7EFF55C42B2F199027F1BF592B677CDECA14065296969A3E4BD06949203E0E1~31bf3856ad364e35~amd64~~10.0.26100.7149.mum Handle ID: 0xa54 Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:18 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\Package-F1E6C66AC7D3E46AFA5EDE98971587DA5F9934A1429416E6F68FA909FD980683~31bf3856ad364e35~amd64~~10.0.26100.7149.cat Handle ID: 0xa54 Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:18 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\Package-F1E6C66AC7D3E46AFA5EDE98971587DA5F9934A1429416E6F68FA909FD980683~31bf3856ad364e35~amd64~~10.0.26100.7149.mum Handle ID: 0xa54 Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:18 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\Language-00816435615F13A79DE24CE5C46EEED13BDFDEDAEAE45D3C267FE08B3031EC33~31bf3856ad364e35~amd64~en-US~10.0.26100.7149.cat Handle ID: 0xa54 Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:18 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\Language-00816435615F13A79DE24CE5C46EEED13BDFDEDAEAE45D3C267FE08B3031EC33~31bf3856ad364e35~amd64~en-US~10.0.26100.7149.mum Handle ID: 0xa54 Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:18 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\Package-55BA3732A20872FF989A6CF310F9DFE2CAAEB931A81CF74B16C7F76AAF4684F5~31bf3856ad364e35~amd64~en-US~10.0.26100.7149.cat Handle ID: 0xa54 Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:18 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\Package-55BA3732A20872FF989A6CF310F9DFE2CAAEB931A81CF74B16C7F76AAF4684F5~31bf3856ad364e35~amd64~en-US~10.0.26100.7149.mum Handle ID: 0xa54 Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:18 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\Package-8098005153239E21CE7139456A12C6C423AB350540B9FC813CFB3FA1B32031DF~31bf3856ad364e35~amd64~en-US~10.0.26100.7149.cat Handle ID: 0xa54 Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:18 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\Package-8098005153239E21CE7139456A12C6C423AB350540B9FC813CFB3FA1B32031DF~31bf3856ad364e35~amd64~en-US~10.0.26100.7149.mum Handle ID: 0xa54 Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:18 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\Package-9BF398C92405870DBFEEFC4055260B1446387F317E14A6BBF7B8B7E3205C14E2~31bf3856ad364e35~amd64~en-US~10.0.26100.7149.cat Handle ID: 0xa54 Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:18 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\Package-9BF398C92405870DBFEEFC4055260B1446387F317E14A6BBF7B8B7E3205C14E2~31bf3856ad364e35~amd64~en-US~10.0.26100.7149.mum Handle ID: 0xa54 Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:23 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\Package-A3E79A8A0C116175C30E0F02A1DFB79477E3D031CA2D74C6077B9220B12A7B6C~31bf3856ad364e35~amd64~~10.0.26100.7149.cat Handle ID: 0xa28 Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:23 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\Package-8ADA81636E71B6B6E9EC41ABB39809449262728839513A997473F8D555DF3159~31bf3856ad364e35~amd64~en-US~10.0.26100.7149.cat Handle ID: 0x740 Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:23 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\Wrapper-84FFE732012D6E212082614F6688BD121294AB672E1C15BEA34D8C32CA4B22BE~31bf3856ad364e35~amd64~~10.0.26100.7149.cat Handle ID: 0x54c Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:23 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\Wrapper-96382338A5225D2BF8309DA8392FA6A1512BB739DD40FC20E1606E40778298D3~31bf3856ad364e35~amd64~~10.0.26100.7149.cat Handle ID: 0xaac Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:23 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\Language-1D7BB005245F5C4AC6BF127D978669E269FA8D374A5A36899D9F4EA813E3D532~31bf3856ad364e35~amd64~en-US~10.0.26100.7149.cat Handle ID: 0x70c Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:23 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\Wrapper-AE48F4500838F08A8E41A789B132000FD27A4816FF0CCF22309DECBD89FF7E17~31bf3856ad364e35~amd64~~10.0.26100.7149.cat Handle ID: 0xbcc Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:23 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\Shared-C35C451B528AC523A573769E54593A7712C82C99A3FBCECB2C0D02A3B8BD10B1~31bf3856ad364e35~amd64~~10.0.26100.7149.cat Handle ID: 0xdfc Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:23 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\Language-BAEE1F89655E17706CD0A5CE9571203942067DEFE16E854A9A9E66F27A214405~31bf3856ad364e35~amd64~en-US~10.0.26100.7149.cat Handle ID: 0xcb0 Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:23 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\Package-6989F5AB1C96444FA205D6195C1B1C26FFAACCC7CB097B27C85937BA65B41A7B~31bf3856ad364e35~amd64~~10.0.26100.7149.cat Handle ID: 0x89c Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:23 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\Package-CEA7105E5168DA9342892833403E0C075AD33DF172ECE6F948FB257B39FA8EE9~31bf3856ad364e35~amd64~~10.0.26100.7149.cat Handle ID: 0xde8 Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:23 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\Package-0ADD83C089AC5184A9C44B662FFDFECDE4811389BC9B5ED7388761E5107E2579~31bf3856ad364e35~amd64~~10.0.26100.7149.cat Handle ID: 0x3ec Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:23 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\Package-40EF8EC574B3B4235FABD6555DDCB057CB8A7A5D1DFA51FBC66C5024800C70F0~31bf3856ad364e35~amd64~~10.0.26100.7149.cat Handle ID: 0x70c Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:24 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\Package-51D318826FA91389900D0D7699B2BB45565E45B3182265C5F0F1B3E000C94D3A~31bf3856ad364e35~amd64~~10.0.26100.7149.cat Handle ID: 0xc7c Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:24 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\Package-C7EFF55C42B2F199027F1BF592B677CDECA14065296969A3E4BD06949203E0E1~31bf3856ad364e35~amd64~~10.0.26100.7149.cat Handle ID: 0x2fc Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:24 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\Package-F1E6C66AC7D3E46AFA5EDE98971587DA5F9934A1429416E6F68FA909FD980683~31bf3856ad364e35~amd64~~10.0.26100.7149.cat Handle ID: 0xd00 Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:24 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\Package-55BA3732A20872FF989A6CF310F9DFE2CAAEB931A81CF74B16C7F76AAF4684F5~31bf3856ad364e35~amd64~en-US~10.0.26100.7149.cat Handle ID: 0x4cc Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:24 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\Package-8098005153239E21CE7139456A12C6C423AB350540B9FC813CFB3FA1B32031DF~31bf3856ad364e35~amd64~en-US~10.0.26100.7149.cat Handle ID: 0xd10 Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:24 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\servicing\Packages\Package-9BF398C92405870DBFEEFC4055260B1446387F317E14A6BBF7B8B7E3205C14E2~31bf3856ad364e35~amd64~en-US~10.0.26100.7149.cat Handle ID: 0x9a0 Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\System32\apisetschema.dll Handle ID: 0x123c Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\System32\cdd.dll Handle ID: 0x123c Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\System32\ci.dll Handle ID: 0x123c Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\System32\KerbClientShared.dll Handle ID: 0x123c Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\System32\nsi.dll Handle ID: 0x123c Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\System32\nsisvc.dll Handle ID: 0x123c Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\System32\ntdll.dll Handle ID: 0x123c Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\System32\NtlmShared.dll Handle ID: 0x123c Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\System32\ntoskrnl.exe Handle ID: 0x123c Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\System32\symcryptk.dll Handle ID: 0x123c Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\System32\winload.efi Handle ID: 0x123c Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\System32\winload.exe Handle ID: 0x123c Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\System32\winnsi.dll Handle ID: 0x123c Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\System32\CodeIntegrity\driver.stl Handle ID: 0x123c Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\System32\CodeIntegrity\previous.driver.stl Handle ID: 0x123c Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\System32\drivers\cng.sys Handle ID: 0x123c Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\System32\drivers\dumpfve.sys Handle ID: 0x123c Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\System32\drivers\dxgkrnl.sys Handle ID: 0x123c Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\System32\drivers\dxgmms1.sys Handle ID: 0x123c Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\System32\drivers\dxgmms2.sys Handle ID: 0x123c Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\System32\drivers\fbwf.sys Handle ID: 0x123c Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\System32\drivers\fvevol.sys Handle ID: 0x123c Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\System32\drivers\FWPKCLNT.SYS Handle ID: 0x123c Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\System32\drivers\netio.sys Handle ID: 0x123c Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\System32\drivers\nsiproxy.sys Handle ID: 0x123c Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\System32\drivers\tcpip.sys Handle ID: 0x123c Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\System32\drivers\tcpipreg.sys Handle ID: 0x123c Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\SysWOW64\KerbClientShared.dll Handle ID: 0x123c Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\SysWOW64\nsi.dll Handle ID: 0x123c Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\SysWOW64\ntdll.dll Handle ID: 0x123c Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\SysWOW64\NtlmShared.dll Handle ID: 0x123c Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\SysWOW64\winnsi.dll Handle ID: 0x123c Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\_0000000000000000.cdf-ms Handle ID: 0x123c Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$.cdf-ms Handle ID: 0x123c Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_waas_401032e7a18c2040.cdf-ms Handle ID: 0x123c Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_waas_services_ddfc4ae175ff1678.cdf-ms Handle ID: 0x123c Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_waas_regkeys_dbffc348a6fab71c.cdf-ms Handle ID: 0x123c Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_uus_3f582921a4c8b86f.cdf-ms Handle ID: 0x123c Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_uus_amd64_1a6fccf0d7e0978b.cdf-ms Handle ID: 0x123c Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_syswow64_21ffbdd2a2dd92e0.cdf-ms Handle ID: 0x123c Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_syswow64_downlevel_6821b3350853d81a.cdf-ms Handle ID: 0x123c Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_syswow64_dism_1bf2381fbb30eb13.cdf-ms Handle ID: 0x123c Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_system32_21f9a9c4a2f8b514.cdf-ms Handle ID: 0x123c Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_system32_recovery_f87e94e0816fb86b.cdf-ms Handle ID: 0x123c Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_system32_en-us_429cd25484dc6f94.cdf-ms Handle ID: 0x123c Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_system32_drivers_dc1b782427b5ee1b.cdf-ms Handle ID: 0x123c Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_system32_drivers_en-us_4bb913fc5eb96bcf.cdf-ms Handle ID: 0x123c Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_system32_downlevel_3ccc30959b90736e.cdf-ms Handle ID: 0x123c Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_system32_dism_066548addf2fbd4b.cdf-ms Handle ID: 0x123c Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_system32_dism_en-us_064f3ab06d0848d3.cdf-ms Handle ID: 0x123c Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_system32_codeintegrity_e9af9308cfc26dc2.cdf-ms Handle ID: 0x123c Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_system32_codeintegrity_update_previous_ad580ee945408ddc.cdf-ms Handle ID: 0x123c Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_system32_codeintegrity_cipolicies_staged_276d48e6ef8844ae.cdf-ms Handle ID: 0x123c Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_system32_codeintegrity_cipolicies_internal_c92a000dc3e74fc1.cdf-ms Handle ID: 0x123c Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_system32_codeintegrity_cipolicies_active_29d3e16aea6e0340.cdf-ms Handle ID: 0x123c Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_system32_catroot_dcafaffa24ca18cc.cdf-ms Handle ID: 0x123c Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_system32_catroot_f750e6c3-38ee-11d1-85e5-00c04fc295ee__0f6ee2e4c9b287a4.cdf-ms Handle ID: 0x123c Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_system32_boot_06654401df2fc50e.cdf-ms Handle ID: 0x123c Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_logs_measuredboot_ab1fadc53c86b337.cdf-ms Handle ID: 0x123c Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_livekernelreports_13126bbee8c1252a.cdf-ms Handle ID: 0x123c Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_boot_40104b85a18bfcb2.cdf-ms Handle ID: 0x123c Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_boot_fonts_ex_e31996175596d82a.cdf-ms Handle ID: 0x123c Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_boot_fonts_fee710f4f7b180e0.cdf-ms Handle ID: 0x123c Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_boot_efi_ex_797e466ba2705b86.cdf-ms Handle ID: 0x123c Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_boot_efi_ex_zh-tw_0d0c37bd28bee6cc.cdf-ms Handle ID: 0x123c Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_boot_efi_ex_zh-cn_0d0c379b28bee75c.cdf-ms Handle ID: 0x123c Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_boot_efi_ex_uk-ua_0d0c3d7128b9dce7.cdf-ms Handle ID: 0x123c Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_boot_efi_ex_tr-tr_0d0c4ab928b8c8d3.cdf-ms Handle ID: 0x123c Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_boot_efi_ex_sv-se_0d0c524f28b7bd2c.cdf-ms Handle ID: 0x123c Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_boot_efi_ex_sr-latn-rs_495dabcc2134885b.cdf-ms Handle ID: 0x123c Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_boot_efi_ex_sl-si_0d0c3f5328b7d9aa.cdf-ms Handle ID: 0x123c Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_boot_efi_ex_sk-sk_0d0c3d6d28b7dc85.cdf-ms Handle ID: 0x123c Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_boot_efi_ex_ru-ru_0d0c506728b6bfdf.cdf-ms Handle ID: 0x123c Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_boot_efi_ex_ro-ro_0d0c450328b6d0ef.cdf-ms Handle ID: 0x123c Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_boot_efi_ex_pt-pt_0d0c4e7d28b4c24b.cdf-ms Handle ID: 0x123c Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_boot_efi_ex_pt-br_0d0c4e6128b4c2c7.cdf-ms Handle ID: 0x123c Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_boot_efi_ex_pl-pl_0d0c3f4d28b4d90b.cdf-ms Handle ID: 0x123c Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_boot_efi_ex_nl-nl_0d0c3f4928b2d89f.cdf-ms Handle ID: 0x123c Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_boot_efi_ex_nb-no_0d0c2c4d28b2f51c.cdf-ms Handle ID: 0x123c Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_boot_efi_ex_lv-lv_0d0c524128b0bbc3.cdf-ms Handle ID: 0x123c Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_boot_efi_ex_lt-lt_0d0c4e7528b0c173.cdf-ms Handle ID: 0x123c Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_boot_efi_ex_ko-kr_0d0c44f528afcf78.cdf-ms Handle ID: 0x123c Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_boot_efi_ex_ja-jp_0d0c2a5f28aef71e.cdf-ms Handle ID: 0x123c Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_boot_efi_ex_it-it_0d0c4e6f28adc0d1.cdf-ms Handle ID: 0x123c Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_boot_efi_ex_hu-hu_0d0c505328acbdc3.cdf-ms Handle ID: 0x123c Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_boot_efi_ex_hr-hr_0d0c4aa128acc64b.cdf-ms Handle ID: 0x123c Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_boot_efi_ex_fr-fr_0d0c4a9d28aac5df.cdf-ms Handle ID: 0x123c Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_boot_efi_ex_fr-ca_0d0c4a9728aac5e9.cdf-ms Handle ID: 0x123c Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_boot_efi_ex_fi-fi_0d0c398728aadf77.cdf-ms Handle ID: 0x123c Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_boot_efi_ex_et-ee_0d0c4e6728a9bfea.cdf-ms Handle ID: 0x123c Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_boot_efi_ex_es-mx_0d0c4c9128a9c28e.cdf-ms Handle ID: 0x123c Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_boot_efi_ex_es-es_0d0c4c8128a9c2d1.cdf-ms Handle ID: 0x123c Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_boot_efi_ex_en-us_0d0c432328a9d07e.cdf-ms Handle ID: 0x123c Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_boot_efi_ex_en-gb_0d0c430728a9d0eb.cdf-ms Handle ID: 0x123c Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_boot_efi_ex_el-gr_0d0c3f3b28a9d6ad.cdf-ms Handle ID: 0x123c Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_boot_efi_ex_de-de_0d0c31eb28a8ea6b.cdf-ms Handle ID: 0x123c Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_boot_efi_ex_da-dk_0d0c2a5328a8f5d5.cdf-ms Handle ID: 0x123c Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_boot_efi_ex_cs-cz_0d0c4c7d28a7c26c.cdf-ms Handle ID: 0x123c Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_boot_efi_ex_bg-bg_0d0c35b328a6e44f.cdf-ms Handle ID: 0x123c Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_boot_efi_0f890f82be247f42.cdf-ms Handle ID: 0x123c Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_boot_efi_zh-tw_ed00671ec5ef6d14.cdf-ms Handle ID: 0x123c Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_boot_efi_zh-cn_ed005608c5ef86a4.cdf-ms Handle ID: 0x123c Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_boot_efi_uk-ua_e37fe6ecd4302db1.cdf-ms Handle ID: 0x123c Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_boot_efi_tr-tr_e1998e9cd709b2e5.cdf-ms Handle ID: 0x123c Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_boot_efi_sv-se_dfb2fdc4d9e38c94.cdf-ms Handle ID: 0x123c Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_boot_efi_sr-latn-rs_175a7056497f1cbd.cdf-ms Handle ID: 0x123c Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_boot_efi_sl-si_dfb306c4d9e37e06.cdf-ms Handle ID: 0x123c Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_boot_efi_sk-sk_dfb30ab4d9e37803.cdf-ms Handle ID: 0x123c Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_boot_efi_ru-ru_ddcca4aedcbd1219.cdf-ms Handle ID: 0x123c Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_boot_efi_ro-ro_ddcc9a22dcbd2149.cdf-ms Handle ID: 0x123c Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_boot_efi_pt-pt_d9ffb3b8e2707b6d.cdf-ms Handle ID: 0x123c Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_boot_efi_pt-br_d9ffafece2708111.cdf-ms Handle ID: 0x123c Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_boot_efi_pl-pl_d9ffa5a8e2708fad.cdf-ms Handle ID: 0x123c Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_boot_efi_nl-nl_d632b674e823f679.cdf-ms Handle ID: 0x123c Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_boot_efi_nb-no_d632bd8ee823eac4.cdf-ms Handle ID: 0x123c Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_boot_efi_lv-lv_d265d8d4edd743f5.cdf-ms Handle ID: 0x123c Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_boot_efi_lt-lt_d265d550edd74905.cdf-ms Handle ID: 0x123c Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_boot_efi_ko-kr_d07f5a9ef0b10088.cdf-ms Handle ID: 0x123c Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_boot_efi_ja-jp_ce98e130f38ab532.cdf-ms Handle ID: 0x123c Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_boot_efi_it-it_ccb26e82f6646337.cdf-ms Handle ID: 0x123c Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_boot_efi_hu-hu_cacbf8aaf93e1415.cdf-ms Handle ID: 0x123c Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_boot_efi_hr-hr_cacbf364f93e1bad.cdf-ms Handle ID: 0x123c Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_boot_efi_fr-fr_c6ff0430fef18279.cdf-ms Handle ID: 0x123c Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_boot_efi_fr-ca_c6fee3eafef1b2df.cdf-ms Handle ID: 0x123c Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_boot_efi_fi-fi_c6fef45efef19941.cdf-ms Handle ID: 0x123c Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_boot_efi_et-ee_c51873a101cb5b86.cdf-ms Handle ID: 0x123c Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_boot_efi_es-mx_c51897d701cb2522.cdf-ms Handle ID: 0x123c Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_boot_efi_es-es_c5188e5901cb3357.cdf-ms Handle ID: 0x123c Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_boot_efi_en-us_c5188f0d01cb31d2.cdf-ms Handle ID: 0x123c Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_boot_efi_en-gb_c5186ec701cb622d.cdf-ms Handle ID: 0x123c Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_boot_efi_el-gr_c5188d6f01cb33fb.cdf-ms Handle ID: 0x123c Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_boot_efi_de-de_c331fe2304a50a2d.cdf-ms Handle ID: 0x123c Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_boot_efi_da-dk_c3320a1704a4f7d3.cdf-ms Handle ID: 0x123c Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_boot_efi_cs-cz_c14bac6f077e8634.cdf-ms Handle ID: 0x123c Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_boot_efi_bg-bg_bf6512730a586be9.cdf-ms Handle ID: 0x123c Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_boot_dvd_ex_efi_en-us_91aa4a0627c21b4a.cdf-ms Handle ID: 0x123c Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_boot_dvd_efi_de3c4ceb52549e1c.cdf-ms Handle ID: 0x123c Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\$$_boot_dvd_efi_en-us_8245c3aed97c0844.cdf-ms Handle ID: 0x123c Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\sources.cdf-ms Handle ID: 0x123c Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\sources_recovery_fa3a0fbfbc08eda1.cdf-ms Handle ID: 0x123c Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\sources_recovery_en-us_38d0190271db68af.cdf-ms Handle ID: 0x123c Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\sources_en-us_2e88d920877a69ae.cdf-ms Handle ID: 0x123c Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\programdata.cdf-ms Handle ID: 0x123c Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\programdata_usoshared_logs_user_cc47ba2ac1c4ac78.cdf-ms Handle ID: 0x123c Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\programdata_usoshared_logs_system_1d654048a9eadf5a.cdf-ms Handle ID: 0x123c Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\programdata_usoprivate_f18983166baec8e8.cdf-ms Handle ID: 0x123c Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\programdata_microsoft_fe5c6d762edd2110.cdf-ms Handle ID: 0x123c Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\programdata_microsoft_windows_cae2264614449191.cdf-ms Handle ID: 0x123c Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\programdata_microsoft_windows_wer_temp_783673b09e921b6b.cdf-ms Handle ID: 0x123c Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\programdata_microsoft_windows_wer_reportqueue_9ca35f30fc68b178.cdf-ms Handle ID: 0x123c Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\programdata_microsoft_windows_wer_reportarchive_5449504010b82c41.cdf-ms Handle ID: 0x123c Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\FileMaps\programdata_microsoft_crypto_pcpksp_windowsaik_cb9775b914a8e5a2.cdf-ms Handle ID: 0x123c Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\sources\recovery\RecEnv.exe Handle ID: 0x123c Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\sources\recovery\RecHost.exe Handle ID: 0x123c Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\sources\recovery\SrtTel.dll Handle ID: 0x123c Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\sources\recovery\StartRep.exe Handle ID: 0x123c Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\sources\recovery\en-US\RecEnv.exe.mui Handle ID: 0x123c Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\sources\recovery\en-US\StartRep.exe.mui Handle ID: 0x123c Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\Boot\Fonts\chs_boot.ttf Handle ID: 0x123c Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\Boot\Fonts\cht_boot.ttf Handle ID: 0x123c Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\Boot\Fonts\jpn_boot.ttf Handle ID: 0x123c Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\Boot\Fonts\kor_boot.ttf Handle ID: 0x123c Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\Boot\Fonts\malgun_boot.ttf Handle ID: 0x123c Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\Boot\Fonts\malgunn_boot.ttf Handle ID: 0x123c Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\Boot\Fonts\meiryo_boot.ttf Handle ID: 0x123c Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\Boot\Fonts\meiryon_boot.ttf Handle ID: 0x123c Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\Boot\Fonts\msjh_boot.ttf Handle ID: 0x123c Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\Boot\Fonts\msjhn_boot.ttf Handle ID: 0x123c Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\Boot\Fonts\msyh_boot.ttf Handle ID: 0x123c Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\Boot\Fonts\msyhn_boot.ttf Handle ID: 0x123c Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\Boot\Fonts\segmono_boot.ttf Handle ID: 0x123c Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\Boot\Fonts\segoe_slboot.ttf Handle ID: 0x123c Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\Boot\Fonts\segoen_slboot.ttf Handle ID: 0x123c Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\Boot\Fonts\wgl4_boot.ttf Handle ID: 0x123c Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\Boot\Fonts_EX\chs_boot_EX.ttf Handle ID: 0x123c Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\Boot\Fonts_EX\cht_boot_EX.ttf Handle ID: 0x123c Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\Boot\Fonts_EX\jpn_boot_EX.ttf Handle ID: 0x123c Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\Boot\Fonts_EX\kor_boot_EX.ttf Handle ID: 0x123c Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\Boot\Fonts_EX\malgun_boot_EX.ttf Handle ID: 0x123c Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\Boot\Fonts_EX\malgunn_boot_EX.ttf Handle ID: 0x123c Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\Boot\Fonts_EX\meiryo_boot_EX.ttf Handle ID: 0x123c Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\Boot\Fonts_EX\meiryon_boot_EX.ttf Handle ID: 0x123c Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\Boot\Fonts_EX\msjh_boot_EX.ttf Handle ID: 0x123c Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\Boot\Fonts_EX\msjhn_boot_EX.ttf Handle ID: 0x123c Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\Boot\Fonts_EX\msyh_boot_EX.ttf Handle ID: 0x123c Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\Boot\Fonts_EX\msyhn_boot_EX.ttf Handle ID: 0x123c Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\Boot\Fonts_EX\segmono_boot_EX.ttf Handle ID: 0x123c Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\Boot\Fonts_EX\segoe_slboot_EX.ttf Handle ID: 0x123c Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\Boot\Fonts_EX\segoen_slboot_EX.ttf Handle ID: 0x123c Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\Boot\Fonts_EX\wgl4_boot_EX.ttf Handle ID: 0x123c Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\System32\AppExtAgent.dll Handle ID: 0x123c Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\System32\bcrypt.dll Handle ID: 0x123c Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\System32\bcryptprimitives.dll Handle ID: 0x123c Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\System32\BootMenuUX.dll Handle ID: 0x123c Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\System32\BootRec.exe Handle ID: 0x123c Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\System32\bootux.dll Handle ID: 0x123c Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\System32\CloudRecApi.dll Handle ID: 0x123c Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\System32\CloudRecSvc.exe Handle ID: 0x123c Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\System32\cmi2migxml.dll Handle ID: 0x123c Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\System32\cryptbase.dll Handle ID: 0x123c Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\System32\cryptsp.dll Handle ID: 0x123c Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\System32\csiagent.dll Handle ID: 0x123c Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\System32\dhcpcore.dll Handle ID: 0x123c Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\System32\dhcpcore6.dll Handle ID: 0x123c Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\System32\dhcpcsvc.dll Handle ID: 0x123c Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\System32\dhcpcsvc6.dll Handle ID: 0x123c Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\System32\diagER.dll Handle ID: 0x123c Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\System32\DiagnosticDataSettings.dll Handle ID: 0x123c Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\System32\DuCsps.dll Handle ID: 0x123c Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\System32\edgeIso.dll Handle ID: 0x123c Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\System32\Facilitator.dll Handle ID: 0x123c Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\System32\Faultrep.dll Handle ID: 0x123c Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\System32\fveapi.dll Handle ID: 0x123c Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\System32\fveapibase.dll Handle ID: 0x123c Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\System32\hwcompat.dll Handle ID: 0x123c Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\System32\hwcompat.txt Handle ID: 0x123c Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\System32\iertutil.dll Handle ID: 0x123c Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\System32\kerb3961.dll Handle ID: 0x123c Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\System32\kerberos.dll Handle ID: 0x123c Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\System32\kernel.appcore.dll Handle ID: 0x123c Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\System32\kernel32.dll Handle ID: 0x123c Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\System32\KernelBase.dll Handle ID: 0x123c Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\System32\localkdcsvc.dll Handle ID: 0x123c Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\System32\migcore.dll Handle ID: 0x123c Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\System32\mighost.exe Handle ID: 0x123c Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\System32\migisol.dll Handle ID: 0x123c Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\System32\migres.dll Handle ID: 0x123c Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\System32\migstore.dll Handle ID: 0x123c Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\System32\migsys.dll Handle ID: 0x123c Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\System32\msasn1.dll Handle ID: 0x123c Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\System32\msIso.dll Handle ID: 0x123c Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\System32\msvcp_win.dll Handle ID: 0x123c Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\System32\msvcrt.dll Handle ID: 0x123c Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\System32\MXEAgent.dll Handle ID: 0x123c Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\System32\ncsi.dll Handle ID: 0x123c Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\System32\netprofmsvc.dll Handle ID: 0x123c Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\System32\nlaapi.dll Handle ID: 0x123c Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\System32\nlmproxy.dll Handle ID: 0x123c Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\System32\nlmsprep.dll Handle ID: 0x123c Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\System32\offline.xml Handle ID: 0x123c Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\System32\pnppropmig.dll Handle ID: 0x123c Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\System32\ReAgent.dll Handle ID: 0x123c Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\System32\ReInfo.dll Handle ID: 0x123c Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\System32\ReserveManager.dll Handle ID: 0x123c Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\System32\ResetEngine.dll Handle ID: 0x123c Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\System32\ResetEngine.exe Handle ID: 0x123c Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\System32\ResetPluginHost.exe Handle ID: 0x123c Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\System32\ResetTelemetry.dll Handle ID: 0x123c Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\System32\rpcrt4.dll Handle ID: 0x123c Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\System32\sechost.dll Handle ID: 0x123c Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\System32\ServicingCommon.dll Handle ID: 0x123c Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\System32\setupplatform.dll Handle ID: 0x123c Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\System32\setupplatform.exe Handle ID: 0x123c Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\System32\srms.dat Handle ID: 0x123c Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\System32\sysreset.exe Handle ID: 0x123c Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\System32\tbs.dll Handle ID: 0x123c Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\System32\ucrtbase.dll Handle ID: 0x123c Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\System32\unbcl.dll Handle ID: 0x123c Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\System32\upgradeagent.dll Handle ID: 0x123c Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\System32\usoapi.dll Handle ID: 0x123c Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\System32\usocoreps.dll Handle ID: 0x123c Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\System32\usodocked.dll Handle ID: 0x123c Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\System32\usosvc.dll Handle ID: 0x123c Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\System32\wdsutil.dll Handle ID: 0x123c Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\System32\wer.dll Handle ID: 0x123c Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\System32\werdiagcontroller.dll Handle ID: 0x123c Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\System32\WerEnc.dll Handle ID: 0x123c Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\System32\weretw.dll Handle ID: 0x123c Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\System32\WerFault.exe Handle ID: 0x123c Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\System32\WerFaultSecure.exe Handle ID: 0x123c Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\System32\wermgr.exe Handle ID: 0x123c Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\System32\win32k.sys Handle ID: 0x123c Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\System32\win32kbase.sys Handle ID: 0x123c Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\System32\win32kbase_rs.sys Handle ID: 0x123c Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\System32\win32kfull.sys Handle ID: 0x123c Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\System32\win32u.dll Handle ID: 0x123c Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\System32\Windows.Management.Update.dll Handle ID: 0x123c Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\System32\WindowsCodecs.dll Handle ID: 0x123c Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\System32\winpeshl.exe Handle ID: 0x123c Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\System32\WinSetupBak.hiv Handle ID: 0x123c Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\System32\WinSetupBak.sys Handle ID: 0x123c Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\System32\WinSetupMon.hiv Handle ID: 0x123c Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\System32\WinSetupMon.sys Handle ID: 0x123c Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\System32\wpeinit.exe Handle ID: 0x123c Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\System32\wpeutil.dll Handle ID: 0x123c Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\System32\wpeutil.exe Handle ID: 0x123c Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\System32\ws2_32.dll Handle ID: 0x123c Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\System32\Dism\DismCore.dll Handle ID: 0x123c Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\System32\Dism\DismCorePS.dll Handle ID: 0x123c Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\System32\Dism\DismProv.dll Handle ID: 0x123c Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\System32\Dism\DUTProvider.dll Handle ID: 0x123c Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\System32\Dism\FolderProvider.dll Handle ID: 0x123c Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\System32\Dism\LogProvider.dll Handle ID: 0x123c Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\System32\Dism\en-US\DUTProvider.dll.mui Handle ID: 0x123c Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\System32\downlevel\api-ms-win-core-comm-l1-1-0.dll Handle ID: 0x123c Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\System32\downlevel\api-ms-win-core-console-l1-1-0.dll Handle ID: 0x123c Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\System32\downlevel\api-ms-win-core-datetime-l1-1-0.dll Handle ID: 0x123c Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\System32\downlevel\api-ms-win-core-datetime-l1-1-1.dll Handle ID: 0x123c Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\System32\downlevel\api-ms-win-core-debug-l1-1-0.dll Handle ID: 0x123c Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\System32\downlevel\api-ms-win-core-debug-l1-1-1.dll Handle ID: 0x123c Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\System32\downlevel\api-ms-win-core-delayload-l1-1-0.dll Handle ID: 0x123c Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\System32\downlevel\api-ms-win-core-errorhandling-l1-1-0.dll Handle ID: 0x123c Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\System32\downlevel\api-ms-win-core-errorhandling-l1-1-1.dll Handle ID: 0x123c Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\System32\downlevel\api-ms-win-core-fibers-l1-1-0.dll Handle ID: 0x123c Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\System32\downlevel\api-ms-win-core-fibers-l1-1-1.dll Handle ID: 0x123c Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\System32\downlevel\api-ms-win-core-file-l1-1-0.dll Handle ID: 0x123c Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\System32\downlevel\api-ms-win-core-file-l1-2-0.dll Handle ID: 0x123c Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\System32\downlevel\api-ms-win-core-file-l1-2-1.dll Handle ID: 0x123c Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\System32\downlevel\api-ms-win-core-handle-l1-1-0.dll Handle ID: 0x123c Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\System32\downlevel\api-ms-win-core-heap-l1-1-0.dll Handle ID: 0x123c Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\System32\downlevel\api-ms-win-core-interlocked-l1-1-0.dll Handle ID: 0x123c Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\System32\downlevel\api-ms-win-core-io-l1-1-0.dll Handle ID: 0x123c Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\System32\downlevel\api-ms-win-core-io-l1-1-1.dll Handle ID: 0x123c Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\System32\downlevel\api-ms-win-core-libraryloader-l1-1-0.dll Handle ID: 0x123c Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\System32\downlevel\api-ms-win-core-libraryloader-l1-1-1.dll Handle ID: 0x123c Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\System32\downlevel\api-ms-win-core-localization-l1-2-0.dll Handle ID: 0x123c Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\System32\downlevel\api-ms-win-core-localization-l1-2-1.dll Handle ID: 0x123c Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\System32\downlevel\API-MS-Win-core-localization-obsolete-l1-2-0.dll Handle ID: 0x123c Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\System32\downlevel\api-ms-win-core-memory-l1-1-0.dll Handle ID: 0x123c Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\System32\downlevel\api-ms-win-core-memory-l1-1-1.dll Handle ID: 0x123c Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\System32\downlevel\api-ms-win-core-memory-l1-1-2.dll Handle ID: 0x123c Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\System32\downlevel\api-ms-win-core-namedpipe-l1-1-0.dll Handle ID: 0x123c Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\System32\downlevel\api-ms-win-core-processenvironment-l1-1-0.dll Handle ID: 0x123c Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\System32\downlevel\api-ms-win-core-processenvironment-l1-2-0.dll Handle ID: 0x123c Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\System32\downlevel\api-ms-win-core-processthreads-l1-1-0.dll Handle ID: 0x123c Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\System32\downlevel\api-ms-win-core-processthreads-l1-1-1.dll Handle ID: 0x123c Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\System32\downlevel\api-ms-win-core-processthreads-l1-1-2.dll Handle ID: 0x123c Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\System32\downlevel\api-ms-win-core-profile-l1-1-0.dll Handle ID: 0x123c Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\System32\downlevel\api-ms-win-core-realtime-l1-1-0.dll Handle ID: 0x123c Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\System32\downlevel\api-ms-win-core-registry-l1-1-0.dll Handle ID: 0x123c Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\System32\downlevel\api-ms-win-core-rtlsupport-l1-1-0.dll Handle ID: 0x123c Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\System32\downlevel\api-ms-win-core-string-l1-1-0.dll Handle ID: 0x123c Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\System32\downlevel\api-ms-win-core-stringloader-l1-1-1.dll Handle ID: 0x123c Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\System32\downlevel\api-ms-win-core-synch-l1-1-0.dll Handle ID: 0x123c Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\System32\downlevel\api-ms-win-core-synch-l1-2-0.dll Handle ID: 0x123c Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\System32\downlevel\api-ms-win-core-sysinfo-l1-1-0.dll Handle ID: 0x123c Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\System32\downlevel\api-ms-win-core-sysinfo-l1-2-0.dll Handle ID: 0x123c Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\System32\downlevel\api-ms-win-core-sysinfo-l1-2-1.dll Handle ID: 0x123c Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\System32\downlevel\api-ms-win-core-threadpool-l1-2-0.dll Handle ID: 0x123c Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\System32\downlevel\api-ms-win-core-threadpool-legacy-l1-1-0.dll Handle ID: 0x123c Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\System32\downlevel\api-ms-win-core-threadpool-private-l1-1-0.dll Handle ID: 0x123c Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\System32\downlevel\api-ms-win-core-timezone-l1-1-0.dll Handle ID: 0x123c Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\System32\downlevel\api-ms-win-core-util-l1-1-0.dll Handle ID: 0x123c Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\System32\downlevel\api-ms-win-core-wow64-l1-1-0.dll Handle ID: 0x123c Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\System32\downlevel\api-ms-win-core-xstate-l1-1-0.dll Handle ID: 0x123c Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\System32\downlevel\api-ms-win-crt-conio-l1-1-0.dll Handle ID: 0x123c Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\System32\downlevel\api-ms-win-crt-convert-l1-1-0.dll Handle ID: 0x123c Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\System32\downlevel\api-ms-win-crt-environment-l1-1-0.dll Handle ID: 0x123c Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\System32\downlevel\api-ms-win-crt-filesystem-l1-1-0.dll Handle ID: 0x123c Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\System32\downlevel\api-ms-win-crt-heap-l1-1-0.dll Handle ID: 0x123c Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\System32\downlevel\api-ms-win-crt-locale-l1-1-0.dll Handle ID: 0x123c Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\System32\downlevel\api-ms-win-crt-math-l1-1-0.dll Handle ID: 0x123c Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\System32\downlevel\api-ms-win-crt-multibyte-l1-1-0.dll Handle ID: 0x123c Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\System32\downlevel\api-ms-win-crt-private-l1-1-0.dll Handle ID: 0x123c Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\System32\downlevel\api-ms-win-crt-process-l1-1-0.dll Handle ID: 0x123c Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\System32\downlevel\api-ms-win-crt-runtime-l1-1-0.dll Handle ID: 0x123c Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\System32\downlevel\api-ms-win-crt-stdio-l1-1-0.dll Handle ID: 0x123c Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\System32\downlevel\api-ms-win-crt-string-l1-1-0.dll Handle ID: 0x123c Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\System32\downlevel\api-ms-win-crt-time-l1-1-0.dll Handle ID: 0x123c Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\System32\downlevel\api-ms-win-crt-utility-l1-1-0.dll Handle ID: 0x123c Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\System32\downlevel\api-ms-win-security-base-l1-1-0.dll Handle ID: 0x123c Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\System32\downlevel\api-ms-win-service-core-l1-1-0.dll Handle ID: 0x123c Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\System32\downlevel\api-ms-win-service-core-l1-1-1.dll Handle ID: 0x123c Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\System32\downlevel\api-ms-win-service-management-l1-1-0.dll Handle ID: 0x123c Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\System32\downlevel\api-ms-win-service-management-l2-1-0.dll Handle ID: 0x123c Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\System32\downlevel\api-ms-win-service-private-l1-1-0.dll Handle ID: 0x123c Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\System32\downlevel\api-ms-win-service-private-l1-1-1.dll Handle ID: 0x123c Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\System32\downlevel\api-ms-win-service-winsvc-l1-1-0.dll Handle ID: 0x123c Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\System32\downlevel\ucrtbase.dll Handle ID: 0x123c Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\System32\drivers\tbs.sys Handle ID: 0x123c Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\System32\drivers\Ucx01000.sys Handle ID: 0x123c Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\System32\drivers\en-US\tcpip.sys.mui Handle ID: 0x123c Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\System32\en-US\BootRec.exe.mui Handle ID: 0x123c Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\System32\en-US\bootux.dll.mui Handle ID: 0x123c Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\System32\en-US\faultrep.dll.mui Handle ID: 0x1238 Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\System32\en-US\migres.dll.mui Handle ID: 0x1238 Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\System32\en-US\setupplatform.exe.mui Handle ID: 0x1238 Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\System32\en-US\usosvc.dll.mui Handle ID: 0x1238 Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\System32\en-US\wer.dll.mui Handle ID: 0x123c Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\System32\en-US\WerFault.exe.mui Handle ID: 0x123c Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\System32\en-US\WerFaultSecure.exe.mui Handle ID: 0x123c Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\System32\en-US\win32kbase.sys.mui Handle ID: 0x123c Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\System32\en-US\winpeshl.exe.mui Handle ID: 0x123c Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\System32\en-US\wpeutil.dll.mui Handle ID: 0x123c Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\SysWOW64\bcrypt.dll Handle ID: 0x123c Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\SysWOW64\bcryptprimitives.dll Handle ID: 0x123c Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\SysWOW64\cryptsp.dll Handle ID: 0x123c Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\SysWOW64\dhcpcore.dll Handle ID: 0x13a8 Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\SysWOW64\dhcpcore6.dll Handle ID: 0x13a8 Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\SysWOW64\dhcpcsvc.dll Handle ID: 0x13a8 Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\SysWOW64\dhcpcsvc6.dll Handle ID: 0x13a8 Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\SysWOW64\DiagnosticDataSettings.dll Handle ID: 0x13a8 Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\SysWOW64\Faultrep.dll Handle ID: 0x13a8 Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\SysWOW64\fveapi.dll Handle ID: 0x123c Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\SysWOW64\fveapibase.dll Handle ID: 0x123c Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\SysWOW64\kerb3961.dll Handle ID: 0x123c Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\SysWOW64\kerberos.dll Handle ID: 0x123c Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\SysWOW64\KernelBase.dll Handle ID: 0x123c Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\SysWOW64\msasn1.dll Handle ID: 0x123c Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\SysWOW64\msvcp_win.dll Handle ID: 0x123c Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\SysWOW64\ServicingCommon.dll Handle ID: 0x123c Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\SysWOW64\ucrtbase.dll Handle ID: 0x123c Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\SysWOW64\wer.dll Handle ID: 0x123c Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\SysWOW64\werdiagcontroller.dll Handle ID: 0x123c Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\SysWOW64\WerEnc.dll Handle ID: 0x123c Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\SysWOW64\weretw.dll Handle ID: 0x123c Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\SysWOW64\WerFault.exe Handle ID: 0x123c Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\SysWOW64\WerFaultSecure.exe Handle ID: 0x123c Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\SysWOW64\wermgr.exe Handle ID: 0x123c Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\SysWOW64\win32u.dll Handle ID: 0x123c Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\SysWOW64\Dism\DismCore.dll Handle ID: 0x123c Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\SysWOW64\Dism\DismCorePS.dll Handle ID: 0x123c Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\SysWOW64\Dism\DismProv.dll Handle ID: 0x123c Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\SysWOW64\Dism\FolderProvider.dll Handle ID: 0x123c Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\SysWOW64\Dism\LogProvider.dll Handle ID: 0x123c Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\SysWOW64\downlevel\api-ms-win-core-comm-l1-1-0.dll Handle ID: 0x123c Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\SysWOW64\downlevel\api-ms-win-core-console-l1-1-0.dll Handle ID: 0x123c Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\SysWOW64\downlevel\api-ms-win-core-datetime-l1-1-0.dll Handle ID: 0x123c Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\SysWOW64\downlevel\api-ms-win-core-datetime-l1-1-1.dll Handle ID: 0x123c Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\SysWOW64\downlevel\api-ms-win-core-debug-l1-1-0.dll Handle ID: 0x123c Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\SysWOW64\downlevel\api-ms-win-core-debug-l1-1-1.dll Handle ID: 0x123c Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\SysWOW64\downlevel\api-ms-win-core-delayload-l1-1-0.dll Handle ID: 0x123c Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\SysWOW64\downlevel\api-ms-win-core-errorhandling-l1-1-0.dll Handle ID: 0x123c Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\SysWOW64\downlevel\api-ms-win-core-errorhandling-l1-1-1.dll Handle ID: 0x123c Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\SysWOW64\downlevel\api-ms-win-core-fibers-l1-1-0.dll Handle ID: 0x123c Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\SysWOW64\downlevel\api-ms-win-core-fibers-l1-1-1.dll Handle ID: 0x123c Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\SysWOW64\downlevel\api-ms-win-core-file-l1-1-0.dll Handle ID: 0x123c Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\SysWOW64\downlevel\api-ms-win-core-file-l1-2-0.dll Handle ID: 0x123c Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\SysWOW64\downlevel\api-ms-win-core-file-l1-2-1.dll Handle ID: 0x123c Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\SysWOW64\downlevel\api-ms-win-core-handle-l1-1-0.dll Handle ID: 0x123c Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\SysWOW64\downlevel\api-ms-win-core-heap-l1-1-0.dll Handle ID: 0x123c Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\SysWOW64\downlevel\api-ms-win-core-interlocked-l1-1-0.dll Handle ID: 0x123c Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\SysWOW64\downlevel\api-ms-win-core-io-l1-1-0.dll Handle ID: 0x123c Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\SysWOW64\downlevel\api-ms-win-core-io-l1-1-1.dll Handle ID: 0x123c Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\SysWOW64\downlevel\api-ms-win-core-libraryloader-l1-1-0.dll Handle ID: 0x123c Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\SysWOW64\downlevel\api-ms-win-core-libraryloader-l1-1-1.dll Handle ID: 0x123c Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\SysWOW64\downlevel\api-ms-win-core-localization-l1-2-0.dll Handle ID: 0x123c Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\SysWOW64\downlevel\api-ms-win-core-localization-l1-2-1.dll Handle ID: 0x13a8 Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\SysWOW64\downlevel\API-MS-Win-core-localization-obsolete-l1-2-0.dll Handle ID: 0x13a8 Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\SysWOW64\downlevel\api-ms-win-core-memory-l1-1-0.dll Handle ID: 0x13a8 Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\SysWOW64\downlevel\api-ms-win-core-memory-l1-1-1.dll Handle ID: 0x13a8 Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\SysWOW64\downlevel\api-ms-win-core-memory-l1-1-2.dll Handle ID: 0x13a8 Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\SysWOW64\downlevel\api-ms-win-core-namedpipe-l1-1-0.dll Handle ID: 0x13a8 Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\SysWOW64\downlevel\api-ms-win-core-processenvironment-l1-1-0.dll Handle ID: 0x13a8 Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\SysWOW64\downlevel\api-ms-win-core-processenvironment-l1-2-0.dll Handle ID: 0x13a8 Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\SysWOW64\downlevel\api-ms-win-core-processthreads-l1-1-0.dll Handle ID: 0x13a8 Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\SysWOW64\downlevel\api-ms-win-core-processthreads-l1-1-1.dll Handle ID: 0x13a8 Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\SysWOW64\downlevel\api-ms-win-core-processthreads-l1-1-2.dll Handle ID: 0x13a8 Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\SysWOW64\downlevel\api-ms-win-core-profile-l1-1-0.dll Handle ID: 0x13a8 Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\SysWOW64\downlevel\api-ms-win-core-realtime-l1-1-0.dll Handle ID: 0x13a8 Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\SysWOW64\downlevel\api-ms-win-core-registry-l1-1-0.dll Handle ID: 0x13a8 Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\SysWOW64\downlevel\api-ms-win-core-rtlsupport-l1-1-0.dll Handle ID: 0x13a8 Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\SysWOW64\downlevel\api-ms-win-core-string-l1-1-0.dll Handle ID: 0x13a8 Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\SysWOW64\downlevel\api-ms-win-core-stringloader-l1-1-1.dll Handle ID: 0x13a8 Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\SysWOW64\downlevel\api-ms-win-core-synch-l1-1-0.dll Handle ID: 0x13a8 Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\SysWOW64\downlevel\api-ms-win-core-synch-l1-2-0.dll Handle ID: 0x13a8 Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\SysWOW64\downlevel\api-ms-win-core-sysinfo-l1-1-0.dll Handle ID: 0x13a8 Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\SysWOW64\downlevel\api-ms-win-core-sysinfo-l1-2-0.dll Handle ID: 0x13a8 Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\SysWOW64\downlevel\api-ms-win-core-sysinfo-l1-2-1.dll Handle ID: 0x13a8 Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\SysWOW64\downlevel\api-ms-win-core-threadpool-l1-2-0.dll Handle ID: 0x13a8 Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\SysWOW64\downlevel\api-ms-win-core-threadpool-legacy-l1-1-0.dll Handle ID: 0x13a8 Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\SysWOW64\downlevel\api-ms-win-core-threadpool-private-l1-1-0.dll Handle ID: 0x13a8 Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\SysWOW64\downlevel\api-ms-win-core-timezone-l1-1-0.dll Handle ID: 0x13a8 Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\SysWOW64\downlevel\api-ms-win-core-util-l1-1-0.dll Handle ID: 0x13a8 Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\SysWOW64\downlevel\api-ms-win-core-wow64-l1-1-0.dll Handle ID: 0x13a8 Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\SysWOW64\downlevel\api-ms-win-core-xstate-l1-1-0.dll Handle ID: 0x13a8 Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\SysWOW64\downlevel\api-ms-win-crt-conio-l1-1-0.dll Handle ID: 0x13a8 Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\SysWOW64\downlevel\api-ms-win-crt-convert-l1-1-0.dll Handle ID: 0x13a8 Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\SysWOW64\downlevel\api-ms-win-crt-environment-l1-1-0.dll Handle ID: 0x13a8 Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\SysWOW64\downlevel\api-ms-win-crt-filesystem-l1-1-0.dll Handle ID: 0x13a8 Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\SysWOW64\downlevel\api-ms-win-crt-heap-l1-1-0.dll Handle ID: 0x13a8 Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\SysWOW64\downlevel\api-ms-win-crt-locale-l1-1-0.dll Handle ID: 0x13a8 Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\SysWOW64\downlevel\api-ms-win-crt-math-l1-1-0.dll Handle ID: 0x13a8 Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\SysWOW64\downlevel\api-ms-win-crt-multibyte-l1-1-0.dll Handle ID: 0xde4 Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\SysWOW64\downlevel\api-ms-win-crt-private-l1-1-0.dll Handle ID: 0x9ac Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\SysWOW64\downlevel\api-ms-win-crt-process-l1-1-0.dll Handle ID: 0x9ac Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\SysWOW64\downlevel\api-ms-win-crt-runtime-l1-1-0.dll Handle ID: 0x9ac Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\SysWOW64\downlevel\api-ms-win-crt-stdio-l1-1-0.dll Handle ID: 0x1204 Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\SysWOW64\downlevel\api-ms-win-crt-string-l1-1-0.dll Handle ID: 0x1204 Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\SysWOW64\downlevel\api-ms-win-crt-time-l1-1-0.dll Handle ID: 0x1204 Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\SysWOW64\downlevel\api-ms-win-crt-utility-l1-1-0.dll Handle ID: 0x1204 Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\SysWOW64\downlevel\api-ms-win-security-base-l1-1-0.dll Handle ID: 0x11d0 Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\SysWOW64\downlevel\api-ms-win-service-core-l1-1-0.dll Handle ID: 0x11d0 Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\SysWOW64\downlevel\api-ms-win-service-core-l1-1-1.dll Handle ID: 0x11cc Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\SysWOW64\downlevel\api-ms-win-service-management-l1-1-0.dll Handle ID: 0x1210 Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\SysWOW64\downlevel\api-ms-win-service-management-l2-1-0.dll Handle ID: 0x1210 Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\SysWOW64\downlevel\api-ms-win-service-private-l1-1-0.dll Handle ID: 0x1210 Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\SysWOW64\downlevel\api-ms-win-service-private-l1-1-1.dll Handle ID: 0x1210 Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\SysWOW64\downlevel\api-ms-win-service-winsvc-l1-1-0.dll Handle ID: 0x1210 Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\SysWOW64\downlevel\ucrtbase.dll Handle ID: 0x1210 Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\UUS\amd64\MoUsoCoreWorker.exe Handle ID: 0x1210 Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\UUS\amd64\usosvcimpl.dll Handle ID: 0x1210 Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:30:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\$WinREAgent\Scratch\Mount\Windows\WaaS\services\43ee7b2a373632f9a701249fd96d0edec2ff1279.xml Handle ID: 0x1210 Process Information: Process ID: 0x1038 Process Name: C:\$WinREAgent\Scratch\82A722F5-6900-4F2D-BBA9-F000CD77A78B\DismHost.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 12544 | 2025-11-29 09:31:09 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4d4 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12548 | 2025-11-29 09:31:09 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12544 | 2025-11-29 09:31:10 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4d4 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12548 | 2025-11-29 09:31:10 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12544 | 2025-11-29 09:31:26 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4d4 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12548 | 2025-11-29 09:31:26 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12544 | 2025-11-29 09:32:15 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4d4 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12548 | 2025-11-29 09:32:15 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 13568 | 2025-11-29 09:32:24 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Shared-C96391D8C1EC2830A050B58DD4D67986A7CFF6A951051505C179DAA7C19FAC17~31bf3856ad364e35~amd64~~10.0.26100.7010.cat Handle ID: 0x12b4 Process Information: Process ID: 0x1828 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.5074_none_a5532eb7772ad4c4\TiWorker.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:32:25 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\_0000000000000000.cdf-ms Handle ID: 0x1838 Process Information: Process ID: 0x1828 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.5074_none_a5532eb7772ad4c4\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:32:25 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$.cdf-ms Handle ID: 0x1838 Process Information: Process ID: 0x1828 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.5074_none_a5532eb7772ad4c4\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:32:25 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_syswow64_21ffbdd2a2dd92e0.cdf-ms Handle ID: 0x1838 Process Information: Process ID: 0x1828 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.5074_none_a5532eb7772ad4c4\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:32:25 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_syswow64_advancedinstallers_0c6bb4866bff02f7.cdf-ms Handle ID: 0x1838 Process Information: Process ID: 0x1828 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.5074_none_a5532eb7772ad4c4\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:32:25 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_system32_21f9a9c4a2f8b514.cdf-ms Handle ID: 0x1838 Process Information: Process ID: 0x1828 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.5074_none_a5532eb7772ad4c4\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:32:25 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_system32_advancedinstallers_dfe2cf200b391371.cdf-ms Handle ID: 0x1838 Process Information: Process ID: 0x1828 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.5074_none_a5532eb7772ad4c4\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:32:25 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_servicing_fc2045b9046cc796.cdf-ms Handle ID: 0x1838 Process Information: Process ID: 0x1828 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.5074_none_a5532eb7772ad4c4\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:32:25 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_servicing_version_10.0.26100.7010_8bf004db831e9b2e.cdf-ms Handle ID: 0x21a8 Process Information: Process ID: 0x1828 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.5074_none_a5532eb7772ad4c4\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:32:25 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_servicing_sqm_51d9d5f9de5a2fa5.cdf-ms Handle ID: 0x21a8 Process Information: Process ID: 0x1828 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.5074_none_a5532eb7772ad4c4\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:32:25 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_servicing_sessions_5591aee9e2456a35.cdf-ms Handle ID: 0x21a8 Process Information: Process ID: 0x1828 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.5074_none_a5532eb7772ad4c4\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:32:25 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_servicing_packages_46c20bc5f833cc43.cdf-ms Handle ID: 0x21a8 Process Information: Process ID: 0x1828 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.5074_none_a5532eb7772ad4c4\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:32:25 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_logs_cbs_10a752bcbbaee88b.cdf-ms Handle ID: 0x21a8 Process Information: Process ID: 0x1828 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.5074_none_a5532eb7772ad4c4\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:32:25 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\poqexec.exe Handle ID: 0x21a8 Process Information: Process ID: 0x1828 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.5074_none_a5532eb7772ad4c4\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:32:25 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\poqexec.exe Handle ID: 0x21a8 Process Information: Process ID: 0x1828 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.5074_none_a5532eb7772ad4c4\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 12544 | 2025-11-29 09:32:53 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4d4 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12548 | 2025-11-29 09:32:53 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12544 | 2025-11-29 09:32:56 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4d4 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12548 | 2025-11-29 09:32:56 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 13824 | 2025-11-29 09:33:11 | | Microsoft-Windows-Security-Auditing | 5382: Vault credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x6033c This event occurs when a user reads a stored vault credential.
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:27 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Package_for_RollupFix~31bf3856ad364e35~amd64~~26100.7171.1.16.cat Handle ID: 0x3910 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:27 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Package_for_RollupFix~31bf3856ad364e35~amd64~~26100.7171.1.16.mum Handle ID: 0xc960 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:27 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-ProfessionalEdition-Wrapper~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0x4af4 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:27 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-ProfessionalEdition-Wrapper~31bf3856ad364e35~amd64~~10.0.26100.7171.mum Handle ID: 0x195e0 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:27 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-ProfessionalEdition~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0x7a14 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:27 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-ProfessionalEdition~31bf3856ad364e35~amd64~~10.0.26100.7171.mum Handle ID: 0xc960 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:27 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-EditionSpecific-Professional-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0xcaa0 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:27 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-EditionSpecific-Professional-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.mum Handle ID: 0x938c Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:27 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Client-License-Platform-Device-Licensing-Service-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0x9200 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:27 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Client-License-Platform-Device-Licensing-Service-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.mum Handle ID: 0x9638 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:27 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Client-License-Platform-Upgrade-Subscription-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x9704 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:27 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Client-License-Platform-Upgrade-Subscription-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.mum Handle ID: 0x7a14 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:27 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-OSClient-Layer-Data-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0x9270 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:27 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-OSClient-Layer-Data-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.mum Handle ID: 0x7a14 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:27 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Editions-Professional-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0x7a14 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:27 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Editions-Professional-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.mum Handle ID: 0x7a14 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:27 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Licenses-Professional-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0xbb5c Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:27 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Licenses-Professional-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.mum Handle ID: 0x938c Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:27 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Licenses-IoTEnterprise-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0x7894 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:27 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Licenses-IoTEnterprise-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.mum Handle ID: 0x9704 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:27 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Licenses-IoTEnterpriseK-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0x9718 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:27 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Licenses-IoTEnterpriseK-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.mum Handle ID: 0x9270 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:27 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Management-SecureAssessment-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0xbb58 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:27 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Management-SecureAssessment-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.mum Handle ID: 0xbb5c Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:27 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Professional-SPP-Components-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x971c Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:27 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Professional-SPP-Components-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.mum Handle ID: 0xcb4c Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:27 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Security-SPP-Component-SKU-Enterprise-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x9780 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:27 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Security-SPP-Component-SKU-Enterprise-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.mum Handle ID: 0x9718 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:27 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Security-SPP-Component-SKU-Enterprise-License-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x96f0 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:27 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Security-SPP-Component-SKU-Enterprise-License-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.mum Handle ID: 0x4af4 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:27 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Security-SPP-Component-SKU-Enterprise-Default-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x7b0c Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:27 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Security-SPP-Component-SKU-Enterprise-Default-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.mum Handle ID: 0x971c Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:27 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Security-SPP-Component-SKU-Education-License-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x7b58 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:27 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Security-SPP-Component-SKU-Education-License-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.mum Handle ID: 0x9780 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:27 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Security-SPP-Component-SKU-ProfessionalCountrySpecific-License-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x7b90 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:27 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Security-SPP-Component-SKU-ProfessionalCountrySpecific-License-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.mum Handle ID: 0x96f0 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:27 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Security-SPP-Component-SKU-ProfessionalEducation-License-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0xb1e8 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:27 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Security-SPP-Component-SKU-ProfessionalEducation-License-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.mum Handle ID: 0x195e0 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:28 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Security-SPP-Component-SKU-ProfessionalSingleLanguage-License-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x193e0 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:28 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Security-SPP-Component-SKU-ProfessionalSingleLanguage-License-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.mum Handle ID: 0x7b0c Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:28 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Security-SPP-Component-SKU-ProfessionalWorkstation-License-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x1c7c4 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:28 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Security-SPP-Component-SKU-ProfessionalWorkstation-License-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.mum Handle ID: 0x7b58 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:28 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Security-SPP-Component-SKU-Professional-License-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x7a44 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:28 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Security-SPP-Component-SKU-Professional-License-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.mum Handle ID: 0x7b90 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:28 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Security-SPP-Component-SKU-IoTEnterprise-License-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x9658 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:28 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Security-SPP-Component-SKU-IoTEnterprise-License-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.mum Handle ID: 0x193e0 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:28 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Security-SPP-Component-SKU-IoTEnterpriseK-License-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x193d0 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:28 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Security-SPP-Component-SKU-IoTEnterpriseK-License-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.mum Handle ID: 0x1c7c4 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:28 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Security-SPP-Component-SKU-ServerRdsh-License-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x1be44 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:28 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Security-SPP-Component-SKU-ServerRdsh-License-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.mum Handle ID: 0x3ca8 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:28 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Security-SPP-Component-SKU-CloudEdition-License-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x77b8 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:28 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Security-SPP-Component-SKU-CloudEdition-License-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.mum Handle ID: 0x708 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:28 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-SenseClient-Task-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0xbb48 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:28 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-SenseClient-Task-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.mum Handle ID: 0x708 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:28 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\UserExperience-Desktop-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0x92a4 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:28 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\UserExperience-Desktop-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.mum Handle ID: 0x1be44 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:28 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Client-Desktop-Required-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0x4d6c Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:28 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Client-Desktop-Required-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.mum Handle ID: 0x77b8 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:28 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-User-Choice-Protection-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0xa30 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:28 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-User-Choice-Protection-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.mum Handle ID: 0xb1ec Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:28 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Client-Desktop-Required-Package00~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0xbb48 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:28 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Client-Desktop-Required-Package00~31bf3856ad364e35~amd64~~10.0.26100.7019.mum Handle ID: 0xbb48 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:28 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Client-Desktop-Required-Package01~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0x1b2f0 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:28 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Client-Desktop-Required-Package01~31bf3856ad364e35~amd64~~10.0.26100.7171.mum Handle ID: 0x77b8 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:28 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Desktop-Required-ClientOnly-SharedWithServer-removable-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x1aeec Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:28 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Desktop-Required-ClientOnly-SharedWithServer-removable-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.mum Handle ID: 0x2fd4 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:28 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-PEAuth-OneCore-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x7498 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:28 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-PEAuth-OneCore-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.mum Handle ID: 0x501c Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:28 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Client-Desktop-Required-Package0110~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x77ec Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:28 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Client-Desktop-Required-Package0110~31bf3856ad364e35~amd64~~10.0.26100.7019.mum Handle ID: 0x77b8 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:28 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Client-Desktop-Required-Package0111~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0x7498 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:28 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Client-Desktop-Required-Package0111~31bf3856ad364e35~amd64~~10.0.26100.7171.mum Handle ID: 0x1c100 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:28 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Client-Desktop-Required-Package011120~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0x19d74 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:28 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Client-Desktop-Required-Package011120~31bf3856ad364e35~amd64~~10.0.26100.7171.mum Handle ID: 0x1b2f0 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:28 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Kernel-Package-Acpi-Pci-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0xd354 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:28 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Kernel-Package-Acpi-Pci-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.mum Handle ID: 0x1aeec Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:28 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Kernel-Package-Processor-Drivers-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x9b8 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:28 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Kernel-Package-Processor-Drivers-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.mum Handle ID: 0x1aeec Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:28 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Client-Desktop-Required-Package01112030~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x73f8 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:28 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Client-Desktop-Required-Package01112030~31bf3856ad364e35~amd64~~10.0.26100.7019.mum Handle ID: 0x19d74 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:28 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Kernel-Package-PDC-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x2cac Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:28 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Kernel-Package-PDC-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.mum Handle ID: 0xd354 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Client-Desktop-Required-Package0112~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0x9e38 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Client-Desktop-Required-Package0112~31bf3856ad364e35~amd64~~10.0.26100.7171.mum Handle ID: 0x9b8 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Client-Desktop-Required-Package02~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0x9d1c Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Client-Desktop-Required-Package02~31bf3856ad364e35~amd64~~10.0.26100.7171.mum Handle ID: 0x73f8 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Client-Desktop-Required-Package03~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0x9d14 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Client-Desktop-Required-Package03~31bf3856ad364e35~amd64~~10.0.26100.7171.mum Handle ID: 0x2cac Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\UserExperience-Recall-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0xf80 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\UserExperience-Recall-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.mum Handle ID: 0x9e38 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\UserExperience-AIX-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0x9d0c Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\UserExperience-AIX-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.mum Handle ID: 0x7498 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Client-Desktop-Required-Package04~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0xf78 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Client-Desktop-Required-Package04~31bf3856ad364e35~amd64~~10.0.26100.7019.mum Handle ID: 0x9d14 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Client-Desktop-Required-Package05~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0x2ed4 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Client-Desktop-Required-Package05~31bf3856ad364e35~amd64~~10.0.26100.7171.mum Handle ID: 0xf80 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Desktop-Required-SharedWithServer-removable-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0xba78 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Desktop-Required-SharedWithServer-removable-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.mum Handle ID: 0xba78 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-OneCore-SystemSettings-Devices-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x750c Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-OneCore-SystemSettings-Devices-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.mum Handle ID: 0x193d0 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-OneCore-SystemSettings-NetworkMobileHandlers-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x33c4 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-OneCore-SystemSettings-NetworkMobileHandlers-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.mum Handle ID: 0x9d0c Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-UI-Shell-WindowTabManager-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0xce58 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-UI-Shell-WindowTabManager-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.mum Handle ID: 0x9d0c Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Client-Desktop-Required-Package0510~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0x8470 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Client-Desktop-Required-Package0510~31bf3856ad364e35~amd64~~10.0.26100.7171.mum Handle ID: 0x9658 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Client-Desktop-Required-Package0511~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0x32a4 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Client-Desktop-Required-Package0511~31bf3856ad364e35~amd64~~10.0.26100.7171.mum Handle ID: 0x33c4 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-OneCore-AppRuntime-removable-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x2ecc Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-OneCore-AppRuntime-removable-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.mum Handle ID: 0x2ed4 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-OneCore-RemoteDesktopServices-Collaboration-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x750c Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-OneCore-RemoteDesktopServices-Collaboration-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.mum Handle ID: 0x750c Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-OneCore-Graphics-Required-Core-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0xa30 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-OneCore-Graphics-Required-Core-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.mum Handle ID: 0xce58 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Client-Desktop-Required-Package051120~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x7be4 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Client-Desktop-Required-Package051120~31bf3856ad364e35~amd64~~10.0.26100.7019.mum Handle ID: 0x92a4 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Client-Desktop-Required-Package051121~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0x978c Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Client-Desktop-Required-Package051121~31bf3856ad364e35~amd64~~10.0.26100.7171.mum Handle ID: 0x8470 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Client-Desktop-Required-Package05112130~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x5754 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:29 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Client-Desktop-Required-Package05112130~31bf3856ad364e35~amd64~~10.0.26100.7019.mum Handle ID: 0x97b0 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:30 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Client-Desktop-Required-Package0512~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0x2ec8 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:30 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Client-Desktop-Required-Package0512~31bf3856ad364e35~amd64~~10.0.26100.7171.mum Handle ID: 0x7be4 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:30 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-WindowsCoreHeadless-DeviceRuntime-removable-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0xc8cc Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:30 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-WindowsCoreHeadless-DeviceRuntime-removable-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.mum Handle ID: 0x32a4 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:30 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-OneCore-Connectivity-UsbConnectorManager-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x507c Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:30 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-OneCore-Connectivity-UsbConnectorManager-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.mum Handle ID: 0x977c Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:30 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-OneCore-SD-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x96a8 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:30 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-OneCore-SD-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.mum Handle ID: 0x1b3b8 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:30 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Kernel-Package-DriverVerifier-Tools-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x1c674 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:30 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Kernel-Package-DriverVerifier-Tools-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.mum Handle ID: 0xc8cc Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:30 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Client-Desktop-Required-Package0513~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0x1a10c Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:30 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Client-Desktop-Required-Package0513~31bf3856ad364e35~amd64~~10.0.26100.7171.mum Handle ID: 0x978c Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:30 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Client-Desktop-Required-Package0514~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0x1b600 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:30 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Client-Desktop-Required-Package0514~31bf3856ad364e35~amd64~~10.0.26100.7171.mum Handle ID: 0x5754 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:30 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Client-Desktop-Required-Package0515~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0x1c4cc Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:30 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Client-Desktop-Required-Package0515~31bf3856ad364e35~amd64~~10.0.26100.7171.mum Handle ID: 0x1c674 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:30 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Client-Desktop-Required-Package0516~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0x1a10c Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:30 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Client-Desktop-Required-Package0516~31bf3856ad364e35~amd64~~10.0.26100.7171.mum Handle ID: 0x1a10c Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:30 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Client-Desktop-Required-Package0517~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0x1b9c4 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:30 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Client-Desktop-Required-Package0517~31bf3856ad364e35~amd64~~10.0.26100.7171.mum Handle ID: 0x1b600 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:30 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Kernel-Package-BootEnvironment-OS-Loader-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0x8ab4 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:30 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Kernel-Package-BootEnvironment-OS-Loader-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.mum Handle ID: 0x1c4cc Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:30 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Kernel-Package-BootEnvironment-OS-Resume-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x1a5dc Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:30 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Kernel-Package-BootEnvironment-OS-Resume-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.mum Handle ID: 0x1b114 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:30 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Kernel-Package-CodeIntegrity-DriverPolicy-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0x1b114 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:30 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Kernel-Package-CodeIntegrity-DriverPolicy-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.mum Handle ID: 0x1b114 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:30 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Kernel-Package-CrashDump-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x1ae38 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:30 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Kernel-Package-CrashDump-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.mum Handle ID: 0x8ab4 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:30 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Client-Desktop-Required-Package051720~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0x32a0 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:30 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Client-Desktop-Required-Package051720~31bf3856ad364e35~amd64~~10.0.26100.7171.mum Handle ID: 0x1a5dc Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:30 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Client-Desktop-Required-Package0518~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0xc2e0 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:30 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Client-Desktop-Required-Package0518~31bf3856ad364e35~amd64~~10.0.26100.7171.mum Handle ID: 0x1a5dc Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:31 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Client-Desktop-Required-Package0519~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0x3dc0 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:31 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Client-Desktop-Required-Package0519~31bf3856ad364e35~amd64~~10.0.26100.7171.mum Handle ID: 0x1b9b8 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:31 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Client-Desktop-Required-Package051920~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0x1ae20 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:31 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Client-Desktop-Required-Package051920~31bf3856ad364e35~amd64~~10.0.26100.7171.mum Handle ID: 0x1ae38 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:31 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Kernel-Package-OS-Kernel-HAL-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0x7844 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:31 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Kernel-Package-OS-Kernel-HAL-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.mum Handle ID: 0xc2e0 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:31 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Client-Desktop-Required-Package05110~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0x9618 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:31 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Client-Desktop-Required-Package05110~31bf3856ad364e35~amd64~~10.0.26100.7171.mum Handle ID: 0x77ec Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:31 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Client-Desktop-Required-Package05111~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0xc684 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:31 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Client-Desktop-Required-Package05111~31bf3856ad364e35~amd64~~10.0.26100.7019.mum Handle ID: 0xba78 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:31 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Client-Desktop-Required-Package05112~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0x9928 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:31 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Client-Desktop-Required-Package05112~31bf3856ad364e35~amd64~~10.0.26100.7171.mum Handle ID: 0x7844 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:31 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0x80dc Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:31 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.26100.7171.mum Handle ID: 0x9618 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:31 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-SearchEngine-Client-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x193d0 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:31 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-SearchEngine-Client-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.mum Handle ID: 0x7498 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:31 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-SearchEngine-Client-Package-onecoreuap-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x19634 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:31 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-SearchEngine-Client-Package-onecoreuap-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.mum Handle ID: 0x7498 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:31 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\WindowsSearchEngineSKU-Group-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x80dc Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:31 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\WindowsSearchEngineSKU-Group-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.mum Handle ID: 0x7498 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:31 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-SearchEngine-Client-Package-shell-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x70f4 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:31 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-SearchEngine-Client-Package-shell-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.mum Handle ID: 0x9928 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:31 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Client-Desktop-Required-Package05114~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0xba74 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:31 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Client-Desktop-Required-Package05114~31bf3856ad364e35~amd64~~10.0.26100.7171.mum Handle ID: 0x7498 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:31 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Kernel-Package-GlobMerger-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x1ae2c Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:31 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Kernel-Package-GlobMerger-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.mum Handle ID: 0xbb48 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:31 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Client-Desktop-Required-Package0511420~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x3dc4 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:31 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Client-Desktop-Required-Package0511420~31bf3856ad364e35~amd64~~10.0.26100.7019.mum Handle ID: 0x3dc0 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:32 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0x1b904 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:32 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.mum Handle ID: 0x3dc0 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:32 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Kernel-Package-Ntdll-WOW64-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0xb204 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:32 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Kernel-Package-Ntdll-WOW64-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.mum Handle ID: 0x1ae20 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:32 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Client-Desktop-Required-WOW64-Package00~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0x3dcc Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:32 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Client-Desktop-Required-WOW64-Package00~31bf3856ad364e35~amd64~~10.0.26100.7171.mum Handle ID: 0xb1e4 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:32 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0010~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0x7e9c Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:32 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0010~31bf3856ad364e35~amd64~~10.0.26100.7171.mum Handle ID: 0x3dc4 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:32 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0011~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0x19638 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:32 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0011~31bf3856ad364e35~amd64~~10.0.26100.7171.mum Handle ID: 0x19634 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:32 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0012~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0xd3e0 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:32 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0012~31bf3856ad364e35~amd64~~10.0.26100.7171.mum Handle ID: 0xba74 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:32 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0013~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0xd3d8 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:32 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0013~31bf3856ad364e35~amd64~~10.0.26100.7019.mum Handle ID: 0x32a0 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:32 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0x1a718 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:32 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.26100.7171.mum Handle ID: 0x2ec8 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:33 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0015~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0xd3d4 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:33 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0015~31bf3856ad364e35~amd64~~10.0.26100.7171.mum Handle ID: 0xd3e0 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:33 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Win4-Feature~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0xa2a4 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:33 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Win4-Feature~31bf3856ad364e35~amd64~~10.0.26100.7171.mum Handle ID: 0xd3d8 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:33 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Runlevel-Win0-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0xd9c0 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:33 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Runlevel-Win0-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.mum Handle ID: 0x1a718 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:33 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Runlevel-Win0-merged-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0x1b8fc Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:33 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Runlevel-Win0-merged-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.mum Handle ID: 0xd3d4 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:33 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-OneCore-Common-DriverClasses-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0xd998 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:33 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-OneCore-Common-DriverClasses-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.mum Handle ID: 0x1b904 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:33 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-OneCore-Common-DriverClasses-Core-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x1b8f8 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:33 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-OneCore-Common-DriverClasses-Core-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.mum Handle ID: 0x3dcc Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:33 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-OneCore-ETW-Rundown-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0xd990 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:33 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-OneCore-ETW-Rundown-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.mum Handle ID: 0x1b8fc Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:33 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-CoreSystem-BootableSKU-Drivers-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0x1cfd0 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:33 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-CoreSystem-BootableSKU-Drivers-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.mum Handle ID: 0xd998 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:33 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-CoreSystem-BootableSKU-Drivers-merged-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0xd998 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:33 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-CoreSystem-BootableSKU-Drivers-merged-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.mum Handle ID: 0xd998 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:33 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Foundation-Win0-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0xd99c Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:33 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Foundation-Win0-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.mum Handle ID: 0xbb48 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:33 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Foundation-Win0-merged-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0x1cfd4 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:33 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Foundation-Win0-merged-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.mum Handle ID: 0xbb48 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:33 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Kernel-Package-DebuggerTransport-Win0-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x5648 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:33 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Kernel-Package-DebuggerTransport-Win0-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.mum Handle ID: 0x1cfd0 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:33 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Kernel-Package-Ntdll-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x1cfd8 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:33 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Kernel-Package-Ntdll-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.mum Handle ID: 0xd99c Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:33 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Kernel-Package-CNG-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x199e8 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:33 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Kernel-Package-CNG-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.mum Handle ID: 0x1cfd4 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:33 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Kernel-Package-CodeIntegrity-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0x25d4 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:33 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Kernel-Package-CodeIntegrity-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.mum Handle ID: 0x5648 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:33 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Kernel-Package-Cryptography-SymCrypt-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x563c Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:33 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Kernel-Package-Cryptography-SymCrypt-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.mum Handle ID: 0x1cfd8 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:33 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Runlevel-Win1-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0x25d8 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:33 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Runlevel-Win1-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.mum Handle ID: 0x1cfd8 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:33 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Runlevel-Win1-merged-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x3ba4 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:33 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Runlevel-Win1-merged-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.mum Handle ID: 0x25d4 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:33 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-OneCore-Console-Host-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x25dc Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:33 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-OneCore-Console-Host-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.mum Handle ID: 0x1cfd8 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:33 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Foundation-Win1-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0x3b98 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:33 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Foundation-Win1-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.mum Handle ID: 0x25d8 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:33 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Foundation-Win1-merged-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0x1410 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:33 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Foundation-Win1-merged-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.mum Handle ID: 0x25d8 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:33 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Runlevel-Win2-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0x467c Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:33 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Runlevel-Win2-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.mum Handle ID: 0x25dc Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:33 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-OneCore-TroubleShooting-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x5068 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:33 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-OneCore-TroubleShooting-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.mum Handle ID: 0x3b98 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:33 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-CoreSystem-DriverSupport-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0xd9ac Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:33 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-CoreSystem-DriverSupport-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.mum Handle ID: 0x1410 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:33 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-CoreSystem-GenericDrivers-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x19ba0 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:33 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-CoreSystem-GenericDrivers-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.mum Handle ID: 0x1410 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:33 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-NetAdapterCx-UMDF-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x505c Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:33 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-NetAdapterCx-UMDF-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.mum Handle ID: 0x467c Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:33 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Platformrecords-PlutonFirmware-Package~31bf3856ad364e35~amd64~~10.0.26100.6899.cat Handle ID: 0x1b40c Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:33 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Platformrecords-PlutonFirmware-Package~31bf3856ad364e35~amd64~~10.0.26100.6899.mum Handle ID: 0x5068 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:33 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Runlevel-Win2-Minimal-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0x9884 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:33 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Runlevel-Win2-Minimal-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.mum Handle ID: 0x19ba0 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:33 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-OneCore-CoreSystem-BootableSKU-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0x75f4 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:33 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-OneCore-CoreSystem-BootableSKU-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.mum Handle ID: 0x505c Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:33 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-OneCore-CoreSystem-BootableSKU-merged-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0x1c414 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:33 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-OneCore-CoreSystem-BootableSKU-merged-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.mum Handle ID: 0x505c Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:33 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-OneCore-TraceDataHelper-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0xde90 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:33 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-OneCore-TraceDataHelper-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.mum Handle ID: 0x9884 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:33 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-OneCore-CoreSystem-Core-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0xaa28 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:33 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-OneCore-CoreSystem-Core-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.mum Handle ID: 0x507c Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:33 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-OneCore-CoreSystem-Core-merged-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0x7bc8 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:33 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-OneCore-CoreSystem-Core-merged-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.mum Handle ID: 0x9884 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:33 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-OneCore-Http-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x7580 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:33 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-OneCore-Http-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.mum Handle ID: 0xde90 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:33 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Basic-Http-Minio-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x9c54 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:33 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Basic-Http-Minio-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.mum Handle ID: 0xaa28 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:33 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-OneCore-LSA-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0xaba8 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:33 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-OneCore-LSA-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.mum Handle ID: 0x7bc8 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:33 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-OneCore-LSA-merged-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0xb970 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:33 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-OneCore-LSA-merged-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.mum Handle ID: 0x7580 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:33 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-OneCore-Pnp-Core-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0xca48 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:33 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-OneCore-Pnp-Core-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.mum Handle ID: 0x9c54 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:33 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-OneCore-Wer-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x1b404 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:33 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-OneCore-Wer-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.mum Handle ID: 0x7580 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:33 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-OneCore-Wer-merged-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x8ff0 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:33 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-OneCore-Wer-merged-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.mum Handle ID: 0x75f4 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:33 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-OneCore-DebugCore-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x7858 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:33 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-OneCore-DebugCore-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.mum Handle ID: 0xaba8 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:33 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-ErrorReportingCore-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x97c4 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:33 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-ErrorReportingCore-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.mum Handle ID: 0xb970 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:33 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-ErrorReportingFaults-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0xaba8 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:33 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-ErrorReportingFaults-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.mum Handle ID: 0xaba8 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:33 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-CoreSystem-UnifiedBPM-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x1c1b0 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:33 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-CoreSystem-UnifiedBPM-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.mum Handle ID: 0x7e9c Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:33 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Foundation-Group-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0x2c4bc Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:33 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Foundation-Group-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.mum Handle ID: 0x80dc Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:33 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Foundation-Group-merged-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0x9364 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:33 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Foundation-Group-merged-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.mum Handle ID: 0x7e9c Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:33 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Kernel-Package-DriverVerifier-Xdv-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x1ac50 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:33 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Kernel-Package-DriverVerifier-Xdv-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.mum Handle ID: 0x7858 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:33 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Kernel-Package-System-Events-Container-Package~31bf3856ad364e35~amd64~~10.0.26100.6725.cat Handle ID: 0x1c418 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:33 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Kernel-Package-System-Events-Container-Package~31bf3856ad364e35~amd64~~10.0.26100.6725.mum Handle ID: 0x1c414 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:33 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Network-Foundation-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0xd9f8 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:33 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Network-Foundation-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.mum Handle ID: 0x1b404 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:33 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-CoreSystem-UMDF-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x1c41c Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:33 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-CoreSystem-UMDF-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.mum Handle ID: 0x1ac50 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:33 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Runlevel-Win3-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0x7870 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:33 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Runlevel-Win3-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.mum Handle ID: 0x1c418 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:33 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Runlevel-Win3-merged-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x78d8 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:33 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Runlevel-Win3-merged-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.mum Handle ID: 0x2c4bc Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:33 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-OneCore-FileSystem-Support-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0xd9ec Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:33 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-OneCore-FileSystem-Support-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.mum Handle ID: 0x9364 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:33 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-OneCore-Graphics-BasicDrivers-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x44d0 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:33 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-OneCore-Graphics-BasicDrivers-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.mum Handle ID: 0xd9f8 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:33 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-CoreSystem-BootableSKU-Winlogon-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0xd9fc Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:33 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-CoreSystem-BootableSKU-Winlogon-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.mum Handle ID: 0x1c41c Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:33 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-CoreSystem-CredSSP-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x1cc4 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:33 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-CoreSystem-CredSSP-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.mum Handle ID: 0xd9ec Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:33 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-CoreSystem-Security-UserMgr-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0x44c8 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:33 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-CoreSystem-Security-UserMgr-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.mum Handle ID: 0xd9ec Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:33 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-CoreSystem-WINNLS-Core-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0xd764 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:33 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-CoreSystem-WINNLS-Core-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.mum Handle ID: 0xd9ec Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:33 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-CoreSystem-WinTrust-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x44c4 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:33 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-CoreSystem-WinTrust-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.mum Handle ID: 0xd9fc Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:33 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Gdi32Full-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x8f18 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:33 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Gdi32Full-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.mum Handle ID: 0x44c8 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:33 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Windows-ClientCore-Shutdown-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0xa444 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:33 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Windows-ClientCore-Shutdown-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.mum Handle ID: 0xd764 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:33 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Windows-ClientCore-Win32Bridge-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x4644 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:33 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Windows-ClientCore-Win32Bridge-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.mum Handle ID: 0x70f4 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:33 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Runlevel-Win4-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0x4644 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:33 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Runlevel-Win4-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.mum Handle ID: 0x1c414 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:33 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Runlevel-Win4-merged-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0xd754 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:33 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Runlevel-Win4-merged-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.mum Handle ID: 0x44c4 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:33 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Client-License-Platform-CSP-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0xd760 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:33 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Client-License-Platform-CSP-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.mum Handle ID: 0x8f18 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:33 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-OneCore-DeviceRuntime-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0x4638 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:33 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-OneCore-DeviceRuntime-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.mum Handle ID: 0x4644 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:33 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-OneCore-Biometrics-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x4fb0 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-OneCore-Biometrics-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.mum Handle ID: 0xd754 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-OneCore-Biometrics-Fingerprint-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x4648 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-OneCore-Biometrics-Fingerprint-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.mum Handle ID: 0xd760 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-OneCore-Graphics-IndirectDisplays-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x4fa4 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-OneCore-Graphics-IndirectDisplays-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.mum Handle ID: 0x4638 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-OneCore-Miracast-Transmitter-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x26b8 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-OneCore-Miracast-Transmitter-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.mum Handle ID: 0xd760 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Product-onecore__Microsoft-OneCore-WSD-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0xc9cc Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Product-onecore__Microsoft-OneCore-WSD-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.mum Handle ID: 0x4648 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-WindowsCoreHeadless-DeviceRuntime-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0x1a3f0 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-WindowsCoreHeadless-DeviceRuntime-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.mum Handle ID: 0x1c1b0 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Mobile-Sensors-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0xc9e8 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Mobile-Sensors-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.mum Handle ID: 0xa444 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-OneCore-Connectivity-Bluetooth-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0x93e4 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-OneCore-Connectivity-Bluetooth-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.mum Handle ID: 0xc9cc Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-OneCore-Bluetooth-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0x9578 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-OneCore-Bluetooth-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.mum Handle ID: 0x1a3f0 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-OneCore-Bluetooth-Input-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x1a3f0 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-OneCore-Bluetooth-Input-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.mum Handle ID: 0x1a3f0 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-OneCore-Connectivity-HID-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x26b0 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-OneCore-Connectivity-HID-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.mum Handle ID: 0x4638 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Product-onecore__Microsoft-OneCore-Connectivity-HIDMiniports-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x3c18 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Product-onecore__Microsoft-OneCore-Connectivity-HIDMiniports-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.mum Handle ID: 0x4fa4 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-OneCore-Connectivity-I3C-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x26bc Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-OneCore-Connectivity-I3C-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.mum Handle ID: 0x26b8 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-OneCore-Connectivity-Serial-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x3c04 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-OneCore-Connectivity-Serial-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.mum Handle ID: 0x4fa4 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-OneCore-Connectivity-UsbHost-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x127c Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-OneCore-Connectivity-UsbHost-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.mum Handle ID: 0x4638 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-OneCore-FirmwareUpdate-HidCfu-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x3c14 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-OneCore-FirmwareUpdate-HidCfu-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.mum Handle ID: 0x26bc Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-OneCore-FirmwareUpdate-StorFwUpdate-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x9190 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-OneCore-FirmwareUpdate-StorFwUpdate-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.mum Handle ID: 0x3c04 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-OneCore-SecureStartup-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0xca44 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-OneCore-SecureStartup-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.mum Handle ID: 0x127c Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-OneCore-SecureStartup-merged-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x92b8 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-OneCore-SecureStartup-merged-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.mum Handle ID: 0x19638 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-OneCore-SecureStartup-Foundation-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0xba8c Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-OneCore-SecureStartup-Foundation-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.mum Handle ID: 0x127c Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-OneCore-Sensors-Core-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0xbaac Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-OneCore-Sensors-Core-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.mum Handle ID: 0xca44 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-CoreSystem-Security-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x78ec Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-CoreSystem-Security-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.mum Handle ID: 0x92b8 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Network-Security-Core-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x87b4 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Network-Security-Core-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.mum Handle ID: 0x7870 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-OneCore-ClassExtensions-Package~31bf3856ad364e35~amd64~~10.0.26100.6725.cat Handle ID: 0x33bc Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-OneCore-ClassExtensions-Package~31bf3856ad364e35~amd64~~10.0.26100.6725.mum Handle ID: 0x92b8 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-OneCore-DeviceAssociationFramework-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0xbde0 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-OneCore-DeviceAssociationFramework-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.mum Handle ID: 0xbaac Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-TrustedExecution-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0x79c0 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-TrustedExecution-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.mum Handle ID: 0x87b4 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-OneCore-Edge-WebRuntime-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x735c Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-OneCore-Edge-WebRuntime-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.mum Handle ID: 0x33bc Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-OneCore-EnterpriseNetworking-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0x7370 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-OneCore-EnterpriseNetworking-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.mum Handle ID: 0x3c14 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-OneCore-ESENT-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0xc378 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-OneCore-ESENT-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.mum Handle ID: 0xbde0 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-OneCore-Fonts-UAPFonts-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x42a0 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-OneCore-Fonts-UAPFonts-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.mum Handle ID: 0x79c0 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-OneCore-Pnp-Full-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0x8fa0 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-OneCore-Pnp-Full-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.mum Handle ID: 0x7370 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-OneCore-Pnp-Basic-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0x7c64 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-OneCore-Pnp-Basic-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.mum Handle ID: 0xc378 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-OneCore-Pnp-OnlineDriverStore-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0xa118 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-OneCore-Pnp-OnlineDriverStore-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.mum Handle ID: 0x7370 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-OneCore-Pnp-PlatformServices-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x1c8 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-OneCore-Pnp-PlatformServices-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.mum Handle ID: 0x78ec Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-OneCore-Pnp-RuntimeDeviceInstall-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x7154 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-OneCore-Pnp-RuntimeDeviceInstall-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.mum Handle ID: 0x78ec Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-OneCore-Transactions-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0x7114 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-OneCore-Transactions-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.mum Handle ID: 0xc378 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-OneCore-WebService-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x9048 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-OneCore-WebService-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.mum Handle ID: 0x93e4 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Browser-Brokers-Package~31bf3856ad364e35~amd64~~11.0.26100.7019.cat Handle ID: 0x94ac Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Browser-Brokers-Package~31bf3856ad364e35~amd64~~11.0.26100.7019.mum Handle ID: 0x9578 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-CoreSystem-BootEnv-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0xa024 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-CoreSystem-BootEnv-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.mum Handle ID: 0x7114 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-CoreSystem-BootEnv-merged-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0xc88c Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-CoreSystem-BootEnv-merged-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.mum Handle ID: 0x9190 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-CoreSystem-DXG-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0x19a58 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-CoreSystem-DXG-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.mum Handle ID: 0x19a58 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-CoreSystem-DXG-merged-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x5640 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-CoreSystem-DXG-merged-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.mum Handle ID: 0xa024 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-OneCore-Graphics-DirectX-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0x1b5fc Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-OneCore-Graphics-DirectX-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.mum Handle ID: 0x1c8 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-CoreSystem-DXG-Common-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0x19434 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-CoreSystem-DXG-Common-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.mum Handle ID: 0xa024 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-CoreSystem-DXG-Common-merged-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0xbacc Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-CoreSystem-DXG-Common-merged-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.mum Handle ID: 0x9048 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-OneCore-Graphics-DirectX-Core-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x9230 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-OneCore-Graphics-DirectX-Core-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.mum Handle ID: 0x94ac Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-OneCore-Graphics-Required-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0x9020 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-OneCore-Graphics-Required-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.mum Handle ID: 0x19434 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-OneCore-Graphics-Required-Full-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0x70cc Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-OneCore-Graphics-Required-Full-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.mum Handle ID: 0x94ac Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-DirectX-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x1d578 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-DirectX-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.mum Handle ID: 0x9230 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-DisplayDiag-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x40ec Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-DisplayDiag-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.mum Handle ID: 0x94ac Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-CoreSystem-RemoteFS-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0x6fb4 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-CoreSystem-RemoteFS-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.mum Handle ID: 0xa4a4 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-CoreSystem-RemoteFS-Client-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0x7808 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-CoreSystem-RemoteFS-Client-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.mum Handle ID: 0x1d578 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-CoreSystem-RemoteFS-Server-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x1bd74 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-CoreSystem-RemoteFS-Server-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.mum Handle ID: 0x9020 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-CoreSystem-XmlLite-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x99b8 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-CoreSystem-XmlLite-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.mum Handle ID: 0x70cc Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-CrashDump-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x7bd8 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-CrashDump-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.mum Handle ID: 0x7808 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-WOWSupport-Full-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x85b0 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-WOWSupport-Full-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.mum Handle ID: 0x1bd74 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Win3-DWM-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0x95dc Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Win3-DWM-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.mum Handle ID: 0x7808 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\CoreMessaging-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x40fc Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\CoreMessaging-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.mum Handle ID: 0x7bd8 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-OneCore-Kernel-AppCore-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x4148 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-OneCore-Kernel-AppCore-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.mum Handle ID: 0x40ec Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-UserSessionManagement-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x562c Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-UserSessionManagement-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.mum Handle ID: 0x6fb4 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Windows-ClientCore-DWM-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0x7378 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Windows-ClientCore-DWM-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.mum Handle ID: 0x5640 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Windows-ClientCore-DWM-merged-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0x7430 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Windows-ClientCore-DWM-merged-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.mum Handle ID: 0x1b5fc Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-OneCore-CoreUiComponents-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x874c Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-OneCore-CoreUiComponents-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.mum Handle ID: 0x562c Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-OneCore-MinInput-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x97dc Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-OneCore-MinInput-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.mum Handle ID: 0x7c64 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Composition-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0x91d4 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Composition-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.mum Handle ID: 0xa118 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Composition-merged-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0x7cd0 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Composition-merged-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.mum Handle ID: 0x7378 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Composition-Core-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x4140 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Composition-Core-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.mum Handle ID: 0x40fc Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Composition-Core-merged-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x7d40 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Composition-Core-merged-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.mum Handle ID: 0x4148 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Win4-WOW64-Feature~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0x97bc Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Win4-WOW64-Feature~31bf3856ad364e35~amd64~~10.0.26100.7171.mum Handle ID: 0x85b0 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Runlevel-Win0-WOW64-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0x4148 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Runlevel-Win0-WOW64-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.mum Handle ID: 0x4148 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Runlevel-Win0-WOW64-merged-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0xcc7c Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Runlevel-Win0-WOW64-merged-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.mum Handle ID: 0x7d40 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-OneCore-ETW-Rundown-WOW64-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x728c Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-OneCore-ETW-Rundown-WOW64-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.mum Handle ID: 0x7cd0 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Foundation-Win0-WOW64-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0x1de8 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Foundation-Win0-WOW64-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.mum Handle ID: 0x4140 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Foundation-Win0-WOW64-merged-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0x2c4f0 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Foundation-Win0-WOW64-merged-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.mum Handle ID: 0x874c Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Runlevel-Win1-WOW64-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0xbad0 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Runlevel-Win1-WOW64-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.mum Handle ID: 0x97dc Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Runlevel-Win1-WOW64-merged-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x97a8 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Runlevel-Win1-WOW64-merged-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.mum Handle ID: 0x874c Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Foundation-Win1-WOW64-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0x77ac Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Foundation-Win1-WOW64-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.mum Handle ID: 0x874c Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Foundation-Win1-WOW64-merged-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0x94fc Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Foundation-Win1-WOW64-merged-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.mum Handle ID: 0xbad0 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Runlevel-Win2-WOW64-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0x6f58 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Runlevel-Win2-WOW64-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.mum Handle ID: 0xbad0 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-OneCore-TroubleShooting-WOW64-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x79ec Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-OneCore-TroubleShooting-WOW64-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.mum Handle ID: 0x874c Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Runlevel-Win2-Minimal-WOW64-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0xba90 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Runlevel-Win2-Minimal-WOW64-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.mum Handle ID: 0x4140 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-OneCore-CoreSystem-BootableSKU-WOW64-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0x31c8 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-OneCore-CoreSystem-BootableSKU-WOW64-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.mum Handle ID: 0x4140 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-OneCore-CoreSystem-BootableSKU-WOW64-merged-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0x9234 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-OneCore-CoreSystem-BootableSKU-WOW64-merged-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.mum Handle ID: 0xcc7c Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-OneCore-TraceDataHelper-WOW64-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x31bc Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-OneCore-TraceDataHelper-WOW64-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.mum Handle ID: 0x728c Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-OneCore-CoreSystem-Core-WOW64-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0x789c Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-OneCore-CoreSystem-Core-WOW64-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.mum Handle ID: 0x31c8 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-OneCore-CoreSystem-Core-WOW64-merged-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0x7c80 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-OneCore-CoreSystem-Core-WOW64-merged-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.mum Handle ID: 0x79ec Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-OneCore-Http-WOW64-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x7c60 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-OneCore-Http-WOW64-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.mum Handle ID: 0xba90 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Basic-Http-Minio-WOW64-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x8f38 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Basic-Http-Minio-WOW64-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.mum Handle ID: 0x789c Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-OneCore-Pnp-Core-WOW64-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x9080 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-OneCore-Pnp-Core-WOW64-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.mum Handle ID: 0x7c80 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-OneCore-Wer-WOW64-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x7b7c Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-OneCore-Wer-WOW64-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.mum Handle ID: 0x789c Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-OneCore-DebugCore-WOW64-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x2c4f4 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-OneCore-DebugCore-WOW64-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.mum Handle ID: 0x8f38 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-ErrorReportingCore-WOW64-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x7850 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-ErrorReportingCore-WOW64-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.mum Handle ID: 0x9080 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-ErrorReportingFaults-WOW64-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0xbb30 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-ErrorReportingFaults-WOW64-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.mum Handle ID: 0x7b7c Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Foundation-Group-WOW64-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0x3200 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Foundation-Group-WOW64-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.mum Handle ID: 0x2c4f4 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Foundation-Group-WOW64-merged-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0x330c Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Foundation-Group-WOW64-merged-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.mum Handle ID: 0x7b7c Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Network-Foundation-WOW64-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x3228 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Network-Foundation-WOW64-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.mum Handle ID: 0x31bc Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Runlevel-Win3-WOW64-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0x1b3f4 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Runlevel-Win3-WOW64-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.mum Handle ID: 0x3200 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-OneCore-FileSystem-Support-WOW64-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x544 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-OneCore-FileSystem-Support-WOW64-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.mum Handle ID: 0x7430 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-CoreSystem-CredSSP-WOW64-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0xc8a4 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-CoreSystem-CredSSP-WOW64-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.mum Handle ID: 0x91d4 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-CoreSystem-Security-UserMgr-WOW64-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0x3f34 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-CoreSystem-Security-UserMgr-WOW64-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.mum Handle ID: 0x91d4 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-CoreSystem-WINNLS-Core-WOW64-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x1ab48 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-CoreSystem-WINNLS-Core-WOW64-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.mum Handle ID: 0x91d4 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-CoreSystem-WinTrust-WOW64-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x1a664 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-CoreSystem-WinTrust-WOW64-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.mum Handle ID: 0xc8a4 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Gdi32Full-WOW64-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0x1ab4c Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Gdi32Full-WOW64-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.mum Handle ID: 0x78d8 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Windows-ClientCore-Shutdown-WOW64-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x212c Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Windows-ClientCore-Shutdown-WOW64-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.mum Handle ID: 0x1ab48 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Windows-ClientCore-Win32Bridge-WOW64-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0x20d8 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Windows-ClientCore-Win32Bridge-WOW64-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.mum Handle ID: 0x1a664 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Runlevel-Win4-WOW64-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0x1c774 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Runlevel-Win4-WOW64-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.mum Handle ID: 0x1ab4c Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Runlevel-Win4-WOW64-merged-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0x1ba10 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Runlevel-Win4-WOW64-merged-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.mum Handle ID: 0x212c Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-OneCore-DeviceRuntime-WOW64-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x7964 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-OneCore-DeviceRuntime-WOW64-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.mum Handle ID: 0x330c Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-OneCore-Biometrics-WOW64-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0xba60 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-OneCore-Biometrics-WOW64-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.mum Handle ID: 0x97bc Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Product-onecore__Microsoft-OneCore-WSD-WOW64-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x9824 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Product-onecore__Microsoft-OneCore-WSD-WOW64-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.mum Handle ID: 0xbab8 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-WindowsCoreHeadless-DeviceRuntime-WOW64-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x7a60 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-WindowsCoreHeadless-DeviceRuntime-WOW64-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.mum Handle ID: 0x7964 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-OneCore-Connectivity-Bluetooth-WOW64-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x97ac Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-OneCore-Connectivity-Bluetooth-WOW64-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.mum Handle ID: 0x97ac Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-OneCore-Bluetooth-WOW64-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x41ac Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-OneCore-Bluetooth-WOW64-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.mum Handle ID: 0x9824 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-OneCore-SecureStartup-WOW64-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0xbb24 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-OneCore-SecureStartup-WOW64-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.mum Handle ID: 0x97ac Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-OneCore-SecureStartup-Foundation-WOW64-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x7900 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-OneCore-SecureStartup-Foundation-WOW64-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.mum Handle ID: 0x7850 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-OneCore-Sensors-Core-WOW64-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x2c4d0 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-OneCore-Sensors-Core-WOW64-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.mum Handle ID: 0xbb30 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-CoreSystem-Security-WOW64-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x91f8 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-CoreSystem-Security-WOW64-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.mum Handle ID: 0xbb24 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Network-Security-Core-WOW64-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x7834 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Network-Security-Core-WOW64-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.mum Handle ID: 0xbb24 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-OneCore-DeviceAssociationFramework-WOW64-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x92e8 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-OneCore-DeviceAssociationFramework-WOW64-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.mum Handle ID: 0x2c4d0 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-OneCore-EnterpriseNetworking-WOW64-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0x1bb58 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-OneCore-EnterpriseNetworking-WOW64-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.mum Handle ID: 0x91f8 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-OneCore-ESENT-WOW64-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x382c Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-OneCore-ESENT-WOW64-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.mum Handle ID: 0x2c4d0 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-OneCore-Pnp-Full-WOW64-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0xc810 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-OneCore-Pnp-Full-WOW64-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.mum Handle ID: 0x41ac Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-OneCore-Pnp-Basic-WOW64-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0xc678 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-OneCore-Pnp-Basic-WOW64-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.mum Handle ID: 0x1bb58 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-OneCore-Pnp-OnlineDriverStore-WOW64-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0xc624 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-OneCore-Pnp-OnlineDriverStore-WOW64-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.mum Handle ID: 0x382c Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-OneCore-Pnp-RuntimeDeviceInstall-WOW64-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0xc49c Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-OneCore-Pnp-RuntimeDeviceInstall-WOW64-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.mum Handle ID: 0x382c Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-OneCore-WebService-WOW64-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x1c5ec Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-OneCore-WebService-WOW64-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.mum Handle ID: 0xc678 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-CoreSystem-DXG-WOW64-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0xbf18 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-CoreSystem-DXG-WOW64-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.mum Handle ID: 0xc678 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-CoreSystem-DXG-WOW64-merged-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x3310 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-CoreSystem-DXG-WOW64-merged-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.mum Handle ID: 0xc624 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-OneCore-Graphics-DirectX-WOW64-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x19a7c Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-OneCore-Graphics-DirectX-WOW64-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.mum Handle ID: 0x1ba10 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-CoreSystem-DXG-Common-WOW64-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0x1c5b0 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-CoreSystem-DXG-Common-WOW64-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.mum Handle ID: 0x1c5ec Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-CoreSystem-DXG-Common-WOW64-merged-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x9dec Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-CoreSystem-DXG-Common-WOW64-merged-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.mum Handle ID: 0x3310 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-OneCore-Graphics-DirectX-Core-WOW64-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0xc030 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-OneCore-Graphics-DirectX-Core-WOW64-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.mum Handle ID: 0x3310 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-OneCore-Graphics-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0xc5f8 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-OneCore-Graphics-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.mum Handle ID: 0x1c5ec Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-OneCore-Graphics-Required-Full-WOW64-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0xcdc8 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-OneCore-Graphics-Required-Full-WOW64-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.mum Handle ID: 0x1ba10 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-DirectX-WOW64-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0xbf58 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-DirectX-WOW64-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.mum Handle ID: 0xc49c Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-DisplayDiag-WOW64-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0xc49c Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-DisplayDiag-WOW64-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.mum Handle ID: 0xc49c Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-CoreSystem-RemoteFS-WOW64-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0xdd60 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-CoreSystem-RemoteFS-WOW64-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.mum Handle ID: 0xc49c Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-CoreSystem-RemoteFS-Client-WOW64-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x79c8 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-CoreSystem-RemoteFS-Client-WOW64-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.mum Handle ID: 0x1ba10 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-CoreSystem-XmlLite-WOW64-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x954c Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-CoreSystem-XmlLite-WOW64-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.mum Handle ID: 0xbf58 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-WOWSupport-Full-WOW64-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x1bcec Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-WOWSupport-Full-WOW64-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.mum Handle ID: 0xdd60 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Win3-DWM-WOW64-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x9330 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Win3-DWM-WOW64-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.mum Handle ID: 0x79c8 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\CoreMessaging-WOW64-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0xc024 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\CoreMessaging-WOW64-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.mum Handle ID: 0xc030 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-OneCore-Kernel-AppCore-WOW64-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x7d18 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-OneCore-Kernel-AppCore-WOW64-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.mum Handle ID: 0x79c8 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-UserSessionManagement-WOW64-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0xcfe4 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-UserSessionManagement-WOW64-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.mum Handle ID: 0x9330 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Windows-ClientCore-DWM-WOW64-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x7b4 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Windows-ClientCore-DWM-WOW64-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.mum Handle ID: 0xc024 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Windows-ClientCore-DWM-WOW64-merged-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x82dc Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Windows-ClientCore-DWM-WOW64-merged-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.mum Handle ID: 0x7d18 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-OneCore-CoreUiComponents-WOW64-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0xc144 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-OneCore-CoreUiComponents-WOW64-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.mum Handle ID: 0x954c Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-OneCore-MinInput-WOW64-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0xcbec Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-OneCore-MinInput-WOW64-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.mum Handle ID: 0x1bcec Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Composition-WOW64-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x8c58 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Composition-WOW64-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.mum Handle ID: 0x82dc Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Composition-WOW64-merged-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0xd0e0 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Composition-WOW64-merged-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.mum Handle ID: 0x20d8 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Composition-Core-WOW64-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0xc5ac Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Composition-Core-WOW64-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.mum Handle ID: 0x82dc Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Composition-Core-WOW64-merged-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x83f8 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Composition-Core-WOW64-merged-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.mum Handle ID: 0xcbec Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Client-Features-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0x8ea8 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Client-Features-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.mum Handle ID: 0x82dc Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Desktop-Shared-removable-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0x7f20 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Desktop-Shared-removable-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.mum Handle ID: 0xc5ac Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-BioEnrollment-UX-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x1b144 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-BioEnrollment-UX-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.mum Handle ID: 0x83f8 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-ComputerManagerLauncher-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x1b13c Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-ComputerManagerLauncher-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.mum Handle ID: 0x8ea8 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Defrag-UI-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x18dc Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Defrag-UI-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.mum Handle ID: 0x7f20 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Printer-Drivers-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0x1c764 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Printer-Drivers-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.mum Handle ID: 0x1b144 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-RecoveryDrive-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x640c Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-RecoveryDrive-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.mum Handle ID: 0x1c774 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-ScreenSavers-3D-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x84c8 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-ScreenSavers-3D-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.mum Handle ID: 0x1b13c Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-ShellOptions-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x19bcc Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-ShellOptions-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.mum Handle ID: 0xcfe4 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Client-Features-Package00~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0x84bc Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Client-Features-Package00~31bf3856ad364e35~amd64~~10.0.26100.7171.mum Handle ID: 0x7b4 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Client-Features-Package01~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0x8c08 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Client-Features-Package01~31bf3856ad364e35~amd64~~10.0.26100.7171.mum Handle ID: 0x84c8 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Client-Features-Package02~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0x4f78 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Client-Features-Package02~31bf3856ad364e35~amd64~~10.0.26100.7171.mum Handle ID: 0x19bcc Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0x754c Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.26100.7171.mum Handle ID: 0x84bc Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Client-Features-Package04~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0x1c274 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Client-Features-Package04~31bf3856ad364e35~amd64~~10.0.26100.7171.mum Handle ID: 0x8c08 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Client-Features-Package05~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0x76b0 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Client-Features-Package05~31bf3856ad364e35~amd64~~10.0.26100.7171.mum Handle ID: 0x84bc Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Client-Features-Package0510~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x5aac Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Client-Features-Package0510~31bf3856ad364e35~amd64~~10.0.26100.7019.mum Handle ID: 0x754c Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-TS-OptionalComponents-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x70c Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-TS-OptionalComponents-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.mum Handle ID: 0x1c274 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-TS-Optional-Client-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x8c58 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-TS-Optional-Client-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.mum Handle ID: 0x76b0 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Client-Features-Package06~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0xdd78 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Client-Features-Package06~31bf3856ad364e35~amd64~~10.0.26100.7171.mum Handle ID: 0xcbec Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Kernel-Package-Kernel-Power-Events-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x1c764 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Kernel-Package-Kernel-Power-Events-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.mum Handle ID: 0x18dc Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Kernel-Package-Kernel-Power-Events-Container-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0x7254 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Kernel-Package-Kernel-Power-Events-Container-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.mum Handle ID: 0x4f78 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\HyperV-VID-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x1a988 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\HyperV-VID-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.mum Handle ID: 0x640c Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Client-Features-Package07~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0x1b054 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Client-Features-Package07~31bf3856ad364e35~amd64~~10.0.26100.7171.mum Handle ID: 0xdd78 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-OneCore-VirtualizationBasedSecurity-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0x1b05c Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-OneCore-VirtualizationBasedSecurity-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.mum Handle ID: 0x7254 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\HyperV-Hypervisor-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0x1a88c Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\HyperV-Hypervisor-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.mum Handle ID: 0x1a988 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Undocked-Hypervisor-Drivers-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0x8c38 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Undocked-Hypervisor-Drivers-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.mum Handle ID: 0x1b054 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Undocked-Hypervisor-Host-Service-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x6658 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Undocked-Hypervisor-Host-Service-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.mum Handle ID: 0x1b05c Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Undocked-Hypervisor-hvservice.inf-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x1b94c Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Undocked-Hypervisor-hvservice.inf-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.mum Handle ID: 0x1a88c Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Undocked-Hypervisor-WINHVR-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0xdeec Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Undocked-Hypervisor-WINHVR-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.mum Handle ID: 0x8c38 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-OneCore-IsolatedUserMode-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0x666c Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-OneCore-IsolatedUserMode-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.mum Handle ID: 0x1a88c Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-OneCore-IsolatedUserMode-merged-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0xbc40 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-OneCore-IsolatedUserMode-merged-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.mum Handle ID: 0x1a88c Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Kernel-Package-IsolatedUserMode-Common-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x6434 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Kernel-Package-IsolatedUserMode-Common-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.mum Handle ID: 0x1b94c Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Kernel-Package-IsolatedUserMode-Other-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0x1abe8 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Kernel-Package-IsolatedUserMode-Other-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.mum Handle ID: 0x666c Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-SecConfig-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x7a18 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-SecConfig-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.mum Handle ID: 0x1b94c Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Client-Features-Package08~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x7b1c Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Client-Features-Package08~31bf3856ad364e35~amd64~~10.0.26100.7019.mum Handle ID: 0x7834 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Client-Optional-Features-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0x80d8 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Client-Optional-Features-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.mum Handle ID: 0x92e8 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-HyperV-OptionalFeature-HypervisorPlatform-Disabled-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0x80c4 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-HyperV-OptionalFeature-HypervisorPlatform-Disabled-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.mum Handle ID: 0x7a18 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-HyperV-OptionalFeature-HypervisorPlatform-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0x7a1c Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-HyperV-OptionalFeature-HypervisorPlatform-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.mum Handle ID: 0x7b1c Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\HyperV-HypervisorPlatform-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0xca78 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\HyperV-HypervisorPlatform-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.mum Handle ID: 0x80d8 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\HyperV-HypervisorPlatform-merged-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x7b68 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\HyperV-HypervisorPlatform-merged-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.mum Handle ID: 0x80c4 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Hyper-V-Hypervisor-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0x1b68 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Hyper-V-Hypervisor-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.mum Handle ID: 0x7a1c Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Lxss-Optional-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0xd9bc Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Lxss-Optional-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.mum Handle ID: 0xd9c0 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Lxss-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0x6f74 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Lxss-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.mum Handle ID: 0x80c4 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Lxss-merged-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x2758 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Lxss-merged-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.mum Handle ID: 0xca78 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\HyperV-Networking-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0x7820 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\HyperV-Networking-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.mum Handle ID: 0x7b68 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\HyperV-Networking-merged-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0x19ce4 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\HyperV-Networking-merged-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.mum Handle ID: 0x6f74 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\HyperV-KMCL-Host-Package~31bf3856ad364e35~amd64~~10.0.26100.6725.cat Handle ID: 0x1a618 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\HyperV-KMCL-Host-Package~31bf3856ad364e35~amd64~~10.0.26100.6725.mum Handle ID: 0x1c764 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-RemoteAssistance-Package-Client~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x1a778 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-RemoteAssistance-Package-Client~31bf3856ad364e35~amd64~~10.0.26100.7019.mum Handle ID: 0x1b68 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Client-Features-Package09~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x1b6c Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Client-Features-Package09~31bf3856ad364e35~amd64~~10.0.26100.7019.mum Handle ID: 0xd9bc Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Client-Features-Package010~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0x4ad8 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Client-Features-Package010~31bf3856ad364e35~amd64~~10.0.26100.7171.mum Handle ID: 0x1a618 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Client-Features-Package011~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x78c0 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Client-Features-Package011~31bf3856ad364e35~amd64~~10.0.26100.7019.mum Handle ID: 0x6434 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Printing-Foundation-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x1a764 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Printing-Foundation-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.mum Handle ID: 0x1a618 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Printing-InternetPrinting-Client-Opt-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x9440 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Printing-InternetPrinting-Client-Opt-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.mum Handle ID: 0xdeec Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Client-Features-Package012~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0x2bc4 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Client-Features-Package012~31bf3856ad364e35~amd64~~10.0.26100.7171.mum Handle ID: 0x7820 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Client-Features-Package013~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x7134 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Client-Features-Package013~31bf3856ad364e35~amd64~~10.0.26100.7019.mum Handle ID: 0x19ce4 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-RecDisc-SDP-removable-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x60a4 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-RecDisc-SDP-removable-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.mum Handle ID: 0x1a764 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-BootEnvironment-Dvd-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0xd378 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-BootEnvironment-Dvd-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.mum Handle ID: 0x19ce4 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Client-Features-WOW64-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0x7914 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Client-Features-WOW64-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.mum Handle ID: 0x7820 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Client-Features-WOW64-Package00~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x1a77c Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Client-Features-WOW64-Package00~31bf3856ad364e35~amd64~~10.0.26100.7019.mum Handle ID: 0x9440 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Client-Features-WOW64-Package01~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0xc3c Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Client-Features-WOW64-Package01~31bf3856ad364e35~amd64~~10.0.26100.7171.mum Handle ID: 0x1a778 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Client-Features-WOW64-Package0110~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0xc78 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Client-Features-WOW64-Package0110~31bf3856ad364e35~amd64~~10.0.26100.7171.mum Handle ID: 0x1a778 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Client-Features-WOW64-Package0111~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0x12d8 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Client-Features-WOW64-Package0111~31bf3856ad364e35~amd64~~10.0.26100.7171.mum Handle ID: 0x1a77c Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Client-Features-WOW64-Package0112~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0xcb6c Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Client-Features-WOW64-Package0112~31bf3856ad364e35~amd64~~10.0.26100.7019.mum Handle ID: 0xc3c Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-TS-OptionalComponents-WOW64-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x70ac Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-TS-OptionalComponents-WOW64-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.mum Handle ID: 0xc78 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-TS-Optional-Client-WOW64-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x5fcc Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-TS-Optional-Client-WOW64-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.mum Handle ID: 0x12d8 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Client-Features-WOW64-Package02~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0xdb4c Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Client-Features-WOW64-Package02~31bf3856ad364e35~amd64~~10.0.26100.7171.mum Handle ID: 0x5aac Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-EditionPack-Professional-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0xc2a4 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-EditionPack-Professional-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.mum Handle ID: 0x70c Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-EditionPack-Professional-removable-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0xa80c Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-EditionPack-Professional-removable-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.mum Handle ID: 0x5fcc Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-AppManagement-UEV-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x1a4c4 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-AppManagement-UEV-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.mum Handle ID: 0xdb4c Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Win2-MSXML6-Feature~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x66d8 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Win2-MSXML6-Feature~31bf3856ad364e35~amd64~~10.0.26100.7019.mum Handle ID: 0xc2a4 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-CoreSystem-MSXML6-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x73ac Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-CoreSystem-MSXML6-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.mum Handle ID: 0xa80c Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Containers-Client-Manager-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0xb918 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Containers-Client-Manager-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.mum Handle ID: 0x7134 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Containers-ApplicationGuard-Shared-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x1ad4c Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Containers-ApplicationGuard-Shared-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.mum Handle ID: 0x60a4 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Containers-ApplicationGuard-Shared-merged-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x33f4 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Containers-ApplicationGuard-Shared-merged-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.mum Handle ID: 0x73ac Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Containers-Client-Shared-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0x1ad58 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Containers-Client-Shared-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.mum Handle ID: 0xb918 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-OneCore-Containers-Guest-Shared-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0xcec0 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-OneCore-Containers-Guest-Shared-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.mum Handle ID: 0x73ac Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-UtilityVM-Containers-Shared-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0x1abdc Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-UtilityVM-Containers-Shared-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.mum Handle ID: 0xd378 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-OneCore-EventLog-Api-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x1b3c8 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-OneCore-EventLog-Api-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.mum Handle ID: 0x1abe8 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-OneCore-UtilityVM-Containers-Shared-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0x193ac Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-OneCore-UtilityVM-Containers-Shared-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.mum Handle ID: 0x4ad8 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-OneCore-UtilityVM-Containers-Shared-merged-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x7740 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-OneCore-UtilityVM-Containers-Shared-merged-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.mum Handle ID: 0x7914 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-OneCore-Containers-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x1d3d0 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-OneCore-Containers-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.mum Handle ID: 0xcec0 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-OneCore-Containers-merged-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x3984 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-OneCore-Containers-merged-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.mum Handle ID: 0x3984 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-OneCore-Helium-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x7268 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-OneCore-Helium-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.mum Handle ID: 0x66d8 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-OneCore-Helium-merged-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x7124 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-OneCore-Helium-merged-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.mum Handle ID: 0x193ac Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-OneCore-CimFS-UnionFS-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x70d8 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-OneCore-CimFS-UnionFS-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.mum Handle ID: 0x7740 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-CoreSystem-DISM-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x9014 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-CoreSystem-DISM-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.mum Handle ID: 0x193ac Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\HyperV-Feature-ApplicationGuard-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0x474 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\HyperV-Feature-ApplicationGuard-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.mum Handle ID: 0x7124 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Containers-Client-SDN-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x74c8 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Containers-Client-SDN-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.mum Handle ID: 0x70d8 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\HyperV-Compute-Host-VirtualMachines-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0xd894 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\HyperV-Compute-Host-VirtualMachines-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.mum Handle ID: 0x7124 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\HyperV-Compute-Host-VirtualMachines-merged-Package~31bf3856ad364e35~amd64~~10.0.26100.6725.cat Handle ID: 0x8f0c Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\HyperV-Compute-Host-VirtualMachines-merged-Package~31bf3856ad364e35~amd64~~10.0.26100.6725.mum Handle ID: 0x70ac Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\HyperV-Compute-Host-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0xd314 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\HyperV-Compute-Host-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.mum Handle ID: 0x74c8 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\HyperV-Compute-Host-merged-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x1ad40 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\HyperV-Compute-Host-merged-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.mum Handle ID: 0x33f4 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\HyperV-Compute-Storage-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0xd30c Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\HyperV-Compute-Storage-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.mum Handle ID: 0x74c8 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\HyperV-Compute-Storage-merged-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x1d34 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\HyperV-Compute-Storage-merged-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.mum Handle ID: 0xd314 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\HyperV-Compute-System-VmDirect-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0xd318 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\HyperV-Compute-System-VmDirect-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.mum Handle ID: 0x1ad40 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\HyperV-DynamicMemory-VirtualDevice-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0xc8c8 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\HyperV-DynamicMemory-VirtualDevice-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.mum Handle ID: 0xd30c Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\HyperV-Networking-VirtualDevice-Synthetic-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0xd30c Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\HyperV-Networking-VirtualDevice-Synthetic-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.mum Handle ID: 0xd30c Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\HyperV-VmBus-Host-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0xd30c Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\HyperV-VmBus-Host-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.mum Handle ID: 0xd30c Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\HyperV-VmBus-Host-merged-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0xd358 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\HyperV-VmBus-Host-merged-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.mum Handle ID: 0x1d34 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\HyperV-Primitive-VirtualMachine-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0x1200 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\HyperV-Primitive-VirtualMachine-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.mum Handle ID: 0xd894 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\HyperV-Chipset-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0x1abec Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\HyperV-Chipset-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.mum Handle ID: 0x2bc4 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\HyperV-HvSocket-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0x7264 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\HyperV-HvSocket-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.mum Handle ID: 0x1abdc Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\HyperV-Virtio-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x7988 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\HyperV-Virtio-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.mum Handle ID: 0x8f0c Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\HyperV-VmBus-VirtualDevice-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x195a8 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\HyperV-VmBus-VirtualDevice-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.mum Handle ID: 0x1d34 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\HyperV-Worker-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0x9014 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\HyperV-Worker-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.mum Handle ID: 0x8f0c Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\HyperV-Worker-merged-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x195a8 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\HyperV-Worker-merged-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.mum Handle ID: 0x1abdc Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\HyperV-IsolatedVm-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0x97cc Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\HyperV-IsolatedVm-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.mum Handle ID: 0x474 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\HyperV-IsolatedVm-merged-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0x2c94 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\HyperV-IsolatedVm-merged-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.mum Handle ID: 0x7988 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\HyperV-RDP4VS-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x7988 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\HyperV-RDP4VS-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.mum Handle ID: 0x7988 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\RemoteDesktopServices-Base-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x4cfc Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\RemoteDesktopServices-Base-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.mum Handle ID: 0x9014 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\HyperV-Storage-VirtualDevice-PMEM-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0x1a09c Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\HyperV-Storage-VirtualDevice-PMEM-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.mum Handle ID: 0x1ad58 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\HyperV-Storage-VSP-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0x1ad58 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\HyperV-Storage-VSP-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.mum Handle ID: 0x1200 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\HyperV-Storage-VSP-merged-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0x1b3cc Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\HyperV-Storage-VSP-merged-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.mum Handle ID: 0x70d8 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\HyperV-Storage-VirtualDevice-SCSI-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0xbfb8 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\HyperV-Storage-VirtualDevice-SCSI-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.mum Handle ID: 0x1b3c8 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\HyperV-Storage-VirtualDevice-SCSI-merged-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x4b4 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\HyperV-Storage-VirtualDevice-SCSI-merged-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.mum Handle ID: 0x2c94 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\HyperV-Storage-VirtualDevice-SMB-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0x7424 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\HyperV-Storage-VirtualDevice-SMB-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.mum Handle ID: 0x4cfc Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\HyperV-Storage-VirtualDevice-SMB-merged-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0xd3c0 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\HyperV-Storage-VirtualDevice-SMB-merged-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.mum Handle ID: 0x4cfc Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\HyperV-VmUiDevices-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x37d0 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\HyperV-VmUiDevices-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.mum Handle ID: 0x4b4 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\HyperV-Vpci-VirtualDevice-FlexIo-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0xc9d8 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\HyperV-Vpci-VirtualDevice-FlexIo-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.mum Handle ID: 0x195a8 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\HyperV-Vpci-VSP-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x71cc Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\HyperV-Vpci-VSP-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.mum Handle ID: 0x97cc Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\HyperV-Vpci-VirtualDevice-Gpup-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0xbb78 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\HyperV-Vpci-VirtualDevice-Gpup-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.mum Handle ID: 0x37d0 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\HyperV-Networking-Containers-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0x9f00 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\HyperV-Networking-Containers-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.mum Handle ID: 0x7264 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Containers-Server-HNS-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0xa6fc Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Containers-Server-HNS-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.mum Handle ID: 0x1a09c Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\HyperV-Networking-Containers-Server-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0x9ee4 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\HyperV-Networking-Containers-Server-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.mum Handle ID: 0xbb78 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\HyperV-Networking-Containers-Server-merged-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0xc700 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\HyperV-Networking-Containers-Server-merged-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.mum Handle ID: 0x9f00 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\HyperV-Guest-KernelInt-Package~31bf3856ad364e35~amd64~~10.0.26100.6725.cat Handle ID: 0xc9d8 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\HyperV-Guest-KernelInt-Package~31bf3856ad364e35~amd64~~10.0.26100.6725.mum Handle ID: 0xc9d8 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\HyperV-Guest-KMCL-Package~31bf3856ad364e35~amd64~~10.0.26100.6725.cat Handle ID: 0xa28c Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\HyperV-Guest-KMCL-Package~31bf3856ad364e35~amd64~~10.0.26100.6725.mum Handle ID: 0x7424 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\HyperV-KernelInt-VirtualDevice-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x1c500 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\HyperV-KernelInt-VirtualDevice-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.mum Handle ID: 0xd3c0 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\HyperV-KernelInt-VSP-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x1d4a4 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\HyperV-KernelInt-VSP-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.mum Handle ID: 0x1abec Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-OneCore-Containers-Client-Manager-Shared-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0x8720 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-OneCore-Containers-Client-Manager-Shared-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.mum Handle ID: 0x6e4 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-OneCore-Containers-Client-Manager-Shared-merged-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0xa20 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-OneCore-Containers-Client-Manager-Shared-merged-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.mum Handle ID: 0xca48 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\HyperV-Feature-Containers-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0x9d34 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\HyperV-Feature-Containers-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.mum Handle ID: 0xa6fc Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\HyperV-Compute-Host-Containers-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x1aa14 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\HyperV-Compute-Host-Containers-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.mum Handle ID: 0x9ee4 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\HyperV-Compute-Host-Containers-merged-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0xaad4 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\HyperV-Compute-Host-Containers-merged-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.mum Handle ID: 0xa20 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Onecore-SPP-VirtualDevice-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x6a10 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Onecore-SPP-VirtualDevice-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.mum Handle ID: 0x9d34 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Client-License-Flexible-Platform-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0xa3b0 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Client-License-Flexible-Platform-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.mum Handle ID: 0xa28c Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Hyper-V-ClientEdition-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0xbca4 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Hyper-V-ClientEdition-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.mum Handle ID: 0x1d4a4 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\HyperV-UX-PowerShell-Module-HyperV-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x5034 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\HyperV-UX-PowerShell-Module-HyperV-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.mum Handle ID: 0x6a10 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\HyperV-UX-PowerShell-Module-HyperV-merged-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x29e4 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\HyperV-UX-PowerShell-Module-HyperV-merged-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.mum Handle ID: 0x6a10 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\HyperV-UX-Common-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x19b58 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\HyperV-UX-Common-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.mum Handle ID: 0xa3b0 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Hyper-V-Package-base-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0x7950 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Hyper-V-Package-base-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.mum Handle ID: 0xac20 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Hyper-V-Package-base-merged-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0xc888 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Hyper-V-Package-base-merged-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.mum Handle ID: 0xa3b0 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-HgsClient-Core-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0x1b4fc Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-HgsClient-Core-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.mum Handle ID: 0x6a10 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Hyper-V-Services-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0x8394 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Hyper-V-Services-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.mum Handle ID: 0x4f34 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Hyper-V-Offline-Common-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0xd0d4 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Hyper-V-Offline-Common-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.mum Handle ID: 0x7950 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Hyper-V-Offline-Common-merged-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0xc5b0 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Hyper-V-Offline-Common-merged-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.mum Handle ID: 0xc888 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Hyper-V-Offline-Core-Group-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0x8704 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Hyper-V-Offline-Core-Group-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.mum Handle ID: 0x7950 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\HyperV-VMMS-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0x1c17c Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\HyperV-VMMS-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.mum Handle ID: 0xd0d4 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Hyper-V-Online-Services-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0xbfc0 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Hyper-V-Online-Services-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.mum Handle ID: 0xc5b0 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\HyperV-Compute-System-VirtualMachine-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0x8b2c Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\HyperV-Compute-System-VirtualMachine-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.mum Handle ID: 0x8704 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Product-Data-Ge-26143-Version-EKB-Wrapper-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.mum Handle ID: 0x5d00 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Product-Data-Ge-26143-Version-EKB-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0x9104 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Product-Data-Ge-26143-Version-EKB-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.mum Handle ID: 0x5d00 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Product-Data-Ge-26144-Version-EKB-Wrapper-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0x84b0 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Product-Data-Ge-26144-Version-EKB-Wrapper-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.mum Handle ID: 0x9a08 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Product-Data-Ge-26144-Version-EKB-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0xbc78 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Product-Data-Ge-26144-Version-EKB-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.mum Handle ID: 0x6190 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Product-Data-Ge-26145-Version-EKB-Wrapper-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0x6440 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Product-Data-Ge-26145-Version-EKB-Wrapper-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.mum Handle ID: 0x9104 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Product-Data-Ge-26145-Version-EKB-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0x1b808 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Product-Data-Ge-26145-Version-EKB-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.mum Handle ID: 0x6448 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Product-Data-Ge-26200-Version-EKB-Wrapper-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0x7ec4 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Product-Data-Ge-26200-Version-EKB-Wrapper-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.mum Handle ID: 0xaad4 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Product-Data-Ge-26200-Version-EKB-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0x2088 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Product-Data-Ge-26200-Version-EKB-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.mum Handle ID: 0x84b0 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Product-Data-Ge-26220-Version-EKB-Wrapper-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0x8298 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Product-Data-Ge-26220-Version-EKB-Wrapper-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.mum Handle ID: 0x5034 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Product-Data-Ge-26220-Version-EKB-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0xe40 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Product-Data-Ge-26220-Version-EKB-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.mum Handle ID: 0x45dc Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-UpdateTargeting-ClientOS-Ge-26141-Version-EKB-Wrapper-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0x43c Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-UpdateTargeting-ClientOS-Ge-26141-Version-EKB-Wrapper-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.mum Handle ID: 0x1cb70 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-UpdateTargeting-ClientOS-Ge-26141-Version-EKB-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0xcd38 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-UpdateTargeting-ClientOS-Ge-26141-Version-EKB-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.mum Handle ID: 0xbc78 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-UpdateTargeting-ClientOS-Ge-26142-Version-EKB-Wrapper-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0x19d20 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-UpdateTargeting-ClientOS-Ge-26142-Version-EKB-Wrapper-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.mum Handle ID: 0x1cb70 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-UpdateTargeting-ClientOS-Ge-26142-Version-EKB-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0x8060 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-UpdateTargeting-ClientOS-Ge-26142-Version-EKB-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.mum Handle ID: 0x17f8 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-UpdateTargeting-ClientOS-Ge-26143-Version-EKB-Wrapper-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0xdcd4 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-UpdateTargeting-ClientOS-Ge-26143-Version-EKB-Wrapper-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.mum Handle ID: 0x59c Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-UpdateTargeting-ClientOS-Ge-26143-Version-EKB-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0x1cb54 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-UpdateTargeting-ClientOS-Ge-26143-Version-EKB-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.mum Handle ID: 0x17f8 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-UpdateTargeting-ClientOS-Ge-26144-Version-EKB-Wrapper-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0x7ef8 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-UpdateTargeting-ClientOS-Ge-26144-Version-EKB-Wrapper-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.mum Handle ID: 0x1cb70 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-UpdateTargeting-ClientOS-Ge-26144-Version-EKB-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0x564 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-UpdateTargeting-ClientOS-Ge-26144-Version-EKB-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.mum Handle ID: 0xdcd4 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-UpdateTargeting-ClientOS-Ge-26145-Version-EKB-Wrapper-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0x8f88 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-UpdateTargeting-ClientOS-Ge-26145-Version-EKB-Wrapper-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.mum Handle ID: 0x19d20 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-UpdateTargeting-ClientOS-Ge-26145-Version-EKB-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0xd5ac Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-UpdateTargeting-ClientOS-Ge-26145-Version-EKB-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.mum Handle ID: 0x8060 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-UpdateTargeting-ClientOS-Ge-26200-Version-EKB-Wrapper-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0xb38 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-UpdateTargeting-ClientOS-Ge-26200-Version-EKB-Wrapper-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.mum Handle ID: 0x1cb54 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-UpdateTargeting-ClientOS-Ge-26200-Version-EKB-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0x553c Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-UpdateTargeting-ClientOS-Ge-26200-Version-EKB-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.mum Handle ID: 0x7ef8 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-UpdateTargeting-ClientOS-Ge-26220-Version-EKB-Wrapper-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0x1be0c Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-UpdateTargeting-ClientOS-Ge-26220-Version-EKB-Wrapper-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.mum Handle ID: 0xd5ac Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-UpdateTargeting-ClientOS-Ge-26220-Version-EKB-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0x4df4 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-UpdateTargeting-ClientOS-Ge-26220-Version-EKB-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.mum Handle ID: 0xb38 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0xbaf4 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.mum Handle ID: 0x553c Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-AppManagement-Common-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x1c398 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-AppManagement-Common-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.mum Handle ID: 0x1be0c Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Client-AssignedAccess-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x94e4 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Client-AssignedAccess-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.mum Handle ID: 0x4df4 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\HyperV-Compute-System-AzureVirtualMachine-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0xdfc8 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\HyperV-Compute-System-AzureVirtualMachine-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.mum Handle ID: 0xc5b0 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\HyperV-IntegrationComponents-VirtualDevice-Server-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x1cbd4 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\HyperV-IntegrationComponents-VirtualDevice-Server-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.mum Handle ID: 0x1b4fc Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\HyperV-LegacyChipset-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0x35d4 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\HyperV-LegacyChipset-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.mum Handle ID: 0x8b2c Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\HyperV-LegacyChipset-merged-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0xc488 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\HyperV-LegacyChipset-merged-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.mum Handle ID: 0xdfc8 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\HyperV-Storage-VirtualDevice-IDE-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0xff0 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\HyperV-Storage-VirtualDevice-IDE-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.mum Handle ID: 0x1cbd4 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\HyperV-Storage-VirtualDevice-IDE-merged-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x1c210 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\HyperV-Storage-VirtualDevice-IDE-merged-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.mum Handle ID: 0x35d4 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\HyperV-Vpci-VirtualDevice-DDA-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x17f8 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\HyperV-Vpci-VirtualDevice-DDA-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.mum Handle ID: 0x35d4 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\HyperV-Vpci-VirtualDevice-DDA-merged-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x59c Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\HyperV-Vpci-VirtualDevice-DDA-merged-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.mum Handle ID: 0x1c17c Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\HyperV-Storage-VirtualDevice-FibreChannel-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0x8bd4 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\HyperV-Storage-VirtualDevice-FibreChannel-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.mum Handle ID: 0xbfc0 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\HyperV-UX-UI-Client-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0x1b5bc Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\HyperV-UX-UI-Client-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.mum Handle ID: 0xbca4 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\HyperV-UX-UI-Client-merged-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0xa424 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\HyperV-UX-UI-Client-merged-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.mum Handle ID: 0x29e4 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\HyperV-UX-UI-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0x6840 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\HyperV-UX-UI-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.mum Handle ID: 0x6840 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\HyperV-UX-UI-merged-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0x1c4f4 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\HyperV-UX-UI-merged-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.mum Handle ID: 0x29e4 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-All-Client-Ge-Beta-Version-EKB-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0x6840 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-All-Client-Ge-Beta-Version-EKB-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.mum Handle ID: 0x1b3cc Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\DesktopEditions-Layer-Data-VersionInfo-Dynamic-EKB-Wrapper-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0x2ae8 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\DesktopEditions-Layer-Data-VersionInfo-Dynamic-EKB-Wrapper-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.mum Handle ID: 0x2ae8 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-DesktopEditions-Layer-Data-VersionInfo-Dynamic-Ge-Beta-Version-EKB-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0xd8b4 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-DesktopEditions-Layer-Data-VersionInfo-Dynamic-Ge-Beta-Version-EKB-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.mum Handle ID: 0x1b5bc Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Product-Data-Ge-Beta-Version-EKB-Wrapper-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0xa510 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Product-Data-Ge-Beta-Version-EKB-Wrapper-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.mum Handle ID: 0x2ae8 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Product-Data-Ge-Beta-Version-EKB-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0x1b958 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Product-Data-Ge-Beta-Version-EKB-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.mum Handle ID: 0x1b720 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-UpdateTargeting-ClientOS-Ge-Beta-Version-EKB-Wrapper-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0x5ffc Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-UpdateTargeting-ClientOS-Ge-Beta-Version-EKB-Wrapper-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.mum Handle ID: 0xd8b4 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-UpdateTargeting-ClientOS-Ge-Beta-Version-EKB-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0x1b938 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-UpdateTargeting-ClientOS-Ge-Beta-Version-EKB-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.mum Handle ID: 0xa510 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-All-Client-Ge-Consolidated-Version-EKB-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0x5fec Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-All-Client-Ge-Consolidated-Version-EKB-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.mum Handle ID: 0x1b958 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\DesktopEditions-Layer-Data-VersionInfo-Dynamic-26141-EKB-Wrapper-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0x6450 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\DesktopEditions-Layer-Data-VersionInfo-Dynamic-26141-EKB-Wrapper-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.mum Handle ID: 0x5ffc Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-DesktopEditions-Layer-Data-VersionInfo-Dynamic-Ge-26141-Version-EKB-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0x1c30 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-DesktopEditions-Layer-Data-VersionInfo-Dynamic-Ge-26141-Version-EKB-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.mum Handle ID: 0x1b938 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\DesktopEditions-Layer-Data-VersionInfo-Dynamic-26142-EKB-Wrapper-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0x74e8 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\DesktopEditions-Layer-Data-VersionInfo-Dynamic-26142-EKB-Wrapper-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.mum Handle ID: 0x5ffc Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-DesktopEditions-Layer-Data-VersionInfo-Dynamic-Ge-26142-Version-EKB-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0x1a3e4 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-DesktopEditions-Layer-Data-VersionInfo-Dynamic-Ge-26142-Version-EKB-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.mum Handle ID: 0x1c210 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\DesktopEditions-Layer-Data-VersionInfo-Dynamic-26143-EKB-Wrapper-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0x2134 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\DesktopEditions-Layer-Data-VersionInfo-Dynamic-26143-EKB-Wrapper-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.mum Handle ID: 0x1c30 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-DesktopEditions-Layer-Data-VersionInfo-Dynamic-Ge-26143-Version-EKB-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0x67b4 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-DesktopEditions-Layer-Data-VersionInfo-Dynamic-Ge-26143-Version-EKB-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.mum Handle ID: 0x74e8 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\DesktopEditions-Layer-Data-VersionInfo-Dynamic-26144-EKB-Wrapper-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0x4e70 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\DesktopEditions-Layer-Data-VersionInfo-Dynamic-26144-EKB-Wrapper-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.mum Handle ID: 0x1c30 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-DesktopEditions-Layer-Data-VersionInfo-Dynamic-Ge-26144-Version-EKB-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0x6004 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-DesktopEditions-Layer-Data-VersionInfo-Dynamic-Ge-26144-Version-EKB-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.mum Handle ID: 0x1a3e4 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\DesktopEditions-Layer-Data-VersionInfo-Dynamic-26145-EKB-Wrapper-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0x6448 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\DesktopEditions-Layer-Data-VersionInfo-Dynamic-26145-EKB-Wrapper-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.mum Handle ID: 0x2134 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-DesktopEditions-Layer-Data-VersionInfo-Dynamic-Ge-26145-Version-EKB-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0x4b40 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-DesktopEditions-Layer-Data-VersionInfo-Dynamic-Ge-26145-Version-EKB-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.mum Handle ID: 0x6450 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\DesktopEditions-Layer-Data-VersionInfo-Dynamic-26200-EKB-Wrapper-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0x4604 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\DesktopEditions-Layer-Data-VersionInfo-Dynamic-26200-EKB-Wrapper-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.mum Handle ID: 0x6004 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-DesktopEditions-Layer-Data-VersionInfo-Dynamic-Ge-26200-Version-EKB-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0x1c504 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-DesktopEditions-Layer-Data-VersionInfo-Dynamic-Ge-26200-Version-EKB-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.mum Handle ID: 0x1c500 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\DesktopEditions-Layer-Data-VersionInfo-Dynamic-26220-EKB-Wrapper-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0x1aed0 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\DesktopEditions-Layer-Data-VersionInfo-Dynamic-26220-EKB-Wrapper-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.mum Handle ID: 0x1c4f4 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-DesktopEditions-Layer-Data-VersionInfo-Dynamic-Ge-26220-Version-EKB-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0x8084 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-DesktopEditions-Layer-Data-VersionInfo-Dynamic-Ge-26220-Version-EKB-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.mum Handle ID: 0x67b4 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-OneCore-EnterpriseTempControls-ActiveConfig-25h2-Wrapper-Package~31bf3856ad364e35~amd64~~10.0.26100.6725.cat Handle ID: 0x57f8 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-OneCore-EnterpriseTempControls-ActiveConfig-25h2-Wrapper-Package~31bf3856ad364e35~amd64~~10.0.26100.6725.mum Handle ID: 0x4e70 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-MonthlyBundles-26200-EKB-Wrapper-Package~31bf3856ad364e35~amd64~~10.0.26100.6725.cat Handle ID: 0x45dc Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-MonthlyBundles-26200-EKB-Wrapper-Package~31bf3856ad364e35~amd64~~10.0.26100.6725.mum Handle ID: 0x1aed0 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Product-Data-DisplayVersion-Ge-25h2-Version-EKB-Wrapper-Package~31bf3856ad364e35~amd64~~10.0.26100.6725.cat Handle ID: 0x1cb70 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Product-Data-DisplayVersion-Ge-25h2-Version-EKB-Wrapper-Package~31bf3856ad364e35~amd64~~10.0.26100.6725.mum Handle ID: 0x4604 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Product-Data-Ge-26141-Version-EKB-Wrapper-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0x73b8 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Product-Data-Ge-26141-Version-EKB-Wrapper-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.mum Handle ID: 0x1aed0 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Product-Data-Ge-26141-Version-EKB-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0x5d00 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Product-Data-Ge-26141-Version-EKB-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.mum Handle ID: 0x8084 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Product-Data-Ge-26142-Version-EKB-Wrapper-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0xa9f4 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Product-Data-Ge-26142-Version-EKB-Wrapper-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.mum Handle ID: 0x8084 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Product-Data-Ge-26142-Version-EKB-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0x9a08 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Product-Data-Ge-26142-Version-EKB-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.mum Handle ID: 0x73b8 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Product-Data-Ge-26143-Version-EKB-Wrapper-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0x6190 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Client-ShellLauncher-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x1c168 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Client-ShellLauncher-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.mum Handle ID: 0xbaf4 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Embedded-ShellLauncher-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x1c028 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Embedded-ShellLauncher-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.mum Handle ID: 0x1c398 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Containers-OptionalFeatures-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0x3538 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Containers-OptionalFeatures-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.mum Handle ID: 0x94e4 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Containers-DisposableClientVM-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0x35b4 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Containers-DisposableClientVM-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.mum Handle ID: 0xbaf4 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Containers-DisposableClientVM-merged-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0xd978 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Containers-DisposableClientVM-merged-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.mum Handle ID: 0x1c028 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Container-Professional-Metadata-Wrapper-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0xb1a4 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Container-Professional-Metadata-Wrapper-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.mum Handle ID: 0x3538 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Container-Professional-Payload-Wrapper-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0x1b828 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Container-Professional-Payload-Wrapper-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.mum Handle ID: 0xb204 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Containers-Client-Guest-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0x339c Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Containers-Client-Guest-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.mum Handle ID: 0x35b4 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-OneCore-Containers-Guest-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x1b954 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-OneCore-Containers-Guest-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.mum Handle ID: 0xd978 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-UtilityVM-Containers-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0xa554 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-UtilityVM-Containers-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.mum Handle ID: 0x1b828 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-OneCore-Containers-Client-Manager-Guest-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x1b074 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-OneCore-Containers-Client-Manager-Guest-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.mum Handle ID: 0x339c Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-OneCore-Containers-Client-Manager-Guest-merged-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x2bc0 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-OneCore-Containers-Client-Manager-Guest-merged-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.mum Handle ID: 0x1b954 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-HVSI-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0x1b120 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-HVSI-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.mum Handle ID: 0xa554 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Containers-ApplicationGuard-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0x2588 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Containers-ApplicationGuard-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.mum Handle ID: 0x1b074 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Containers-Guest-Gated-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0xd674 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Containers-Guest-Gated-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.mum Handle ID: 0xa554 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-NFS-ClientSKU-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0xb494 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-NFS-ClientSKU-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.mum Handle ID: 0x1b954 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-ClientForNFS-Infrastructure-OptGroup-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x2610 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-ClientForNFS-Infrastructure-OptGroup-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.mum Handle ID: 0x2588 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-NFS-ClientCore-D-Opt-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0xbddc Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-NFS-ClientCore-D-Opt-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.mum Handle ID: 0x1b954 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-NFS-Administration-D-Opt-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0xd598 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-NFS-Administration-D-Opt-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.mum Handle ID: 0xb494 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-OneCore-Containers-Client-Opt-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0x1ae24 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-OneCore-Containers-Client-Opt-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.mum Handle ID: 0x2610 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Containers-Server-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0x3b40 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Containers-Server-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.mum Handle ID: 0xb494 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Containers-Server-merged-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0xaa5c Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Containers-Server-merged-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.mum Handle ID: 0x8298 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-PeerDist-Client-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x7078 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-PeerDist-Client-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.mum Handle ID: 0xe40 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-PeerDist-Client-Group-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0xdb6c Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-PeerDist-Client-Group-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.mum Handle ID: 0x4b40 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-SecureStartup-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0xdb64 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-SecureStartup-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.mum Handle ID: 0x6440 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x92d0 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.mum Handle ID: 0x7078 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x7dd0 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.mum Handle ID: 0xdb6c Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-SMB1-Package~31bf3856ad364e35~amd64~~10.0.26100.6899.cat Handle ID: 0xdb60 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-SMB1-Package~31bf3856ad364e35~amd64~~10.0.26100.6899.mum Handle ID: 0xdb64 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-SMB1Server-D-Opt-Package~31bf3856ad364e35~amd64~~10.0.26100.6899.cat Handle ID: 0x753c Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-SMB1Server-D-Opt-Package~31bf3856ad364e35~amd64~~10.0.26100.6899.mum Handle ID: 0x92d0 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-TerminalServices-RemoteApplications-Client-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x92c4 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-TerminalServices-RemoteApplications-Client-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.mum Handle ID: 0x7dd0 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Windows-Defender-ApplicationGuard-Inbox-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x1cfc8 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Windows-Defender-ApplicationGuard-Inbox-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.mum Handle ID: 0xdb60 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Browser-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x705c Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Browser-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.mum Handle ID: 0x7dd0 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Client-EmbeddedExp-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x118c Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Client-EmbeddedExp-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.mum Handle ID: 0x92c4 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Embedded-AssignedAccessCsp-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x7060 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Embedded-AssignedAccessCsp-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.mum Handle ID: 0x1cfc8 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Embedded-KeyboardFilter-Core-Package~31bf3856ad364e35~amd64~~10.0.26100.6725.cat Handle ID: 0xcbb4 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Embedded-KeyboardFilter-Core-Package~31bf3856ad364e35~amd64~~10.0.26100.6725.mum Handle ID: 0x705c Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Shell-CustomShellHost-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x253c Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Shell-CustomShellHost-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.mum Handle ID: 0x118c Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Enterprise-Desktop-Shared-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0xc78c Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Enterprise-Desktop-Shared-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.mum Handle ID: 0x7060 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Enterprise-Desktop-Shared-removable-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x6964 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Enterprise-Desktop-Shared-removable-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.mum Handle ID: 0xcbb4 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Printing-PremiumTools-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x9d0 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Printing-PremiumTools-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.mum Handle ID: 0xcbb4 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-ConfigCI-Onecore-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x69f8 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-ConfigCI-Onecore-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.mum Handle ID: 0xcbb4 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-DeviceGuard-GPEXT-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0xc53c Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-DeviceGuard-GPEXT-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.mum Handle ID: 0x6964 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Embedded-UnifiedWriteFilterCSP-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x724c Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Embedded-UnifiedWriteFilterCSP-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.mum Handle ID: 0x9d0 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-GroupPolicy-ClientExtensions-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0xaa60 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-GroupPolicy-ClientExtensions-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.mum Handle ID: 0x564 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-GroupPolicy-ClientTools-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0x94b4 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-GroupPolicy-ClientTools-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.mum Handle ID: 0x3b40 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-GroupPolicy-ClientTools-merged-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0x1c2cc Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-GroupPolicy-ClientTools-merged-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.mum Handle ID: 0xaa5c Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-MultiPoint-Connector-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0xdb5c Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-MultiPoint-Connector-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.mum Handle ID: 0xaa5c Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\MultiPoint-Connector-Opt-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x1c2b8 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\MultiPoint-Connector-Opt-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.mum Handle ID: 0x94b4 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\MultiPoint-Tools-Opt-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0x1c078 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\MultiPoint-Tools-Opt-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.mum Handle ID: 0x1c2cc Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-OfflineFiles-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0x4434 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-OfflineFiles-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.mum Handle ID: 0xdb5c Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-OfflineFiles-merged-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0x2748 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-OfflineFiles-merged-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.mum Handle ID: 0x69f8 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-OfflineFiles-UI-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0xd84c Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-OfflineFiles-UI-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.mum Handle ID: 0xc53c Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-StorageService-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x40e4 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-StorageService-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.mum Handle ID: 0x4434 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-TerminalServices-WMIProvider-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x2084 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-TerminalServices-WMIProvider-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.mum Handle ID: 0x1b808 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-ZTDNS-Package-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x3f7c Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-ZTDNS-Package-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.mum Handle ID: 0x2088 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-IIS-WebServer-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x1b788 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-IIS-WebServer-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.mum Handle ID: 0x2748 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-IIS-WebServer-ServerCommon-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x2490 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-IIS-WebServer-ServerCommon-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.mum Handle ID: 0xd84c Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-IIS-WebServer-AddOn-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0xd454 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-IIS-WebServer-AddOn-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.mum Handle ID: 0xd598 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-IIS-WebServer-AddOn-ServerCommon-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x2234 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-IIS-WebServer-AddOn-ServerCommon-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.mum Handle ID: 0x2748 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-IIS-WebServer-AddOn-2-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x4434 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-IIS-WebServer-AddOn-2-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.mum Handle ID: 0x4434 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-MSMQ-Client-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0x426c Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-MSMQ-Client-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.mum Handle ID: 0x3f7c Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-msmq-server-Opt-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x2638 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-msmq-server-Opt-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.mum Handle ID: 0x8f88 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-COM-MSMQ-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0xa8e4 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-COM-MSMQ-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.mum Handle ID: 0x1b788 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-MSMQ-MMC-OptGroup-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0x298c Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-MSMQ-MMC-OptGroup-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.mum Handle ID: 0xbf50 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-msmq-mmc-Opt-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x9f78 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-msmq-mmc-Opt-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.mum Handle ID: 0xbf50 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-msmq-powershell-Opt-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0x2944 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-msmq-powershell-Opt-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.mum Handle ID: 0xa8e4 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-msmq-runtime-Opt-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x257c Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-msmq-runtime-Opt-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.mum Handle ID: 0x298c Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-msmq-triggers-Opt-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x4fd4 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-msmq-triggers-Opt-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.mum Handle ID: 0x9f78 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-EditionPack-Professional-WOW64-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0x4fe0 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-EditionPack-Professional-WOW64-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.mum Handle ID: 0x724c Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-EditionPack-Professional-WOW64-removable-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x40dc Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-EditionPack-Professional-WOW64-removable-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.mum Handle ID: 0x426c Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-AppManagement-UEV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x4834 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-AppManagement-UEV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.mum Handle ID: 0x40e4 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Win2-MSXML6-WOW64-Feature~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x40e8 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Win2-MSXML6-WOW64-Feature~31bf3856ad364e35~amd64~~10.0.26100.7019.mum Handle ID: 0x2084 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-CoreSystem-MSXML6-WOW64-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x7028 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-CoreSystem-MSXML6-WOW64-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.mum Handle ID: 0x40dc Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Containers-Client-Manager-WOW64-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x9284 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Containers-Client-Manager-WOW64-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.mum Handle ID: 0x4834 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Containers-ApplicationGuard-Shared-WOW64-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x7068 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Containers-ApplicationGuard-Shared-WOW64-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.mum Handle ID: 0x40e8 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Hyper-V-ClientEdition-WOW64-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x1b8b8 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Hyper-V-ClientEdition-WOW64-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.mum Handle ID: 0x7028 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\HyperV-UX-PowerShell-Module-HyperV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x1b8b0 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\HyperV-UX-PowerShell-Module-HyperV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.mum Handle ID: 0x7028 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-AppManagement-AppV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0xdb9c Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-AppManagement-AppV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.mum Handle ID: 0x7068 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-HVSI-WOW64-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0x1c9a8 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-HVSI-WOW64-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.mum Handle ID: 0x1b8b8 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Containers-ApplicationGuard-WOW64-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x848 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Containers-ApplicationGuard-WOW64-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.mum Handle ID: 0x7028 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Containers-Guest-Gated-WOW64-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0xd3b0 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Containers-Guest-Gated-WOW64-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.mum Handle ID: 0x4fd4 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-PeerDist-Client-WOW64-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0xd3ac Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-PeerDist-Client-WOW64-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.mum Handle ID: 0x4fe0 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-PeerDist-Client-Group-WOW64-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x1d04 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-PeerDist-Client-Group-WOW64-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.mum Handle ID: 0x848 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Windows-Defender-ApplicationGuard-Inbox-WOW64-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x2a14 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Windows-Defender-ApplicationGuard-Inbox-WOW64-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.mum Handle ID: 0xd3b0 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Enterprise-Desktop-Shared-WOW64-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0x1d98 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Enterprise-Desktop-Shared-WOW64-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.mum Handle ID: 0xd3ac Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-ConfigCI-Onecore-WOW64-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x2284 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-ConfigCI-Onecore-WOW64-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.mum Handle ID: 0xd3b0 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-GroupPolicy-ClientExtensions-WOW64-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0xcb1c Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-GroupPolicy-ClientExtensions-WOW64-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.mum Handle ID: 0x2234 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0x652c Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.mum Handle ID: 0xd3b0 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-MSMQ-Client-WOW64-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0x1d880 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-MSMQ-Client-WOW64-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.mum Handle ID: 0x1c9a8 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-MSMQ-MMC-OptGroup-WOW64-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0x2a0c Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-MSMQ-MMC-OptGroup-WOW64-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.mum Handle ID: 0xd3b0 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-msmq-mmc-Opt-WOW64-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x6268 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-msmq-mmc-Opt-WOW64-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.mum Handle ID: 0x1d04 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-msmq-powershell-Opt-WOW64-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0x1d890 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-msmq-powershell-Opt-WOW64-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.mum Handle ID: 0x652c Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-msmq-runtime-Opt-WOW64-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x6260 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-msmq-runtime-Opt-WOW64-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.mum Handle ID: 0x1d04 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-RegulatedPackages-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0x69e4 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-RegulatedPackages-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.mum Handle ID: 0x6268 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Common-RegulatedPackages-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0x625c Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Common-RegulatedPackages-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.mum Handle ID: 0x6268 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Media-Foundation-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0x49c8 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Media-Foundation-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.mum Handle ID: 0x6260 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Multimedia-MF-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0x4448 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Multimedia-MF-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.mum Handle ID: 0x2944 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Multimedia-MF-merged-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x3cb8 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Multimedia-MF-merged-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.mum Handle ID: 0x69e4 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-OneCore-Multimedia-MFPMP-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0xa268 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-OneCore-Multimedia-MFPMP-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.mum Handle ID: 0x1cc4 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Multimedia-MFCore-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0xb4c4 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Multimedia-MFCore-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.mum Handle ID: 0x1d98 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Multimedia-MFCore-WCOSHeadless-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0xd494 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Multimedia-MFCore-WCOSHeadless-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.mum Handle ID: 0x2284 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Multimedia-MFCore-WCOSMinusHeadless-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0xd4a0 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Multimedia-MFCore-WCOSMinusHeadless-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.mum Handle ID: 0xa268 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Multimedia-RestrictedCodecs-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0x1a7a8 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Multimedia-RestrictedCodecs-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.mum Handle ID: 0xb4c4 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Multimedia-RestrictedCodecs-merged-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x240c Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Multimedia-RestrictedCodecs-merged-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.mum Handle ID: 0xd494 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Multimedia-RestrictedCodecsCore-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0x49c0 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Multimedia-RestrictedCodecsCore-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.mum Handle ID: 0x257c Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Multimedia-RestrictedCodecsCore-WCOSHeadless-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0x69dc Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Multimedia-RestrictedCodecsCore-WCOSHeadless-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.mum Handle ID: 0x49c8 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Multimedia-RestrictedCodecsCore-WCOSMinusHeadless-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x2c74 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Multimedia-RestrictedCodecsCore-WCOSMinusHeadless-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.mum Handle ID: 0x625c Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Multimedia-RestrictedCodecsExt-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x1af90 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Multimedia-RestrictedCodecsExt-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.mum Handle ID: 0x625c Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Multimedia-RestrictedCodecsExt-WCOSHeadless-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x1b0d0 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Multimedia-RestrictedCodecsExt-WCOSHeadless-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.mum Handle ID: 0x2a14 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Multimedia-RestrictedCodecsExt-WCOSMinusHeadless-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x1a1b0 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Multimedia-RestrictedCodecsExt-WCOSMinusHeadless-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.mum Handle ID: 0x69dc Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Media-Format-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x1b0cc Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Media-Format-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.mum Handle ID: 0x2c74 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Media-Format-merged-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x59f8 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Media-Format-merged-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.mum Handle ID: 0x1b0d0 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-WPD-LegacyWmdmFeature-Feature-Package~31bf3856ad364e35~amd64~~10.0.26100.6899.cat Handle ID: 0xa440 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-WPD-LegacyWmdmFeature-Feature-Package~31bf3856ad364e35~amd64~~10.0.26100.6899.mum Handle ID: 0x1a1b0 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Media-Streaming-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x88d8 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Media-Streaming-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.mum Handle ID: 0x1b0cc Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Media-Streaming-merged-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x1f98 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Media-Streaming-merged-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.mum Handle ID: 0x1b0cc Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-OneCore-Multimedia-CastingCommon-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x8b80 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-OneCore-Multimedia-CastingCommon-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.mum Handle ID: 0x1a1b0 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-OneCore-Multimedia-CastingReceiver-Media-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x8050 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-OneCore-Multimedia-CastingReceiver-Media-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.mum Handle ID: 0x1b0d0 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-OneCore-Multimedia-CastingTransmitter-Media-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x6e40 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-OneCore-Multimedia-CastingTransmitter-Media-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.mum Handle ID: 0x1f98 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Multimedia-WMPDMC-Package~31bf3856ad364e35~amd64~~10.0.26100.6899.cat Handle ID: 0x1d6c Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Multimedia-WMPDMC-Package~31bf3856ad364e35~amd64~~10.0.26100.6899.mum Handle ID: 0x8b80 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Portable-Devices-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x2aec Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Portable-Devices-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.mum Handle ID: 0x8b80 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Portable-Devices-merged-Package~31bf3856ad364e35~amd64~~10.0.26100.6725.cat Handle ID: 0x28bc Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Portable-Devices-merged-Package~31bf3856ad364e35~amd64~~10.0.26100.6725.mum Handle ID: 0xa440 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-WPD-UltimatePortableDeviceFeature-Feature-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0xa434 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-WPD-UltimatePortableDeviceFeature-Feature-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.mum Handle ID: 0x88d8 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-WebcamExperience-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x28fc Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-WebcamExperience-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.mum Handle ID: 0x88d8 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-RegulatedPackages-WOW64-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0x2a08 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-RegulatedPackages-WOW64-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.mum Handle ID: 0x2904 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Common-RegulatedPackages-WOW64-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0x1b7ec Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Common-RegulatedPackages-WOW64-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.mum Handle ID: 0x2a0c Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Media-Foundation-WOW64-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0x1ca8 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Media-Foundation-WOW64-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.mum Handle ID: 0x28b0 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Multimedia-MF-WOW64-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0xcd7c Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Multimedia-MF-WOW64-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.mum Handle ID: 0x6e40 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Multimedia-MF-WOW64-merged-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x1c2c8 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Multimedia-MF-WOW64-merged-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.mum Handle ID: 0x1d6c Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-OneCore-Multimedia-MFPMP-WOW64-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x1c070 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-OneCore-Multimedia-MFPMP-WOW64-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.mum Handle ID: 0x1c2b8 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Multimedia-MFCore-WOW64-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0x1a9b8 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Multimedia-MFCore-WOW64-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.mum Handle ID: 0x1c078 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Multimedia-MFCore-WCOSHeadless-WOW64-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0x1c068 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Multimedia-MFCore-WCOSHeadless-WOW64-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.mum Handle ID: 0x1c2c8 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Multimedia-MFCore-WCOSMinusHeadless-WOW64-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0x7618 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Multimedia-MFCore-WCOSMinusHeadless-WOW64-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.mum Handle ID: 0x1c070 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Multimedia-RestrictedCodecs-WOW64-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0x1a9bc Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Multimedia-RestrictedCodecs-WOW64-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.mum Handle ID: 0x1a9b8 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Multimedia-RestrictedCodecs-WOW64-merged-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x4118 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Multimedia-RestrictedCodecs-WOW64-merged-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.mum Handle ID: 0x1a9b8 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Multimedia-RestrictedCodecsCore-WOW64-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0x4244 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Multimedia-RestrictedCodecsCore-WOW64-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.mum Handle ID: 0x7618 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Multimedia-RestrictedCodecsCore-WCOSHeadless-WOW64-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0x1be38 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Multimedia-RestrictedCodecsCore-WCOSHeadless-WOW64-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.mum Handle ID: 0x1a9bc Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Multimedia-RestrictedCodecsCore-WCOSMinusHeadless-WOW64-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x1a700 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Multimedia-RestrictedCodecsCore-WCOSMinusHeadless-WOW64-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.mum Handle ID: 0x1a9bc Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Multimedia-RestrictedCodecsExt-WOW64-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x1ba8 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Multimedia-RestrictedCodecsExt-WOW64-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.mum Handle ID: 0x1ca8 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Multimedia-RestrictedCodecsExt-WCOSHeadless-WOW64-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x1b8c Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Multimedia-RestrictedCodecsExt-WCOSHeadless-WOW64-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.mum Handle ID: 0x1a9bc Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Multimedia-RestrictedCodecsExt-WCOSMinusHeadless-WOW64-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0xb30c Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Multimedia-RestrictedCodecsExt-WCOSMinusHeadless-WOW64-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.mum Handle ID: 0x1a9bc Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Media-Format-WOW64-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x4240 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Media-Format-WOW64-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.mum Handle ID: 0xb1a4 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Media-Format-WOW64-merged-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x25a0 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Media-Format-WOW64-merged-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.mum Handle ID: 0x25a0 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-WPD-LegacyWmdmFeature-Feature-WOW64-Package~31bf3856ad364e35~amd64~~10.0.26100.6899.cat Handle ID: 0x4248 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-WPD-LegacyWmdmFeature-Feature-WOW64-Package~31bf3856ad364e35~amd64~~10.0.26100.6899.mum Handle ID: 0x4244 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Media-Streaming-WOW64-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x28f8 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Media-Streaming-WOW64-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.mum Handle ID: 0x4240 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Media-Streaming-WOW64-merged-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x1b7e4 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Media-Streaming-WOW64-merged-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.mum Handle ID: 0x28fc Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-OneCore-Multimedia-CastingCommon-WOW64-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x1b844 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-OneCore-Multimedia-CastingCommon-WOW64-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.mum Handle ID: 0x1b7ec Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-OneCore-Multimedia-CastingReceiver-Media-WOW64-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x1af94 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-OneCore-Multimedia-CastingReceiver-Media-WOW64-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.mum Handle ID: 0x28f8 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Portable-Devices-WOW64-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x1b7dc Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Portable-Devices-WOW64-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.mum Handle ID: 0x1af90 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-WPD-UltimatePortableDeviceFeature-Feature-WOW64-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x1a9c0 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-WPD-UltimatePortableDeviceFeature-Feature-WOW64-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.mum Handle ID: 0x1b7e4 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-WebcamExperience-WOW64-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x4d0c Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-WebcamExperience-WOW64-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.mum Handle ID: 0x1af90 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Required-ShellExperiences-Desktop-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0x48e4 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Required-ShellExperiences-Desktop-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.mum Handle ID: 0x4248 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Required-ShellExperiences-Desktop-removable-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0xd7ac Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Required-ShellExperiences-Desktop-removable-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.mum Handle ID: 0x1a9c0 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-DesktopFileExplorer-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x4cf0 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-DesktopFileExplorer-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.mum Handle ID: 0x4d0c Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Runtime-Metadata-Desktop-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x1aaa4 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Runtime-Metadata-Desktop-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.mum Handle ID: 0x48e4 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-ShellExperienceHost-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0xd104 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-ShellExperienceHost-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.mum Handle ID: 0xd7ac Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Required-ShellExperiences-Desktop-WOW64-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x1aa9c Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Required-ShellExperiences-Desktop-WOW64-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.mum Handle ID: 0x4cf0 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Runtime-Metadata-Desktop-WOW64-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x1aaec Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Runtime-Metadata-Desktop-WOW64-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.mum Handle ID: 0xd7ac Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\HyperV-OptionalFeature-VirtualMachinePlatform-Client-Disabled-FOD-Package-Wrapper~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0x1aa94 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\HyperV-OptionalFeature-VirtualMachinePlatform-Client-Disabled-FOD-Package-Wrapper~31bf3856ad364e35~amd64~~10.0.26100.7171.mum Handle ID: 0xd7ac Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\HyperV-OptionalFeature-VirtualMachinePlatform-Client-Disabled-FOD-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0x1aae4 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\HyperV-OptionalFeature-VirtualMachinePlatform-Client-Disabled-FOD-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.mum Handle ID: 0x1aa9c Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-HyperV-OptionalFeature-VirtualMachinePlatform-Client-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0x1b83c Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-HyperV-OptionalFeature-VirtualMachinePlatform-Client-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.mum Handle ID: 0x1aaec Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\HyperV-Feature-VirtualMachinePlatform-Client-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0x1a780 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\HyperV-Feature-VirtualMachinePlatform-Client-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.mum Handle ID: 0x1b844 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Edge-WebView-FOD-Package-Wrapper~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0x1aae0 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Edge-WebView-FOD-Package-Wrapper~31bf3856ad364e35~amd64~~10.0.26100.7171.mum Handle ID: 0x1aa94 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Edge-WebView-FOD-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0x1a784 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Edge-WebView-FOD-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.mum Handle ID: 0x1aae4 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-OneCore-ApplicationModel-Sync-Desktop-FOD-Package-Wrapper~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0x368c Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-OneCore-ApplicationModel-Sync-Desktop-FOD-Package-Wrapper~31bf3856ad364e35~amd64~~10.0.26100.7171.mum Handle ID: 0x1a780 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-OneCore-ApplicationModel-Sync-Desktop-FOD-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0x1c5f8 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-OneCore-ApplicationModel-Sync-Desktop-FOD-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.mum Handle ID: 0x1b7dc Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-OneCore-ApplicationModel-Sync-Desktop-FOD-Package~31bf3856ad364e35~wow64~~10.0.26100.7019.cat Handle ID: 0x1aae0 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-OneCore-ApplicationModel-Sync-Desktop-FOD-Package~31bf3856ad364e35~wow64~~10.0.26100.7019.mum Handle ID: 0x1aae0 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-OneCore-DirectX-Database-FOD-Package-Wrapper~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0x7594 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-OneCore-DirectX-Database-FOD-Package-Wrapper~31bf3856ad364e35~amd64~~10.0.26100.7171.mum Handle ID: 0x1a784 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-OneCore-DirectX-Database-FOD-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0x225c Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-OneCore-DirectX-Database-FOD-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.mum Handle ID: 0x1aae0 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-DirectoryServices-ADAM-Client-FOD-Package-Wrapper~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0x39c8 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-DirectoryServices-ADAM-Client-FOD-Package-Wrapper~31bf3856ad364e35~amd64~~10.0.26100.7171.mum Handle ID: 0x2048 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-DirectoryServices-ADAM-Client-FOD-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0x49cc Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-DirectoryServices-ADAM-Client-FOD-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.mum Handle ID: 0x240c Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-DirectoryServices-ADAM-Client-OptGroup-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x4680 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-DirectoryServices-ADAM-Client-OptGroup-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.mum Handle ID: 0x240c Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-DirectoryServices-ADAM-Client-Admin-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x1b398 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-DirectoryServices-ADAM-Client-Admin-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.mum Handle ID: 0x2048 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-DirectoryServices-ADAM-Snapins-Admin-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x3bc0 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-DirectoryServices-ADAM-Snapins-Admin-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.mum Handle ID: 0x7594 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-DirectoryServices-ADAM-Core-Client-Opt-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x45c0 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-DirectoryServices-ADAM-Core-Client-Opt-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.mum Handle ID: 0x7594 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-DirectoryServices-ADAM-Tools-Opt-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x1a898 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-DirectoryServices-ADAM-Tools-Opt-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.mum Handle ID: 0x4680 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-DirectoryServices-ADAM-Snapins-Group-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x1cd44 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-DirectoryServices-ADAM-Snapins-Group-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.mum Handle ID: 0x225c Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-DirectoryServices-ADAM-Client-FOD-Package-Wrapper~31bf3856ad364e35~wow64~~10.0.26100.7171.cat Handle ID: 0xdb50 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-DirectoryServices-ADAM-Client-FOD-Package-Wrapper~31bf3856ad364e35~wow64~~10.0.26100.7171.mum Handle ID: 0x1b398 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-DirectoryServices-ADAM-Client-FOD-Package~31bf3856ad364e35~wow64~~10.0.26100.7171.cat Handle ID: 0x22a4 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-DirectoryServices-ADAM-Client-FOD-Package~31bf3856ad364e35~wow64~~10.0.26100.7171.mum Handle ID: 0x3bc0 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-EnterpriseClientSync-Host-FOD-Package-Wrapper~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0x1bfec Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-EnterpriseClientSync-Host-FOD-Package-Wrapper~31bf3856ad364e35~amd64~~10.0.26100.7171.mum Handle ID: 0x45c0 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-EnterpriseClientSync-Host-FOD-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0xb570 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-EnterpriseClientSync-Host-FOD-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.mum Handle ID: 0xdb50 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-EnterpriseClientSync-Host-Opt-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0xb560 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-EnterpriseClientSync-Host-Opt-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.mum Handle ID: 0x1ba8 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-EnterpriseClientSync-Host-FOD-Package-Wrapper~31bf3856ad364e35~wow64~~10.0.26100.7171.cat Handle ID: 0x1d644 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-EnterpriseClientSync-Host-FOD-Package-Wrapper~31bf3856ad364e35~wow64~~10.0.26100.7171.mum Handle ID: 0x1b8c Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-EnterpriseClientSync-Host-FOD-Package~31bf3856ad364e35~wow64~~10.0.26100.7171.cat Handle ID: 0xd79c Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-EnterpriseClientSync-Host-FOD-Package~31bf3856ad364e35~wow64~~10.0.26100.7171.mum Handle ID: 0x1a898 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Ethernet-Client-Intel-E1i68x64-FOD-Package-Wrapper~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0x1aa44 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Ethernet-Client-Intel-E1i68x64-FOD-Package-Wrapper~31bf3856ad364e35~amd64~~10.0.26100.7171.mum Handle ID: 0x22a4 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Ethernet-Client-Intel-E1i68x64-FOD-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0x1ac14 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Ethernet-Client-Intel-E1i68x64-FOD-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.mum Handle ID: 0x22a4 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Ethernet-Client-Intel-E2f68-FOD-Package-Wrapper~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0x6698 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Ethernet-Client-Intel-E2f68-FOD-Package-Wrapper~31bf3856ad364e35~amd64~~10.0.26100.7171.mum Handle ID: 0xd79c Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Ethernet-Client-Intel-E2f68-FOD-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0x1aa58 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Ethernet-Client-Intel-E2f68-FOD-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.mum Handle ID: 0x1cd44 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Ethernet-Client-Realtek-Rtcx21x64-FOD-Package-Wrapper~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0xc22c Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Ethernet-Client-Realtek-Rtcx21x64-FOD-Package-Wrapper~31bf3856ad364e35~amd64~~10.0.26100.7171.mum Handle ID: 0xd79c Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Ethernet-Client-Realtek-Rtcx21x64-FOD-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0x1a1f0 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Ethernet-Client-Realtek-Rtcx21x64-FOD-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.mum Handle ID: 0x22a4 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Ethernet-Client-Vmware-Vmxnet3-FOD-Package-Wrapper~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0x66cc Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Ethernet-Client-Vmware-Vmxnet3-FOD-Package-Wrapper~31bf3856ad364e35~amd64~~10.0.26100.7171.mum Handle ID: 0xb560 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Ethernet-Client-Vmware-Vmxnet3-FOD-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0xb538 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Ethernet-Client-Vmware-Vmxnet3-FOD-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.mum Handle ID: 0x1ac14 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-FodMetadataServicing-Desktop-Metadata-Package-Wrapper~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0x50a8 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-FodMetadataServicing-Desktop-Metadata-Package-Wrapper~31bf3856ad364e35~amd64~~10.0.26100.7171.mum Handle ID: 0xc22c Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-FodMetadataServicing-Desktop-Metadata-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0xb508 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-FodMetadataServicing-Desktop-Metadata-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.mum Handle ID: 0x1ac14 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Hello-Face-Package-Wrapper~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0x141c Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Hello-Face-Package-Wrapper~31bf3856ad364e35~amd64~~10.0.26100.7171.mum Handle ID: 0x1a1f0 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Hello-Face-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0x1a534 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Hello-Face-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.mum Handle ID: 0xb538 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-InternetExplorer-Optional-Package-Wrapper~31bf3856ad364e35~amd64~~11.0.26100.7171.cat Handle ID: 0x1488 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-InternetExplorer-Optional-Package-Wrapper~31bf3856ad364e35~amd64~~11.0.26100.7171.mum Handle ID: 0xb538 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-InternetExplorer-Optional-Package~31bf3856ad364e35~amd64~~11.0.26100.7171.cat Handle ID: 0x9f4c Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-InternetExplorer-Optional-Package~31bf3856ad364e35~amd64~~11.0.26100.7171.mum Handle ID: 0x141c Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Kernel-LA57-FoD-Package-Wrapper~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0x2054 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Kernel-LA57-FoD-Package-Wrapper~31bf3856ad364e35~amd64~~10.0.26100.7171.mum Handle ID: 0x1a534 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Kernel-LA57-FoD-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0x66c4 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Kernel-LA57-FoD-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.mum Handle ID: 0x1aa58 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Kernel-Package-IsolatedUserMode-Kernel-LA57-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0x3df8 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Kernel-Package-IsolatedUserMode-Kernel-LA57-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.mum Handle ID: 0x66cc Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Kernel-Package-OS-Kernel-LA57-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0x1d640 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Kernel-Package-OS-Kernel-LA57-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.mum Handle ID: 0x66cc Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-LanguageFeatures-Basic-en-us-Package-Wrapper~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0x1d640 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-LanguageFeatures-Basic-en-us-Package-Wrapper~31bf3856ad364e35~amd64~~10.0.26100.7171.mum Handle ID: 0xc22c Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-LanguageFeatures-Basic-en-us-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0x66c0 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-LanguageFeatures-Basic-en-us-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.mum Handle ID: 0x1d644 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Spelling-Dictionaries-en-us-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x3e90 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Spelling-Dictionaries-en-us-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.mum Handle ID: 0xc22c Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-LanguageFeatures-Handwriting-en-us-Package-Wrapper~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0x3e54 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-LanguageFeatures-Handwriting-en-us-Package-Wrapper~31bf3856ad364e35~amd64~~10.0.26100.7171.mum Handle ID: 0x3df8 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-LanguageFeatures-Handwriting-en-us-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0x3db8 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-LanguageFeatures-Handwriting-en-us-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.mum Handle ID: 0x66c0 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-LanguageFeatures-OCR-en-us-Package-Wrapper~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0x7ed8 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-LanguageFeatures-OCR-en-us-Package-Wrapper~31bf3856ad364e35~amd64~~10.0.26100.7171.mum Handle ID: 0x3df8 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-LanguageFeatures-OCR-en-us-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0x1cc2c Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-LanguageFeatures-OCR-en-us-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.mum Handle ID: 0x3e54 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-LanguageFeatures-Speech-en-us-Package-Wrapper~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0x6744 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-LanguageFeatures-Speech-en-us-Package-Wrapper~31bf3856ad364e35~amd64~~10.0.26100.7171.mum Handle ID: 0x6698 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-LanguageFeatures-Speech-en-us-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0x1b838 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-LanguageFeatures-Speech-en-us-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.mum Handle ID: 0x1d640 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-LanguageFeatures-TextToSpeech-en-us-Package-Wrapper~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0x6694 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-LanguageFeatures-TextToSpeech-en-us-Package-Wrapper~31bf3856ad364e35~amd64~~10.0.26100.7171.mum Handle ID: 0x1b83c Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-LanguageFeatures-TextToSpeech-en-us-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0xa4c0 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-LanguageFeatures-TextToSpeech-en-us-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.mum Handle ID: 0x1cc2c Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-MediaPlayer-Package-Wrapper~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0xd9e0 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-MediaPlayer-Package-Wrapper~31bf3856ad364e35~amd64~~10.0.26100.7171.mum Handle ID: 0x3db8 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-MediaPlayer-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0x9894 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-MediaPlayer-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.mum Handle ID: 0x7ed8 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-MediaPlayer-Payload-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0x1d724 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-MediaPlayer-Payload-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.mum Handle ID: 0x3db8 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-MediaPlayer-Opt-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0xa9bc Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-MediaPlayer-Opt-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.mum Handle ID: 0x66c0 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-MediaPlayer-Opt-merged-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x7630 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-MediaPlayer-Opt-merged-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.mum Handle ID: 0x368c Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Media-Player-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0x9480 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Media-Player-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.mum Handle ID: 0xd9e0 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-WMPNetworkSharingService-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x2548 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-WMPNetworkSharingService-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.mum Handle ID: 0x9894 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-WMPNetworkSharingService-Opt-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x92f4 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-WMPNetworkSharingService-Opt-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.mum Handle ID: 0x7630 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-MediaPlayer-Package-Wrapper~31bf3856ad364e35~wow64~~10.0.26100.7171.cat Handle ID: 0x68c Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-MediaPlayer-Package-Wrapper~31bf3856ad364e35~wow64~~10.0.26100.7171.mum Handle ID: 0x9480 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-MediaPlayer-Package~31bf3856ad364e35~wow64~~10.0.26100.7171.cat Handle ID: 0x1b53c Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-MediaPlayer-Package~31bf3856ad364e35~wow64~~10.0.26100.7171.mum Handle ID: 0x7630 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-MediaPlayer-Payload-WOW64-Package~31bf3856ad364e35~wow64~~10.0.26100.7171.cat Handle ID: 0x1af98 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-MediaPlayer-Payload-WOW64-Package~31bf3856ad364e35~wow64~~10.0.26100.7171.mum Handle ID: 0x2a08 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-MediaPlayer-Opt-WOW64-Package~31bf3856ad364e35~wow64~~10.0.26100.7171.cat Handle ID: 0x2d5c Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-MediaPlayer-Opt-WOW64-Package~31bf3856ad364e35~wow64~~10.0.26100.7171.mum Handle ID: 0x1af94 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Media-Player-WOW64-Package~31bf3856ad364e35~wow64~~10.0.26100.7171.cat Handle ID: 0x1a4c8 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Media-Player-WOW64-Package~31bf3856ad364e35~wow64~~10.0.26100.7171.mum Handle ID: 0x1b53c Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-WMPNetworkSharingService-WOW64-Package~31bf3856ad364e35~wow64~~10.0.26100.7019.cat Handle ID: 0xccb8 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-WMPNetworkSharingService-WOW64-Package~31bf3856ad364e35~wow64~~10.0.26100.7019.mum Handle ID: 0x1af98 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-WMPNetworkSharingService-Opt-WOW64-Package~31bf3856ad364e35~wow64~~10.0.26100.7019.cat Handle ID: 0x1a348 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-WMPNetworkSharingService-Opt-WOW64-Package~31bf3856ad364e35~wow64~~10.0.26100.7019.mum Handle ID: 0x2d5c Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Notepad-System-FoD-Package-Wrapper~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0x74ac Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Notepad-System-FoD-Package-Wrapper~31bf3856ad364e35~amd64~~10.0.26100.7171.mum Handle ID: 0x1488 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Notepad-System-FoD-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0xebc Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Notepad-System-FoD-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.mum Handle ID: 0x1a4c8 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Notepad-System-FoD-Package-Wrapper~31bf3856ad364e35~wow64~~10.0.26100.7171.cat Handle ID: 0x548 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Notepad-System-FoD-Package-Wrapper~31bf3856ad364e35~wow64~~10.0.26100.7171.mum Handle ID: 0xccb8 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Notepad-System-FoD-Package~31bf3856ad364e35~wow64~~10.0.26100.7171.cat Handle ID: 0x19504 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Notepad-System-FoD-Package~31bf3856ad364e35~wow64~~10.0.26100.7171.mum Handle ID: 0x74ac Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-PowerShell-ISE-FOD-Package-Wrapper~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0x9224 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-PowerShell-ISE-FOD-Package-Wrapper~31bf3856ad364e35~amd64~~10.0.26100.7171.mum Handle ID: 0xebc Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-PowerShell-ISE-FOD-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0x3010 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-PowerShell-ISE-FOD-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.mum Handle ID: 0x4dc4 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-PowerShell-ISE-FOD-Package-Wrapper~31bf3856ad364e35~wow64~~10.0.26100.7171.cat Handle ID: 0xcb18 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-PowerShell-ISE-FOD-Package-Wrapper~31bf3856ad364e35~wow64~~10.0.26100.7171.mum Handle ID: 0x548 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-PowerShell-ISE-FOD-Package~31bf3856ad364e35~wow64~~10.0.26100.7171.cat Handle ID: 0x7058 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-PowerShell-ISE-FOD-Package~31bf3856ad364e35~wow64~~10.0.26100.7171.mum Handle ID: 0x19504 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Printing-PMCPPC-FoD-Package-Wrapper~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0x1670 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Printing-PMCPPC-FoD-Package-Wrapper~31bf3856ad364e35~amd64~~10.0.26100.7171.mum Handle ID: 0x3010 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Printing-PMCPPC-FoD-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0x33e0 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Printing-PMCPPC-FoD-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.mum Handle ID: 0x9f4c Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-ProjFS-OptionalFeature-FOD-Package-Wrapper~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0x6994 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-ProjFS-OptionalFeature-FOD-Package-Wrapper~31bf3856ad364e35~amd64~~10.0.26100.7171.mum Handle ID: 0x1b838 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-ProjFS-OptionalFeature-FOD-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0x6724 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-ProjFS-OptionalFeature-FOD-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.mum Handle ID: 0x6694 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-ProjFS-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x6998 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-ProjFS-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.mum Handle ID: 0x1b838 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-SenseClient-FoD-Package-Wrapper~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0x983c Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-SenseClient-FoD-Package-Wrapper~31bf3856ad364e35~amd64~~10.0.26100.7171.mum Handle ID: 0x6994 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-SenseClient-FoD-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0x70d0 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-SenseClient-FoD-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.mum Handle ID: 0xa9bc Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-SenseClient-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0xdb38 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-SenseClient-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.mum Handle ID: 0x33e0 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-SimpleTCP-FOD-Package-Wrapper~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0x7568 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-SimpleTCP-FOD-Package-Wrapper~31bf3856ad364e35~amd64~~10.0.26100.7171.mum Handle ID: 0x92f4 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-SimpleTCP-FOD-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0x7d04 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-SimpleTCP-FOD-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.mum Handle ID: 0x1d724 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-SmbDirect-FOD-Package-Wrapper~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0x1a414 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-SmbDirect-FOD-Package-Wrapper~31bf3856ad364e35~amd64~~10.0.26100.7171.mum Handle ID: 0xdb38 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-SmbDirect-FOD-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0xa0c0 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-SmbDirect-FOD-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.mum Handle ID: 0x1a348 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-StepsRecorder-Package-Wrapper~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0x18fc Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-StepsRecorder-Package-Wrapper~31bf3856ad364e35~amd64~~10.0.26100.7171.mum Handle ID: 0x1670 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-StepsRecorder-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0xca98 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-StepsRecorder-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.mum Handle ID: 0x1a414 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-StepsRecorder-Package-Wrapper~31bf3856ad364e35~wow64~~10.0.26100.7171.cat Handle ID: 0x19d94 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-StepsRecorder-Package-Wrapper~31bf3856ad364e35~wow64~~10.0.26100.7171.mum Handle ID: 0xa0c0 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-StepsRecorder-Package~31bf3856ad364e35~wow64~~10.0.26100.7171.cat Handle ID: 0x19598 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-StepsRecorder-Package~31bf3856ad364e35~wow64~~10.0.26100.7171.mum Handle ID: 0xa0c0 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-TabletPCMath-Package-Wrapper~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0x9c68 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-TabletPCMath-Package-Wrapper~31bf3856ad364e35~amd64~~10.0.26100.7171.mum Handle ID: 0xca98 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-TabletPCMath-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0x1a024 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-TabletPCMath-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.mum Handle ID: 0x19d94 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Telnet-Client-FOD-Package-Wrapper~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0x56b4 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Telnet-Client-FOD-Package-Wrapper~31bf3856ad364e35~amd64~~10.0.26100.7171.mum Handle ID: 0x19598 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Telnet-Client-FOD-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0x56ec Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Telnet-Client-FOD-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.mum Handle ID: 0x9c68 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-TFTP-Client-FOD-Package-Wrapper~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0x56b0 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-TFTP-Client-FOD-Package-Wrapper~31bf3856ad364e35~amd64~~10.0.26100.7171.mum Handle ID: 0x1a024 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-TFTP-Client-FOD-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0x56b4 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-TFTP-Client-FOD-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.mum Handle ID: 0x56b4 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-TFTP-Client-Opt-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0xa58c Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-TFTP-Client-Opt-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.mum Handle ID: 0x56ec Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-VBSCRIPT-FoD-Package-Wrapper~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0x7568 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-VBSCRIPT-FoD-Package-Wrapper~31bf3856ad364e35~amd64~~10.0.26100.7171.mum Handle ID: 0x7568 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-VBSCRIPT-FoD-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0x1b8ec Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-VBSCRIPT-FoD-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.mum Handle ID: 0x6724 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-VBSCRIPT-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0xa288 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-VBSCRIPT-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.mum Handle ID: 0x7568 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-VBSCRIPT-FoD-Package-Wrapper~31bf3856ad364e35~wow64~~10.0.26100.7171.cat Handle ID: 0xbf9c Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-VBSCRIPT-FoD-Package-Wrapper~31bf3856ad364e35~wow64~~10.0.26100.7171.mum Handle ID: 0x56ec Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-VBSCRIPT-FoD-Package~31bf3856ad364e35~wow64~~10.0.26100.7171.cat Handle ID: 0x1d90 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-VBSCRIPT-FoD-Package~31bf3856ad364e35~wow64~~10.0.26100.7171.mum Handle ID: 0x1b8ec Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-VBSCRIPT-WOW64-Package~31bf3856ad364e35~wow64~~10.0.26100.7019.cat Handle ID: 0x1d88 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-VBSCRIPT-WOW64-Package~31bf3856ad364e35~wow64~~10.0.26100.7019.mum Handle ID: 0xa288 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Wallpaper-Content-Extended-FoD-Package-Wrapper~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0x1f54 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Wallpaper-Content-Extended-FoD-Package-Wrapper~31bf3856ad364e35~amd64~~10.0.26100.7171.mum Handle ID: 0xbf9c Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Wallpaper-Content-Extended-FoD-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0x699c Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Wallpaper-Content-Extended-FoD-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.mum Handle ID: 0xa288 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Wifi-Client-Broadcom-Bcmpciedhd63-FOD-Package-Wrapper~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0x1d84 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Wifi-Client-Broadcom-Bcmpciedhd63-FOD-Package-Wrapper~31bf3856ad364e35~amd64~~10.0.26100.7171.mum Handle ID: 0x6998 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Wifi-Client-Broadcom-Bcmpciedhd63-FOD-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0xd28 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Wifi-Client-Broadcom-Bcmpciedhd63-FOD-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.mum Handle ID: 0x1d88 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Wifi-Client-Broadcom-Bcmwl63a-FOD-Package-Wrapper~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0x4964 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Wifi-Client-Broadcom-Bcmwl63a-FOD-Package-Wrapper~31bf3856ad364e35~amd64~~10.0.26100.7171.mum Handle ID: 0x1f54 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Wifi-Client-Broadcom-Bcmwl63a-FOD-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0x1f2c Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Wifi-Client-Broadcom-Bcmwl63a-FOD-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.mum Handle ID: 0x1d84 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Wifi-Client-Broadcom-Bcmwl63al-FOD-Package-Wrapper~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0x495c Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Wifi-Client-Broadcom-Bcmwl63al-FOD-Package-Wrapper~31bf3856ad364e35~amd64~~10.0.26100.7171.mum Handle ID: 0xd28 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Wifi-Client-Broadcom-Bcmwl63al-FOD-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0x19a0 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Wifi-Client-Broadcom-Bcmwl63al-FOD-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.mum Handle ID: 0x4964 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Wifi-Client-Intel-Netwbw02-FOD-Package-Wrapper~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0x19bc4 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Wifi-Client-Intel-Netwbw02-FOD-Package-Wrapper~31bf3856ad364e35~amd64~~10.0.26100.7171.mum Handle ID: 0x56b0 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Wifi-Client-Intel-Netwbw02-FOD-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0x7a8 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Wifi-Client-Intel-Netwbw02-FOD-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.mum Handle ID: 0xad88 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Wifi-Client-Intel-Netwew00-FOD-Package-Wrapper~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0xaadc Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Wifi-Client-Intel-Netwew00-FOD-Package-Wrapper~31bf3856ad364e35~amd64~~10.0.26100.7171.mum Handle ID: 0x56b0 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Wifi-Client-Intel-Netwew00-FOD-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0xd1dc Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Wifi-Client-Intel-Netwew00-FOD-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.mum Handle ID: 0x19bc4 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Wifi-Client-Intel-Netwew01-FOD-Package-Wrapper~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0x42a8 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Wifi-Client-Intel-Netwew01-FOD-Package-Wrapper~31bf3856ad364e35~amd64~~10.0.26100.7171.mum Handle ID: 0x7a8 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Wifi-Client-Intel-Netwew01-FOD-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0x1b464 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Wifi-Client-Intel-Netwew01-FOD-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.mum Handle ID: 0xaadc Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Wifi-Client-Intel-Netwlv64-FOD-Package-Wrapper~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0x1a058 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Wifi-Client-Intel-Netwlv64-FOD-Package-Wrapper~31bf3856ad364e35~amd64~~10.0.26100.7171.mum Handle ID: 0xb30c Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Wifi-Client-Intel-Netwlv64-FOD-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0xbc34 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Wifi-Client-Intel-Netwlv64-FOD-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.mum Handle ID: 0xd1dc Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Wifi-Client-Intel-Netwns64-FOD-Package-Wrapper~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0x1d8c8 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Wifi-Client-Intel-Netwns64-FOD-Package-Wrapper~31bf3856ad364e35~amd64~~10.0.26100.7171.mum Handle ID: 0x42a8 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Wifi-Client-Intel-Netwns64-FOD-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0x3488 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Wifi-Client-Intel-Netwns64-FOD-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.mum Handle ID: 0x42a8 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Wifi-Client-Intel-Netwsw00-FOD-Package-Wrapper~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0x3408 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Wifi-Client-Intel-Netwsw00-FOD-Package-Wrapper~31bf3856ad364e35~amd64~~10.0.26100.7171.mum Handle ID: 0xbc34 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Wifi-Client-Intel-Netwsw00-FOD-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0x1510 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Wifi-Client-Intel-Netwsw00-FOD-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.mum Handle ID: 0x983c Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Wifi-Client-Intel-Netwtw02-FOD-Package-Wrapper~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0xa568 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Wifi-Client-Intel-Netwtw02-FOD-Package-Wrapper~31bf3856ad364e35~amd64~~10.0.26100.7171.mum Handle ID: 0x70d0 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Wifi-Client-Intel-Netwtw02-FOD-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0x1986c Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Wifi-Client-Intel-Netwtw02-FOD-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.mum Handle ID: 0x3408 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Wifi-Client-Intel-Netwtw04-FOD-Package-Wrapper~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0x7244 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Wifi-Client-Intel-Netwtw04-FOD-Package-Wrapper~31bf3856ad364e35~amd64~~10.0.26100.7171.mum Handle ID: 0x1510 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Wifi-Client-Intel-Netwtw04-FOD-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0xa21c Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Wifi-Client-Intel-Netwtw04-FOD-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.mum Handle ID: 0xa568 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Wifi-Client-Intel-Netwtw06-FOD-Package-Wrapper~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0xa070 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Wifi-Client-Intel-Netwtw06-FOD-Package-Wrapper~31bf3856ad364e35~amd64~~10.0.26100.7171.mum Handle ID: 0x1986c Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Wifi-Client-Intel-Netwtw06-FOD-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0x1eec Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Wifi-Client-Intel-Netwtw06-FOD-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.mum Handle ID: 0x7244 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Wifi-Client-Intel-Netwtw08-FOD-Package-Wrapper~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0x4960 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Wifi-Client-Intel-Netwtw08-FOD-Package-Wrapper~31bf3856ad364e35~amd64~~10.0.26100.7171.mum Handle ID: 0x1f2c Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Wifi-Client-Intel-Netwtw08-FOD-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0x1ee0 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Wifi-Client-Intel-Netwtw08-FOD-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.mum Handle ID: 0x495c Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Wifi-Client-Intel-Netwtw10-FOD-Package-Wrapper~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0x6978 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Wifi-Client-Intel-Netwtw10-FOD-Package-Wrapper~31bf3856ad364e35~amd64~~10.0.26100.7171.mum Handle ID: 0x1eec Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Wifi-Client-Intel-Netwtw10-FOD-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0x696c Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Wifi-Client-Intel-Netwtw10-FOD-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.mum Handle ID: 0x4960 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Wifi-Client-Marvel-Mrvlpcie8897-FOD-Package-Wrapper~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0x1ab94 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Wifi-Client-Marvel-Mrvlpcie8897-FOD-Package-Wrapper~31bf3856ad364e35~amd64~~10.0.26100.7171.mum Handle ID: 0x1eec Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Wifi-Client-Marvel-Mrvlpcie8897-FOD-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0x697c Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Wifi-Client-Marvel-Mrvlpcie8897-FOD-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.mum Handle ID: 0x6978 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Wifi-Client-Qualcomm-Athw8x-FOD-Package-Wrapper~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0x1cc48 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Wifi-Client-Qualcomm-Athw8x-FOD-Package-Wrapper~31bf3856ad364e35~amd64~~10.0.26100.7171.mum Handle ID: 0x696c Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Wifi-Client-Qualcomm-Athw8x-FOD-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0x1ab84 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Wifi-Client-Qualcomm-Athw8x-FOD-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.mum Handle ID: 0x1d78c Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Wifi-Client-Qualcomm-Athwnx-FOD-Package-Wrapper~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0x1b028 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Wifi-Client-Qualcomm-Athwnx-FOD-Package-Wrapper~31bf3856ad364e35~amd64~~10.0.26100.7171.mum Handle ID: 0x1ab94 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Wifi-Client-Qualcomm-Athwnx-FOD-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0x1ab90 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Wifi-Client-Qualcomm-Athwnx-FOD-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.mum Handle ID: 0x697c Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Wifi-Client-Qualcomm-Qcamain10x64-FOD-Package-Wrapper~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0x1b020 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Wifi-Client-Qualcomm-Qcamain10x64-FOD-Package-Wrapper~31bf3856ad364e35~amd64~~10.0.26100.7171.mum Handle ID: 0x1ab84 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Wifi-Client-Qualcomm-Qcamain10x64-FOD-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0x2a38 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Wifi-Client-Qualcomm-Qcamain10x64-FOD-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.mum Handle ID: 0x1b028 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Wifi-Client-Ralink-Netr28x-FOD-Package-Wrapper~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0x1b018 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Wifi-Client-Ralink-Netr28x-FOD-Package-Wrapper~31bf3856ad364e35~amd64~~10.0.26100.7171.mum Handle ID: 0x1ab90 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Wifi-Client-Ralink-Netr28x-FOD-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0x6594 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Wifi-Client-Ralink-Netr28x-FOD-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.mum Handle ID: 0x1b020 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Wifi-Client-Realtek-Rtl8192se-FOD-Package-Wrapper~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0xe4c Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Wifi-Client-Realtek-Rtl8192se-FOD-Package-Wrapper~31bf3856ad364e35~amd64~~10.0.26100.7171.mum Handle ID: 0x699c Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Wifi-Client-Realtek-Rtl8192se-FOD-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0x1d794 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Wifi-Client-Realtek-Rtl8192se-FOD-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.mum Handle ID: 0x2a38 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Wifi-Client-Realtek-Rtwlane-FOD-Package-Wrapper~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0x33d0 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Wifi-Client-Realtek-Rtwlane-FOD-Package-Wrapper~31bf3856ad364e35~amd64~~10.0.26100.7171.mum Handle ID: 0x1cc48 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Wifi-Client-Realtek-Rtwlane-FOD-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0x43ac Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Wifi-Client-Realtek-Rtwlane-FOD-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.mum Handle ID: 0x1b018 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Wifi-Client-Realtek-Rtwlane01-FOD-Package-Wrapper~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0x54fc Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Wifi-Client-Realtek-Rtwlane01-FOD-Package-Wrapper~31bf3856ad364e35~amd64~~10.0.26100.7171.mum Handle ID: 0x1cc48 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Wifi-Client-Realtek-Rtwlane01-FOD-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0xd344 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Wifi-Client-Realtek-Rtwlane01-FOD-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.mum Handle ID: 0x33d0 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Wifi-Client-Realtek-Rtwlane13-FOD-Package-Wrapper~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0x3860 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Wifi-Client-Realtek-Rtwlane13-FOD-Package-Wrapper~31bf3856ad364e35~amd64~~10.0.26100.7171.mum Handle ID: 0x43ac Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Wifi-Client-Realtek-Rtwlane13-FOD-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0x1b680 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Wifi-Client-Realtek-Rtwlane13-FOD-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.mum Handle ID: 0x6594 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-WinOcr-FOD-Package-Wrapper~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0xd350 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-WinOcr-FOD-Package-Wrapper~31bf3856ad364e35~amd64~~10.0.26100.7171.mum Handle ID: 0x54fc Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-WinOcr-FOD-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0x1b684 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-WinOcr-FOD-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.mum Handle ID: 0xd344 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-WinOcr-FOD-Package-Wrapper~31bf3856ad364e35~wow64~~10.0.26100.7171.cat Handle ID: 0x4184 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-WinOcr-FOD-Package-Wrapper~31bf3856ad364e35~wow64~~10.0.26100.7171.mum Handle ID: 0xd344 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-WinOcr-FOD-Package~31bf3856ad364e35~wow64~~10.0.26100.7171.cat Handle ID: 0x1b688 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-WinOcr-FOD-Package~31bf3856ad364e35~wow64~~10.0.26100.7171.mum Handle ID: 0xd350 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\OpenSSH-Client-Package-Wrapper~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0x417c Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\OpenSSH-Client-Package-Wrapper~31bf3856ad364e35~amd64~~10.0.26100.7171.mum Handle ID: 0xd344 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\OpenSSH-Client-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0xa5a4 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\OpenSSH-Client-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.mum Handle ID: 0x4184 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Client-LanguagePack-Package-Wrapper~31bf3856ad364e35~amd64~en-US~10.0.26100.7171.cat Handle ID: 0x4174 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Client-LanguagePack-Package-Wrapper~31bf3856ad364e35~amd64~en-US~10.0.26100.7171.mum Handle ID: 0x1b688 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Client-LanguagePack-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.7171.cat Handle ID: 0xa59c Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Client-LanguagePack-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.7171.mum Handle ID: 0x417c Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Editions-Professional-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.7171.cat Handle ID: 0x45d4 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Editions-Professional-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.7171.mum Handle ID: 0xa5a4 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Licenses-Professional-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.7171.cat Handle ID: 0xa598 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Licenses-Professional-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.7171.mum Handle ID: 0xa5a4 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Win4-Feature~31bf3856ad364e35~amd64~en-US~10.0.26100.7171.cat Handle ID: 0x768c Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Win4-Feature~31bf3856ad364e35~amd64~en-US~10.0.26100.7171.mum Handle ID: 0xa59c Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Runlevel-Win0-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.7171.cat Handle ID: 0x9938 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Runlevel-Win0-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.7171.mum Handle ID: 0xa5a4 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-CoreSystem-BootableSKU-Drivers-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.6899.cat Handle ID: 0x7f9c Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-CoreSystem-BootableSKU-Drivers-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.6899.mum Handle ID: 0x3488 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Kernel-Package-Acpi-Pci-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.6899.cat Handle ID: 0x30b0 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Kernel-Package-Acpi-Pci-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.6899.mum Handle ID: 0x3488 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Foundation-Win0-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.7171.cat Handle ID: 0xbe0c Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Foundation-Win0-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.7171.mum Handle ID: 0x9938 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Kernel-Package-Ntdll-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.7171.cat Handle ID: 0x1da10 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Kernel-Package-Ntdll-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.7171.mum Handle ID: 0x3488 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Runlevel-Win1-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.7171.cat Handle ID: 0x1b990 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Runlevel-Win1-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.7171.mum Handle ID: 0x30b0 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Foundation-Win1-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.7171.cat Handle ID: 0x7698 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Foundation-Win1-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.7171.mum Handle ID: 0xbe0c Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Foundation-Win1-merged-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.7019.cat Handle ID: 0x3368 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Foundation-Win1-merged-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.7019.mum Handle ID: 0x1da10 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Runlevel-Win2-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.7171.cat Handle ID: 0x8d18 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Runlevel-Win2-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.7171.mum Handle ID: 0x1b990 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Runlevel-Win2-Minimal-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.7171.cat Handle ID: 0x5380 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Runlevel-Win2-Minimal-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.7171.mum Handle ID: 0x7698 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-OneCore-CoreSystem-BootableSKU-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.6899.cat Handle ID: 0x8cdc Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-OneCore-CoreSystem-BootableSKU-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.6899.mum Handle ID: 0x3368 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-OneCore-CoreSystem-Core-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.7171.cat Handle ID: 0x7e8c Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-OneCore-CoreSystem-Core-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.7171.mum Handle ID: 0x8d18 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-OneCore-CoreSystem-Core-merged-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.7019.cat Handle ID: 0x7670 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-OneCore-CoreSystem-Core-merged-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.7019.mum Handle ID: 0x5380 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-OneCore-LSA-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.6725.cat Handle ID: 0x45d8 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-OneCore-LSA-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.6725.mum Handle ID: 0x8cdc Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-OneCore-LSA-merged-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.6725.cat Handle ID: 0x9870 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-OneCore-LSA-merged-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.6725.mum Handle ID: 0x8cdc Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-OneCore-Wer-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.7019.cat Handle ID: 0xa228 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-OneCore-Wer-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.7019.mum Handle ID: 0xa598 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-ErrorReportingCore-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.7019.cat Handle ID: 0xa064 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-ErrorReportingCore-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.7019.mum Handle ID: 0xa21c Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-ErrorReportingFaults-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.7019.cat Handle ID: 0x506c Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-ErrorReportingFaults-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.7019.mum Handle ID: 0xa070 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Foundation-Group-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.7171.cat Handle ID: 0xa074 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Foundation-Group-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.7171.mum Handle ID: 0xa228 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Foundation-Group-merged-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.7019.cat Handle ID: 0x5058 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Foundation-Group-merged-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.7019.mum Handle ID: 0xa064 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Kernel-Package-System-Events-Container-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.7019.cat Handle ID: 0x458c Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Kernel-Package-System-Events-Container-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.7019.mum Handle ID: 0x506c Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Network-Foundation-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.7019.cat Handle ID: 0x4578 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Network-Foundation-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.7019.mum Handle ID: 0xa074 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Runlevel-Win3-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.7019.cat Handle ID: 0xa01c Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Runlevel-Win3-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.7019.mum Handle ID: 0x5058 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-CoreSystem-BootableSKU-Winlogon-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.6725.cat Handle ID: 0x6590 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-CoreSystem-BootableSKU-Winlogon-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.6725.mum Handle ID: 0x458c Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-CoreSystem-Security-UserMgr-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.6725.cat Handle ID: 0x9538 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-CoreSystem-Security-UserMgr-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.6725.mum Handle ID: 0x5058 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Windows-ClientCore-Win32Bridge-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.7019.cat Handle ID: 0x1bc60 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Windows-ClientCore-Win32Bridge-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.7019.mum Handle ID: 0x3860 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Runlevel-Win4-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.7171.cat Handle ID: 0x3b30 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Runlevel-Win4-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.7171.mum Handle ID: 0x6590 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Runlevel-Win4-merged-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.7019.cat Handle ID: 0x989c Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Runlevel-Win4-merged-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.7019.mum Handle ID: 0x9538 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:47 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-OneCore-DeviceRuntime-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.7019.cat Handle ID: 0x7e08 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:47 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-OneCore-DeviceRuntime-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.7019.mum Handle ID: 0x7e8c Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:47 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-OneCore-Biometrics-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.7019.cat Handle ID: 0x9538 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:47 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-OneCore-Biometrics-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.7019.mum Handle ID: 0x9538 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:47 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-OneCore-Biometrics-Fingerprint-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.6725.cat Handle ID: 0x8c90 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:47 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-OneCore-Biometrics-Fingerprint-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.6725.mum Handle ID: 0x458c Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:47 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-WindowsCoreHeadless-DeviceRuntime-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.7019.cat Handle ID: 0x7694 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:47 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-WindowsCoreHeadless-DeviceRuntime-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.7019.mum Handle ID: 0x989c Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:47 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-WindowsCoreHeadless-DeviceRuntime-removable-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.7019.cat Handle ID: 0x1b510 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:47 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-WindowsCoreHeadless-DeviceRuntime-removable-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.7019.mum Handle ID: 0x7e08 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:47 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-OneCore-SD-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.7019.cat Handle ID: 0xd644 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:47 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-OneCore-SD-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.7019.mum Handle ID: 0x8c90 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:47 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-OneCore-Connectivity-I3C-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.7019.cat Handle ID: 0x927c Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:47 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-OneCore-Connectivity-I3C-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.7019.mum Handle ID: 0x7694 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:47 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-OneCore-SecureStartup-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.7019.cat Handle ID: 0x7024 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:47 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-OneCore-SecureStartup-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.7019.mum Handle ID: 0x7694 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:47 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-OneCore-SecureStartup-Foundation-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.7019.cat Handle ID: 0x1a438 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:47 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-OneCore-SecureStartup-Foundation-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.7019.mum Handle ID: 0x7058 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:47 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-OneCore-EnterpriseNetworking-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.7019.cat Handle ID: 0x2d0c Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:47 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-OneCore-EnterpriseNetworking-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.7019.mum Handle ID: 0x927c Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:47 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-CoreSystem-DXG-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.7171.cat Handle ID: 0x7038 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:47 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-CoreSystem-DXG-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.7171.mum Handle ID: 0x1b510 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:47 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-CoreSystem-DXG-Common-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.7171.cat Handle ID: 0x1af34 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:47 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-CoreSystem-DXG-Common-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.7171.mum Handle ID: 0x7024 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:47 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-OneCore-Graphics-Required-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.7171.cat Handle ID: 0x1978 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:47 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-OneCore-Graphics-Required-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.7171.mum Handle ID: 0x1a438 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:47 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Win3-DWM-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.6725.cat Handle ID: 0x1d5e8 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:47 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Win3-DWM-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.6725.mum Handle ID: 0xd644 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:47 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-UserSessionManagement-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.6725.cat Handle ID: 0x1aa08 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:47 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-UserSessionManagement-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.6725.mum Handle ID: 0x7038 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:47 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Win4-WOW64-Feature~31bf3856ad364e35~amd64~en-US~10.0.26100.7019.cat Handle ID: 0x1d5dc Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:47 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Win4-WOW64-Feature~31bf3856ad364e35~amd64~en-US~10.0.26100.7019.mum Handle ID: 0x1af34 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:47 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Runlevel-Win0-WOW64-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.7019.cat Handle ID: 0xb6c0 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:47 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Runlevel-Win0-WOW64-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.7019.mum Handle ID: 0x1d5e8 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:47 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Foundation-Win0-WOW64-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.7019.cat Handle ID: 0x1d5d8 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:47 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Foundation-Win0-WOW64-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.7019.mum Handle ID: 0x1aa08 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:47 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Kernel-Package-Ntdll-WOW64-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.7019.cat Handle ID: 0xb6b0 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:47 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Kernel-Package-Ntdll-WOW64-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.7019.mum Handle ID: 0x1d5dc Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:47 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Runlevel-Win1-WOW64-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.7019.cat Handle ID: 0x207c Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:47 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Runlevel-Win1-WOW64-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.7019.mum Handle ID: 0xb6c0 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:47 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Foundation-Win1-WOW64-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.7019.cat Handle ID: 0xdc44 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:47 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Foundation-Win1-WOW64-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.7019.mum Handle ID: 0x1aa08 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:47 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Runlevel-Win2-WOW64-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.7019.cat Handle ID: 0xb6bc Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:47 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Runlevel-Win2-WOW64-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.7019.mum Handle ID: 0x1d5d8 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:47 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Runlevel-Win2-Minimal-WOW64-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.7019.cat Handle ID: 0x509c Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:47 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Runlevel-Win2-Minimal-WOW64-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.7019.mum Handle ID: 0xb6b0 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:47 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-OneCore-CoreSystem-Core-WOW64-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.7019.cat Handle ID: 0x8cd0 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:47 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-OneCore-CoreSystem-Core-WOW64-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.7019.mum Handle ID: 0x50a8 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:47 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Foundation-Group-WOW64-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.7019.cat Handle ID: 0x7ea4 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:47 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Foundation-Group-WOW64-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.7019.mum Handle ID: 0xb6b0 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:47 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Client-Features-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.7019.cat Handle ID: 0x35fc Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:47 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Client-Features-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.7019.mum Handle ID: 0xdc44 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:47 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Client-Features-Package01~31bf3856ad364e35~amd64~en-US~10.0.26100.7019.cat Handle ID: 0x5d8 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:47 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Client-Features-Package01~31bf3856ad364e35~amd64~en-US~10.0.26100.7019.mum Handle ID: 0xb6bc Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:47 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Client-Features-Package0110~31bf3856ad364e35~amd64~en-US~10.0.26100.7019.cat Handle ID: 0x17a8 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:47 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Client-Features-Package0110~31bf3856ad364e35~amd64~en-US~10.0.26100.7019.mum Handle ID: 0x7ea4 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:47 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Client-Features-Package0111~31bf3856ad364e35~amd64~en-US~10.0.26100.7019.cat Handle ID: 0x50e8 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:47 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Client-Features-Package0111~31bf3856ad364e35~amd64~en-US~10.0.26100.7019.mum Handle ID: 0x207c Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:47 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Kernel-Package-Kernel-Power-Events-Container-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.7019.cat Handle ID: 0x1c9d8 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:47 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Kernel-Package-Kernel-Power-Events-Container-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.7019.mum Handle ID: 0x8cd0 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:47 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~en-US~10.0.26100.7019.cat Handle ID: 0xa010 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:47 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~en-US~10.0.26100.7019.mum Handle ID: 0x17a8 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:47 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Client-Features-WOW64-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.7019.cat Handle ID: 0x1ab88 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:47 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Client-Features-WOW64-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.7019.mum Handle ID: 0x4578 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:47 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Client-Optional-Features-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.7019.cat Handle ID: 0x1ab80 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:47 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Client-Optional-Features-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.7019.mum Handle ID: 0xa01c Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:47 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Lxss-Optional-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.7019.cat Handle ID: 0xbc0 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:47 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Lxss-Optional-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.7019.mum Handle ID: 0x4578 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:47 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Lxss-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.7019.cat Handle ID: 0x1ab7c Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:47 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Lxss-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.7019.mum Handle ID: 0x1ab88 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\HyperV-Networking-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.7019.cat Handle ID: 0x834 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\HyperV-Networking-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.7019.mum Handle ID: 0x1ab80 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\HyperV-Networking-merged-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.7019.cat Handle ID: 0x1b590 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\HyperV-Networking-merged-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.7019.mum Handle ID: 0xbc0 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-NetFx3-OC-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.7171.cat Handle ID: 0xbb4 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-NetFx3-OC-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.7171.mum Handle ID: 0x1ab7c Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-NetFx3-OnDemand-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.7171.cat Handle ID: 0x1b588 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-NetFx3-OnDemand-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.7171.mum Handle ID: 0x834 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-SecureStartup-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.7019.cat Handle ID: 0x1b5b0 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-SecureStartup-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.7019.mum Handle ID: 0x1b590 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.7019.cat Handle ID: 0x1b594 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.7019.mum Handle ID: 0xbb4 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Help-ClientUA-Client-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.7019.cat Handle ID: 0x1b578 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Help-ClientUA-Client-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.7019.mum Handle ID: 0x1b588 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Help-ClientOOBE-Feature-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.7019.cat Handle ID: 0x96b8 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Help-ClientOOBE-Feature-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.7019.mum Handle ID: 0xbb4 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-GroupPolicy-ClientTools-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.7171.cat Handle ID: 0x1b5a0 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-GroupPolicy-ClientTools-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.7171.mum Handle ID: 0x1b594 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-GroupPolicy-ClientTools-merged-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.7171.cat Handle ID: 0x19b18 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-GroupPolicy-ClientTools-merged-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.7171.mum Handle ID: 0x1b578 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Hyper-V-ClientEdition-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.7019.cat Handle ID: 0xbd08 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Hyper-V-ClientEdition-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.7019.mum Handle ID: 0x96b8 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Hyper-V-Services-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.7019.cat Handle ID: 0x6fd8 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Hyper-V-Services-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.7019.mum Handle ID: 0x35fc Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Hyper-V-Offline-Common-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.7019.cat Handle ID: 0x99dc Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Hyper-V-Offline-Common-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.7019.mum Handle ID: 0x1b5b0 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Hyper-V-Offline-Core-Group-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.7019.cat Handle ID: 0x1a7b8 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Hyper-V-Offline-Core-Group-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.7019.mum Handle ID: 0x19b18 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\HyperV-Networking-Containers-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.7019.cat Handle ID: 0xc24 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\HyperV-Networking-Containers-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.7019.mum Handle ID: 0x45d8 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\HyperV-Networking-Containers-Server-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.7019.cat Handle ID: 0x9ed8 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\HyperV-Networking-Containers-Server-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.7019.mum Handle ID: 0x45d8 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-HVSI-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.7019.cat Handle ID: 0x1d8a4 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-HVSI-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.7019.mum Handle ID: 0x9870 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Containers-ApplicationGuard-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.7019.cat Handle ID: 0x9cd4 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Containers-ApplicationGuard-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.7019.mum Handle ID: 0x1c9d8 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Containers-Client-Manager-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.7019.cat Handle ID: 0xc24 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Containers-Client-Manager-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.7019.mum Handle ID: 0xc24 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Containers-Client-Shared-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.7019.cat Handle ID: 0x9ed4 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Containers-Client-Shared-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.7019.mum Handle ID: 0x1d8a4 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-UtilityVM-Containers-Shared-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.7019.cat Handle ID: 0xbac8 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-UtilityVM-Containers-Shared-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.7019.mum Handle ID: 0x1a7b8 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-OneCore-EventLog-Api-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.7019.cat Handle ID: 0x6810 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-OneCore-EventLog-Api-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.7019.mum Handle ID: 0x6fd8 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-CoreSystem-DISM-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.7019.cat Handle ID: 0x15a8 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-CoreSystem-DISM-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.7019.mum Handle ID: 0x9cd4 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\HyperV-Feature-ApplicationGuard-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.7019.cat Handle ID: 0x158c Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\HyperV-Feature-ApplicationGuard-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.7019.mum Handle ID: 0x99dc Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-OneCore-Containers-Client-Manager-Shared-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.7019.cat Handle ID: 0x160c Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-OneCore-Containers-Client-Manager-Shared-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.7019.mum Handle ID: 0xbac8 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\HyperV-Feature-Containers-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.7019.cat Handle ID: 0x159c Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\HyperV-Feature-Containers-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.7019.mum Handle ID: 0xbac8 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Container-Professional-Payload-Wrapper-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.7019.cat Handle ID: 0x1600 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Container-Professional-Payload-Wrapper-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.7019.mum Handle ID: 0x158c Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Containers-Client-Guest-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.7019.cat Handle ID: 0x96c0 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Containers-Client-Guest-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.7019.mum Handle ID: 0x160c Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-UtilityVM-Containers-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.7019.cat Handle ID: 0x1604 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-UtilityVM-Containers-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.7019.mum Handle ID: 0x160c Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Containers-Guest-Gated-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.7019.cat Handle ID: 0xb994 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Containers-Guest-Gated-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.7019.mum Handle ID: 0x1600 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Management-SecureAssessment-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.7019.cat Handle ID: 0xab0 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Management-SecureAssessment-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.7019.mum Handle ID: 0x96c0 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-EditionPack-Professional-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.7171.cat Handle ID: 0xd0f4 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-EditionPack-Professional-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.7171.mum Handle ID: 0x1600 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-All-Client-Ge-Consolidated-Version-EKB-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.6725.cat Handle ID: 0x10e4 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-All-Client-Ge-Consolidated-Version-EKB-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.6725.mum Handle ID: 0xb994 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\DesktopEditions-Layer-Data-VersionInfo-Dynamic-26220-EKB-Wrapper-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.6725.cat Handle ID: 0x197d4 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\DesktopEditions-Layer-Data-VersionInfo-Dynamic-26220-EKB-Wrapper-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.6725.mum Handle ID: 0xab0 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-DesktopEditions-Layer-Data-VersionInfo-Dynamic-Ge-26220-Version-EKB-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.6725.cat Handle ID: 0x19430 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-DesktopEditions-Layer-Data-VersionInfo-Dynamic-Ge-26220-Version-EKB-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.6725.mum Handle ID: 0xb994 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Product-Data-Ge-26220-Version-EKB-Wrapper-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.6725.cat Handle ID: 0xce7c Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Product-Data-Ge-26220-Version-EKB-Wrapper-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.6725.mum Handle ID: 0x10e4 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Product-Data-Ge-26220-Version-EKB-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.6725.cat Handle ID: 0x1954c Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Product-Data-Ge-26220-Version-EKB-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.6725.mum Handle ID: 0x197d4 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-UpdateTargeting-ClientOS-Ge-26220-Version-EKB-Wrapper-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.6725.cat Handle ID: 0x9a8c Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-UpdateTargeting-ClientOS-Ge-26220-Version-EKB-Wrapper-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.6725.mum Handle ID: 0x19430 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-UpdateTargeting-ClientOS-Ge-26220-Version-EKB-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.6725.cat Handle ID: 0xcf14 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-UpdateTargeting-ClientOS-Ge-26220-Version-EKB-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.6725.mum Handle ID: 0xab0 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Containers-OptionalFeatures-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.7019.cat Handle ID: 0xce74 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Containers-OptionalFeatures-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.7019.mum Handle ID: 0x1954c Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Containers-DisposableClientVM-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.7019.cat Handle ID: 0xc580 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Containers-DisposableClientVM-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.7019.mum Handle ID: 0x9a8c Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-OneCore-Containers-Client-Opt-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.7019.cat Handle ID: 0x1d4d0 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-OneCore-Containers-Client-Opt-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.7019.mum Handle ID: 0xcf14 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Containers-Server-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.7019.cat Handle ID: 0x584c Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Containers-Server-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.7019.mum Handle ID: 0xc90 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-EditionSpecific-Professional-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.7171.cat Handle ID: 0x5ba4 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-EditionSpecific-Professional-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.7171.mum Handle ID: 0x6810 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Licenses-IoTEnterprise-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.7171.cat Handle ID: 0x4af0 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Licenses-IoTEnterprise-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.7171.mum Handle ID: 0x1d4d0 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Licenses-IoTEnterpriseK-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.7171.cat Handle ID: 0x9edc Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Licenses-IoTEnterpriseK-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.7171.mum Handle ID: 0x9ed8 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Client-Desktop-Required-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.7171.cat Handle ID: 0x4adc Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Client-Desktop-Required-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.7171.mum Handle ID: 0x9ed4 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Client-Desktop-Required-Package00~31bf3856ad364e35~amd64~en-US~10.0.26100.7171.cat Handle ID: 0xb3a8 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Client-Desktop-Required-Package00~31bf3856ad364e35~amd64~en-US~10.0.26100.7171.mum Handle ID: 0x4af0 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Client-Desktop-Required-Package0010~31bf3856ad364e35~amd64~en-US~10.0.26100.7019.cat Handle ID: 0xbb44 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Client-Desktop-Required-Package0010~31bf3856ad364e35~amd64~en-US~10.0.26100.7019.mum Handle ID: 0x5d8 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Client-Desktop-Required-Package0011~31bf3856ad364e35~amd64~en-US~10.0.26100.7171.cat Handle ID: 0xe1d0 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Client-Desktop-Required-Package0011~31bf3856ad364e35~amd64~en-US~10.0.26100.7171.mum Handle ID: 0x1bc60 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Client-Desktop-Required-Package001120~31bf3856ad364e35~amd64~en-US~10.0.26100.7171.cat Handle ID: 0xd86c Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Client-Desktop-Required-Package001120~31bf3856ad364e35~amd64~en-US~10.0.26100.7171.mum Handle ID: 0x3b30 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Client-Desktop-Required-Package01~31bf3856ad364e35~amd64~en-US~10.0.26100.7171.cat Handle ID: 0x8680 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Client-Desktop-Required-Package01~31bf3856ad364e35~amd64~en-US~10.0.26100.7171.mum Handle ID: 0xbb44 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Client-Desktop-Required-Package0110~31bf3856ad364e35~amd64~en-US~10.0.26100.7019.cat Handle ID: 0xccc Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Client-Desktop-Required-Package0110~31bf3856ad364e35~amd64~en-US~10.0.26100.7019.mum Handle ID: 0x584c Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Client-Desktop-Required-Package0111~31bf3856ad364e35~amd64~en-US~10.0.26100.7171.cat Handle ID: 0x600c Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Client-Desktop-Required-Package0111~31bf3856ad364e35~amd64~en-US~10.0.26100.7171.mum Handle ID: 0x5ba4 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Client-Desktop-Required-Package0112~31bf3856ad364e35~amd64~en-US~10.0.26100.7171.cat Handle ID: 0x8a48 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Client-Desktop-Required-Package0112~31bf3856ad364e35~amd64~en-US~10.0.26100.7171.mum Handle ID: 0x8680 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Client-Desktop-Required-Package011221~31bf3856ad364e35~amd64~en-US~10.0.26100.7019.cat Handle ID: 0xd260 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Client-Desktop-Required-Package011221~31bf3856ad364e35~amd64~en-US~10.0.26100.7019.mum Handle ID: 0xccc Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Client-Desktop-Required-Package0113~31bf3856ad364e35~amd64~en-US~10.0.26100.7171.cat Handle ID: 0x896c Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Client-Desktop-Required-Package0113~31bf3856ad364e35~amd64~en-US~10.0.26100.7171.mum Handle ID: 0x600c Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Client-Desktop-Required-Package011320~31bf3856ad364e35~amd64~en-US~10.0.26100.7019.cat Handle ID: 0x1a410 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Client-Desktop-Required-Package011320~31bf3856ad364e35~amd64~en-US~10.0.26100.7019.mum Handle ID: 0x8a48 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Client-Desktop-Required-Package0114~31bf3856ad364e35~amd64~en-US~10.0.26100.7171.cat Handle ID: 0x1c4e4 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Client-Desktop-Required-Package0114~31bf3856ad364e35~amd64~en-US~10.0.26100.7171.mum Handle ID: 0xd260 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.7019.cat Handle ID: 0x1b8a8 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.7019.mum Handle ID: 0xe1d0 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Client-Desktop-Required-WOW64-Package00~31bf3856ad364e35~amd64~en-US~10.0.26100.7019.cat Handle ID: 0xd86c Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Client-Desktop-Required-WOW64-Package00~31bf3856ad364e35~amd64~en-US~10.0.26100.7019.mum Handle ID: 0xd86c Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Enterprise-Desktop-Shared-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.7171.cat Handle ID: 0x1c9e0 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Enterprise-Desktop-Shared-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.7171.mum Handle ID: 0x1c4e4 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-InternetExplorer-Optional-Package-Wrapper~31bf3856ad364e35~amd64~en-US~11.0.26100.7171.cat Handle ID: 0x5c84 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-InternetExplorer-Optional-Package-Wrapper~31bf3856ad364e35~amd64~en-US~11.0.26100.7171.mum Handle ID: 0x1c4e4 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-InternetExplorer-Optional-Package~31bf3856ad364e35~amd64~en-US~11.0.26100.7171.cat Handle ID: 0x5ec0 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-InternetExplorer-Optional-Package~31bf3856ad364e35~amd64~en-US~11.0.26100.7171.mum Handle ID: 0xd86c Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-MediaPlayer-Package-Wrapper~31bf3856ad364e35~amd64~en-US~10.0.26100.7171.cat Handle ID: 0x1a38 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-MediaPlayer-Package-Wrapper~31bf3856ad364e35~amd64~en-US~10.0.26100.7171.mum Handle ID: 0x1c9e0 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-MediaPlayer-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.7171.cat Handle ID: 0xaaa0 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-MediaPlayer-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.7171.mum Handle ID: 0x5c84 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-NetFx3-OnDemand-Package-Wrapper~31bf3856ad364e35~amd64~en-US~10.0.26100.7171.cat Handle ID: 0x1a540 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-NetFx3-OnDemand-Package-Wrapper~31bf3856ad364e35~amd64~en-US~10.0.26100.7171.mum Handle ID: 0x5ec0 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Notepad-System-FoD-Package-Wrapper~31bf3856ad364e35~amd64~en-US~10.0.26100.7171.cat Handle ID: 0x8d10 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Notepad-System-FoD-Package-Wrapper~31bf3856ad364e35~amd64~en-US~10.0.26100.7171.mum Handle ID: 0x5c84 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Notepad-System-FoD-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.7171.cat Handle ID: 0xdd1c Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Notepad-System-FoD-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.7171.mum Handle ID: 0xce74 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-PowerShell-ISE-FOD-Package-Wrapper~31bf3856ad364e35~amd64~en-US~10.0.26100.7171.cat Handle ID: 0x8830 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-PowerShell-ISE-FOD-Package-Wrapper~31bf3856ad364e35~amd64~en-US~10.0.26100.7171.mum Handle ID: 0xaaa0 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-PowerShell-ISE-FOD-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.7171.cat Handle ID: 0xc130 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-PowerShell-ISE-FOD-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.7171.mum Handle ID: 0xc580 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Printing-PMCPPC-FoD-Package-Wrapper~31bf3856ad364e35~amd64~en-US~10.0.26100.7171.cat Handle ID: 0x4840 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Printing-PMCPPC-FoD-Package-Wrapper~31bf3856ad364e35~amd64~en-US~10.0.26100.7171.mum Handle ID: 0x1a540 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Printing-PMCPPC-FoD-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.7171.cat Handle ID: 0xc824 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Printing-PMCPPC-FoD-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.7171.mum Handle ID: 0xdd1c Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-ProjFS-OptionalFeature-FOD-Package-Wrapper~31bf3856ad364e35~amd64~en-US~10.0.26100.7171.cat Handle ID: 0x84e0 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-ProjFS-OptionalFeature-FOD-Package-Wrapper~31bf3856ad364e35~amd64~en-US~10.0.26100.7171.mum Handle ID: 0x8d10 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-ProjFS-OptionalFeature-FOD-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.7171.cat Handle ID: 0x688 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-ProjFS-OptionalFeature-FOD-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.7171.mum Handle ID: 0x8830 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-SenseClient-FoD-Package-Wrapper~31bf3856ad364e35~amd64~en-US~10.0.26100.7171.cat Handle ID: 0x197cc Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-SenseClient-FoD-Package-Wrapper~31bf3856ad364e35~amd64~en-US~10.0.26100.7171.mum Handle ID: 0xc824 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-SenseClient-FoD-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.7171.cat Handle ID: 0xc730 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-SenseClient-FoD-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.7171.mum Handle ID: 0x84e0 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-SenseClient-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.7019.cat Handle ID: 0xd0c4 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-SenseClient-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.7019.mum Handle ID: 0x688 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-StepsRecorder-Package-Wrapper~31bf3856ad364e35~amd64~en-US~10.0.26100.7171.cat Handle ID: 0x87e0 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-StepsRecorder-Package-Wrapper~31bf3856ad364e35~amd64~en-US~10.0.26100.7171.mum Handle ID: 0x197cc Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-StepsRecorder-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.7171.cat Handle ID: 0x87dc Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-StepsRecorder-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.7171.mum Handle ID: 0xc730 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Telnet-Client-FOD-Package-Wrapper~31bf3856ad364e35~amd64~en-US~10.0.26100.7171.cat Handle ID: 0x19844 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Telnet-Client-FOD-Package-Wrapper~31bf3856ad364e35~amd64~en-US~10.0.26100.7171.mum Handle ID: 0xc730 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Telnet-Client-FOD-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.7171.cat Handle ID: 0x19848 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Telnet-Client-FOD-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.7171.mum Handle ID: 0x87e0 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-TFTP-Client-FOD-Package-Wrapper~31bf3856ad364e35~amd64~en-US~10.0.26100.7171.cat Handle ID: 0x19850 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-TFTP-Client-FOD-Package-Wrapper~31bf3856ad364e35~amd64~en-US~10.0.26100.7171.mum Handle ID: 0x87dc Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-TFTP-Client-FOD-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.7171.cat Handle ID: 0x19840 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-TFTP-Client-FOD-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.7171.mum Handle ID: 0x19844 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-VBSCRIPT-FoD-Package-Wrapper~31bf3856ad364e35~amd64~en-US~10.0.26100.7171.cat Handle ID: 0x9b88 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-VBSCRIPT-FoD-Package-Wrapper~31bf3856ad364e35~amd64~en-US~10.0.26100.7171.mum Handle ID: 0x19848 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-VBSCRIPT-FoD-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.7171.cat Handle ID: 0x9b7c Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-VBSCRIPT-FoD-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.7171.mum Handle ID: 0x19844 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-WinOcr-FOD-Package-Wrapper~31bf3856ad364e35~amd64~en-US~10.0.26100.7171.cat Handle ID: 0x19420 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-WinOcr-FOD-Package-Wrapper~31bf3856ad364e35~amd64~en-US~10.0.26100.7171.mum Handle ID: 0x19840 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-WinOcr-FOD-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.7171.cat Handle ID: 0x19418 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-WinOcr-FOD-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.7171.mum Handle ID: 0x9b88 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Package_for_KB5054156~31bf3856ad364e35~amd64~~26100.6717.1.4.cat Handle ID: 0x8500 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Package_for_KB5054156~31bf3856ad364e35~amd64~~26100.6717.1.4.mum Handle ID: 0x9b7c Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Ge-Client-Server-26200-Version-Enablement-Package~31bf3856ad364e35~amd64~~10.0.26100.6717.cat Handle ID: 0x8508 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Ge-Client-Server-26200-Version-Enablement-Package~31bf3856ad364e35~amd64~~10.0.26100.6717.mum Handle ID: 0x9b88 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Ge-Client-Server-26200-Version-Enablement-Payload-Package~31bf3856ad364e35~amd64~~10.0.26100.6717.cat Handle ID: 0xd058 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:34:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Ge-Client-Server-26200-Version-Enablement-Payload-Package~31bf3856ad364e35~amd64~~10.0.26100.6717.mum Handle ID: 0x19418 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:ARAI(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 12544 | 2025-11-29 09:35:47 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4d4 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12548 | 2025-11-29 09:35:47 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12544 | 2025-11-29 09:35:48 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4d4 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-29 09:35:48 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4d4 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12548 | 2025-11-29 09:35:48 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-29 09:35:48 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12290 | 2025-11-29 09:35:49 | | Microsoft-Windows-Security-Auditing | 5061: Cryptographic operation. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Cryptographic Parameters: Provider Name: Microsoft Software Key Storage Provider Algorithm Name: RSA Key Name: f8df15d9-56fa-0cb3-682b-838ed74af121 Key Type: %%2500 Cryptographic Operation: Operation: %%2480 Return Code: 0x0
|
| | Security | Audit Success | 12292 | 2025-11-29 09:35:49 | | Microsoft-Windows-Security-Auditing | 5058: Key file operation. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Process Information: Process ID: 1188 Process Creation Time: 2025-11-29T17:35:49.0893601Z Cryptographic Parameters: Provider Name: Microsoft Software Key Storage Provider Algorithm Name: UNKNOWN Key Name: f8df15d9-56fa-0cb3-682b-838ed74af121 Key Type: %%2500 Key File Operation Information: File Path: C:\ProgramData\Microsoft\Crypto\SystemKeys\8bb43a3e92c2eb4c420c9abd6e278936_9ee7012e-fa60-42be-b8b4-8dc8b4e1280d Operation: %%2458 Return Code: 0x0
|
| | Security | Audit Success | 13824 | 2025-11-29 09:35:49 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 09:35:49 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 09:35:49 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 09:35:49 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x602c2 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 09:35:49 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x602c2 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 09:35:49 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x602c2 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 09:35:49 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x602c2 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 09:35:49 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x602c2 Read Operation: %%8099 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 09:35:49 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x602c2 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 09:35:49 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x602c2 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 12290 | 2025-11-29 09:35:50 | | Microsoft-Windows-Security-Auditing | 5061: Cryptographic operation. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Cryptographic Parameters: Provider Name: Microsoft Software Key Storage Provider Algorithm Name: RSA Key Name: f8df15d9-56fa-0cb3-682b-838ed74af121 Key Type: %%2500 Cryptographic Operation: Operation: %%2480 Return Code: 0x0
|
| | Security | Audit Success | 12292 | 2025-11-29 09:35:50 | | Microsoft-Windows-Security-Auditing | 5058: Key file operation. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Process Information: Process ID: 1188 Process Creation Time: 2025-11-29T17:35:49.0893601Z Cryptographic Parameters: Provider Name: Microsoft Software Key Storage Provider Algorithm Name: UNKNOWN Key Name: f8df15d9-56fa-0cb3-682b-838ed74af121 Key Type: %%2500 Key File Operation Information: File Path: C:\ProgramData\Microsoft\Crypto\SystemKeys\8bb43a3e92c2eb4c420c9abd6e278936_9ee7012e-fa60-42be-b8b4-8dc8b4e1280d Operation: %%2458 Return Code: 0x0
|
| | Security | Audit Success | 13824 | 2025-11-29 09:35:50 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x6033c Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 09:35:50 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x6033c Read Operation: %%8099 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 09:35:50 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x6033c Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 09:35:50 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x6033c Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 12544 | 2025-11-29 09:36:35 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4d4 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12548 | 2025-11-29 09:36:35 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 13826 | 2025-11-29 09:36:40 | | Microsoft-Windows-Security-Auditing | 4799: A security-enabled local group membership was enumerated. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Group: Security ID: S-1-5-32-544 Group Name: Administrators Group Domain: Builtin Process Information: Process ID: 0x3a1c Process Name: C:\Windows\System32\svchost.exe
|
| | Security | Audit Success | 13826 | 2025-11-29 09:36:40 | | Microsoft-Windows-Security-Auditing | 4799: A security-enabled local group membership was enumerated. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Group: Security ID: S-1-5-32-551 Group Name: Backup Operators Group Domain: Builtin Process Information: Process ID: 0x3a1c Process Name: C:\Windows\System32\svchost.exe
|
| | Security | Audit Success | 13568 | 2025-11-29 09:38:06 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Client-License-Platform-Device-Licensing-Service-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0x964c Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:38:06 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Client-License-Platform-Upgrade-Subscription-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x1a3d4 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:38:06 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-OSClient-Layer-Data-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0x964c Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:38:07 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Editions-Professional-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0x1a3d4 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:38:07 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Licenses-Professional-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0x964c Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:38:07 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Licenses-IoTEnterprise-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0x1a3d4 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:38:07 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Licenses-IoTEnterpriseK-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0x964c Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:38:07 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Management-SecureAssessment-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0x1a3d4 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:38:07 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Security-SPP-Component-SKU-Enterprise-License-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x964c Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:38:07 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Security-SPP-Component-SKU-Enterprise-Default-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x1a3d4 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:38:07 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Security-SPP-Component-SKU-Education-License-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x964c Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:38:07 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Security-SPP-Component-SKU-ProfessionalCountrySpecific-License-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x1a3d4 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:38:07 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Security-SPP-Component-SKU-ProfessionalEducation-License-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x964c Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:38:07 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Security-SPP-Component-SKU-ProfessionalSingleLanguage-License-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x1a3d4 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:38:07 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Security-SPP-Component-SKU-ProfessionalWorkstation-License-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x964c Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:38:07 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Security-SPP-Component-SKU-Professional-License-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x1a3d4 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:38:07 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Security-SPP-Component-SKU-IoTEnterprise-License-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x964c Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:38:07 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Security-SPP-Component-SKU-IoTEnterpriseK-License-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x1d340 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:38:07 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Security-SPP-Component-SKU-ServerRdsh-License-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x964c Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:38:07 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Security-SPP-Component-SKU-CloudEdition-License-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x1a3d4 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:38:07 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-SenseClient-Task-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x964c Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:38:07 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\UserExperience-Desktop-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0x1a3d4 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:38:07 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Client-Desktop-Required-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0x964c Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:38:07 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-User-Choice-Protection-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0xc8c0 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:38:07 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Client-Desktop-Required-Package00~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x764 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:38:07 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Client-Desktop-Required-Package01~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0xc8c0 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:38:07 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-PEAuth-OneCore-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0xc148 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:38:07 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Client-Desktop-Required-Package0110~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x9c0c Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:38:07 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Client-Desktop-Required-Package0111~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0x1bba4 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:38:09 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Client-Desktop-Required-Package011120~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0x7ba8 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:38:11 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Kernel-Package-Acpi-Pci-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x7ba8 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:38:11 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Kernel-Package-Processor-Drivers-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x7ba8 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:38:11 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Client-Desktop-Required-Package01112030~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0xc5e8 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:38:11 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Kernel-Package-PDC-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x2ae0 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:38:11 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Client-Desktop-Required-Package0112~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0x7d88 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:38:11 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Client-Desktop-Required-Package02~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0x2ae0 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:38:11 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Client-Desktop-Required-Package03~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0x1a41c Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:38:11 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Client-Desktop-Required-Package04~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x2ae0 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:38:11 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Client-Desktop-Required-Package05~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0x7d88 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:38:11 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-OneCore-SystemSettings-Devices-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x2ae0 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:38:11 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-OneCore-SystemSettings-NetworkMobileHandlers-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x7d88 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:38:11 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-UI-Shell-WindowTabManager-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x2ae0 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:38:11 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Client-Desktop-Required-Package0510~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0x7d88 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:38:12 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Client-Desktop-Required-Package0511~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0x2ae0 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:38:12 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-OneCore-RemoteDesktopServices-Collaboration-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x6b5c Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:38:12 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-OneCore-Graphics-Required-Core-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0xbe90 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:38:12 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Client-Desktop-Required-Package051120~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x1d804 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:38:12 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Client-Desktop-Required-Package051121~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0x70bc Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:38:12 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Client-Desktop-Required-Package05112130~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0xc158 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:38:12 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Client-Desktop-Required-Package0512~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0x338 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:38:12 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-OneCore-Connectivity-UsbConnectorManager-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x6b5c Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:38:12 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-OneCore-SD-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0xbe90 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:38:12 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Kernel-Package-DriverVerifier-Tools-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x6b50 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:38:12 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Client-Desktop-Required-Package0513~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0x6bd8 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:38:12 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Client-Desktop-Required-Package0514~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0x6b4c Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:38:12 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Client-Desktop-Required-Package0515~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0x42cc Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:38:12 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Client-Desktop-Required-Package0516~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0x6ae8 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:38:13 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Client-Desktop-Required-Package0517~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0x7600 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:38:13 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Kernel-Package-BootEnvironment-OS-Loader-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0xc5e0 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:38:13 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Kernel-Package-BootEnvironment-OS-Resume-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x7600 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:38:13 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Kernel-Package-CodeIntegrity-DriverPolicy-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0xc5e0 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:38:13 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Kernel-Package-CrashDump-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x7600 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:38:13 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Client-Desktop-Required-Package051720~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0xc5e0 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:38:13 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Client-Desktop-Required-Package0518~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0x7600 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:38:13 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Client-Desktop-Required-Package0519~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0x19474 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:38:13 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Client-Desktop-Required-Package051920~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0xbe90 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:38:13 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Kernel-Package-OS-Kernel-HAL-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0x1d4ac Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:38:13 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Client-Desktop-Required-Package05110~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0xbe90 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:38:13 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Client-Desktop-Required-Package05111~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0xc158 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:38:13 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Client-Desktop-Required-Package05112~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0x9c0c Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:38:13 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0x338 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:38:13 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\WindowsSearchEngineSKU-Group-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x7600 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:38:13 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-SearchEngine-Client-Package-shell-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x338 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:38:13 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Client-Desktop-Required-Package05114~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0x7600 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:38:13 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Kernel-Package-GlobMerger-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x338 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:38:13 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Client-Desktop-Required-Package0511420~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x7600 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:38:13 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0x338 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:38:13 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Kernel-Package-Ntdll-WOW64-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0x5390 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:38:13 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Client-Desktop-Required-WOW64-Package00~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0x338 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:38:13 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0010~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0x5390 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:38:13 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0011~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0x338 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:38:13 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0012~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0x5390 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:38:13 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0013~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x338 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:38:13 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0x5390 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:38:13 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0015~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0x338 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:38:13 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Runlevel-Win0-merged-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0x5390 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:38:13 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-OneCore-Common-DriverClasses-Core-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x7240 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:38:14 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-OneCore-ETW-Rundown-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x1d804 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:38:14 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-CoreSystem-BootableSKU-Drivers-merged-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0x42cc Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:38:14 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Foundation-Win0-merged-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0x7240 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:38:14 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Kernel-Package-DebuggerTransport-Win0-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x338 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:38:14 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Kernel-Package-Ntdll-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x7240 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:38:14 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Kernel-Package-CNG-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x338 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:38:14 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Kernel-Package-CodeIntegrity-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0x7240 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:38:14 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Kernel-Package-Cryptography-SymCrypt-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x338 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:38:14 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Runlevel-Win1-merged-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x7240 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:38:14 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-OneCore-Console-Host-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x338 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:38:14 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Foundation-Win1-merged-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0x7240 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:38:14 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-OneCore-TroubleShooting-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x338 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:38:14 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-CoreSystem-GenericDrivers-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x7240 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:38:14 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-NetAdapterCx-UMDF-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x1d4ac Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:38:14 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Platformrecords-PlutonFirmware-Package~31bf3856ad364e35~amd64~~10.0.26100.6899.cat Handle ID: 0x1d4ac Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:38:14 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-OneCore-CoreSystem-BootableSKU-merged-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0x3794 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:38:14 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-OneCore-TraceDataHelper-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x1d4ac Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:38:14 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-OneCore-CoreSystem-Core-merged-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0x3794 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:38:14 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Basic-Http-Minio-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x19474 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:38:14 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-OneCore-LSA-merged-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0x6350 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:38:14 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-OneCore-Pnp-Core-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0xf78 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:38:14 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-OneCore-Wer-merged-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x6350 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:38:14 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-OneCore-DebugCore-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x7ba8 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:38:14 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-ErrorReportingCore-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x6350 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:38:14 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-ErrorReportingFaults-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x7ba8 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:38:14 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-CoreSystem-UnifiedBPM-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x6350 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:38:14 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Foundation-Group-merged-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0xa380 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:38:14 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Kernel-Package-DriverVerifier-Xdv-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x19474 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:38:14 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Kernel-Package-System-Events-Container-Package~31bf3856ad364e35~amd64~~10.0.26100.6725.cat Handle ID: 0xa380 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:38:14 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Network-Foundation-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x77d8 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:38:14 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-CoreSystem-UMDF-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x1c344 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:38:14 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Runlevel-Win3-merged-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x7ba8 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:38:14 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-OneCore-FileSystem-Support-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x6b5c Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:38:14 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-OneCore-Graphics-BasicDrivers-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x7ba8 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:38:14 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-CoreSystem-BootableSKU-Winlogon-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0x5390 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:38:14 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-CoreSystem-CredSSP-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x26b8 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:38:14 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-CoreSystem-Security-UserMgr-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0x5390 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:38:14 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-CoreSystem-WINNLS-Core-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x26b8 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:38:14 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-CoreSystem-WinTrust-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x5390 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:38:14 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Gdi32Full-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x26b8 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:38:14 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Windows-ClientCore-Shutdown-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0xc148 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:38:14 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Windows-ClientCore-Win32Bridge-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x26b8 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:38:14 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Runlevel-Win4-merged-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0xc158 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:38:14 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Client-License-Platform-CSP-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x1b010 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:38:14 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-OneCore-Biometrics-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0xc158 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:38:14 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-OneCore-Biometrics-Fingerprint-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x7a74 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:38:14 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-OneCore-Graphics-IndirectDisplays-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0xc158 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:38:14 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-OneCore-Miracast-Transmitter-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x7a74 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:38:14 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Product-onecore__Microsoft-OneCore-WSD-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x3794 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:38:14 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Mobile-Sensors-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x6b4c Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:38:14 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-OneCore-Bluetooth-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0x26b8 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:38:14 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-OneCore-Bluetooth-Input-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x5390 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:38:14 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-OneCore-Connectivity-HID-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x1f44 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:38:14 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Product-onecore__Microsoft-OneCore-Connectivity-HIDMiniports-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x1b010 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:38:15 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-OneCore-Connectivity-I3C-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x3794 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:38:15 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-OneCore-Connectivity-Serial-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x19474 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:38:15 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-OneCore-Connectivity-UsbHost-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x9c0c Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:38:15 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-OneCore-FirmwareUpdate-HidCfu-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0xc148 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:38:15 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-OneCore-FirmwareUpdate-StorFwUpdate-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0xa380 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:38:15 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-OneCore-SecureStartup-merged-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x1f44 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:38:15 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-OneCore-SecureStartup-Foundation-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x37e4 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:38:15 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-OneCore-Sensors-Core-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x4d88 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:38:15 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-CoreSystem-Security-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x8940 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:38:15 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Network-Security-Core-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x4d88 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:38:15 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-OneCore-ClassExtensions-Package~31bf3856ad364e35~amd64~~10.0.26100.6725.cat Handle ID: 0x8940 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:38:15 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-OneCore-DeviceAssociationFramework-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x4d88 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:38:15 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-TrustedExecution-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0x8940 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:38:15 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-OneCore-Edge-WebRuntime-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x70bc Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:38:15 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-OneCore-EnterpriseNetworking-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0x6bd8 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:38:15 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-OneCore-ESENT-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x70bc Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:38:15 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-OneCore-Fonts-UAPFonts-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x6bd8 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:38:15 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-OneCore-Pnp-OnlineDriverStore-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0x70bc Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:38:15 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-OneCore-Pnp-PlatformServices-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x6bd8 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:38:15 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-OneCore-Pnp-RuntimeDeviceInstall-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x70bc Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:38:15 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-OneCore-Transactions-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0x6bd8 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:38:15 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-OneCore-WebService-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x70bc Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:38:15 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Browser-Brokers-Package~31bf3856ad364e35~amd64~~11.0.26100.7019.cat Handle ID: 0x6bd8 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:38:15 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-CoreSystem-BootEnv-merged-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x2ae0 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:38:15 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-CoreSystem-DXG-merged-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x6bd8 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:38:15 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-OneCore-Graphics-DirectX-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0x2ae0 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:38:15 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-CoreSystem-DXG-Common-merged-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0x6bd8 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:38:15 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-OneCore-Graphics-DirectX-Core-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x338 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:38:15 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-OneCore-Graphics-Required-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0x6bd8 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:38:15 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-OneCore-Graphics-Required-Full-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0x338 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:38:15 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-DirectX-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0xc5e8 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:38:15 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-DisplayDiag-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x1f44 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:38:15 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-CoreSystem-RemoteFS-Client-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0xc5e8 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:38:15 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-CoreSystem-RemoteFS-Server-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x1f44 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:38:15 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-CoreSystem-XmlLite-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0xc5e8 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:38:15 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-CrashDump-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x1f44 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:38:15 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-WOWSupport-Full-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x1b010 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:38:15 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\CoreMessaging-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x1f44 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:38:15 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-OneCore-Kernel-AppCore-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x1b010 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:38:15 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-UserSessionManagement-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x1f44 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:38:15 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Windows-ClientCore-DWM-merged-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0x1b010 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:38:15 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-OneCore-CoreUiComponents-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x1f44 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:38:15 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-OneCore-MinInput-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x3794 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:38:15 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Composition-merged-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0x1f44 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:38:15 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Composition-Core-merged-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x3794 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:38:15 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Runlevel-Win0-WOW64-merged-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x1b010 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:38:15 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-OneCore-ETW-Rundown-WOW64-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x3794 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:38:15 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Foundation-Win0-WOW64-merged-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0x1b010 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:38:15 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Runlevel-Win1-WOW64-merged-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x3794 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:38:15 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Foundation-Win1-WOW64-merged-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0x1b010 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:38:15 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-OneCore-TroubleShooting-WOW64-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x3794 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:38:15 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-OneCore-CoreSystem-BootableSKU-WOW64-merged-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0x1b010 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:38:15 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-OneCore-TraceDataHelper-WOW64-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x9c0c Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:38:15 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-OneCore-CoreSystem-Core-WOW64-merged-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0x1b010 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:38:15 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Basic-Http-Minio-WOW64-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x9c0c Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:38:15 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-OneCore-Pnp-Core-WOW64-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x1b010 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:38:15 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-OneCore-DebugCore-WOW64-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x9c0c Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:38:15 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-ErrorReportingCore-WOW64-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x1b010 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:38:15 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-ErrorReportingFaults-WOW64-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x9c0c Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:38:15 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Foundation-Group-WOW64-merged-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0x3794 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:38:15 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Network-Foundation-WOW64-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x9c0c Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:38:15 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-OneCore-FileSystem-Support-WOW64-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x3794 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:38:15 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-CoreSystem-CredSSP-WOW64-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0xc158 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:38:15 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-CoreSystem-Security-UserMgr-WOW64-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0x3794 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:38:15 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-CoreSystem-WINNLS-Core-WOW64-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0xc158 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:38:15 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-CoreSystem-WinTrust-WOW64-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x3794 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:38:15 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Gdi32Full-WOW64-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0xc158 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:38:15 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Windows-ClientCore-Shutdown-WOW64-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x3794 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:38:15 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Windows-ClientCore-Win32Bridge-WOW64-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0x9c0c Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:38:15 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Runlevel-Win4-WOW64-merged-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0x3794 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:38:15 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-OneCore-Biometrics-WOW64-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x3620 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:38:15 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Product-onecore__Microsoft-OneCore-WSD-WOW64-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x70bc Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:38:15 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-OneCore-Bluetooth-WOW64-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x3620 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:38:15 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-OneCore-SecureStartup-Foundation-WOW64-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x70bc Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:38:15 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-OneCore-Sensors-Core-WOW64-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x3620 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:38:15 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-CoreSystem-Security-WOW64-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x70bc Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:38:15 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Network-Security-Core-WOW64-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x3620 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:38:15 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-OneCore-DeviceAssociationFramework-WOW64-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x70bc Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:38:15 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-OneCore-EnterpriseNetworking-WOW64-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0x85f0 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:38:15 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-OneCore-ESENT-WOW64-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x3620 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:38:15 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-OneCore-Pnp-OnlineDriverStore-WOW64-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x85f0 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:38:15 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-OneCore-Pnp-RuntimeDeviceInstall-WOW64-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x3620 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:38:15 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-OneCore-WebService-WOW64-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x85f0 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:38:15 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-CoreSystem-DXG-WOW64-merged-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x3620 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:38:15 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-OneCore-Graphics-DirectX-WOW64-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x85f0 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:38:15 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-CoreSystem-DXG-Common-WOW64-merged-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x3620 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:38:15 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-OneCore-Graphics-DirectX-Core-WOW64-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x85f0 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:38:15 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-OneCore-Graphics-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x3620 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:38:15 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-OneCore-Graphics-Required-Full-WOW64-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0x85f0 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:38:15 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-DirectX-WOW64-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x3620 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:38:15 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-DisplayDiag-WOW64-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x85f0 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:38:15 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-CoreSystem-RemoteFS-Client-WOW64-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x3620 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:38:15 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-CoreSystem-XmlLite-WOW64-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x85f0 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:38:15 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-WOWSupport-Full-WOW64-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x3620 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:38:15 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\CoreMessaging-WOW64-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x85f0 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:38:15 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-OneCore-Kernel-AppCore-WOW64-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x3620 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:38:15 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-UserSessionManagement-WOW64-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x85f0 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:38:15 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Windows-ClientCore-DWM-WOW64-merged-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x3620 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:38:15 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-OneCore-CoreUiComponents-WOW64-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x85f0 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:38:15 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-OneCore-MinInput-WOW64-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x70bc Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:38:15 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Composition-WOW64-merged-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x3620 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:38:15 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Composition-Core-WOW64-merged-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x70bc Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:38:15 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Client-Features-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0x3620 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:38:15 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-BioEnrollment-UX-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x1d804 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:38:15 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-ComputerManagerLauncher-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x2bd8 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:38:15 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Defrag-UI-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x1d804 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:38:15 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Printer-Drivers-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0x2bd8 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:38:15 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-RecoveryDrive-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x2bd8 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:38:15 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-ScreenSavers-3D-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x1d804 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:38:15 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-ShellOptions-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x2bd8 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:38:15 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Client-Features-Package00~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0x1d804 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:38:15 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Client-Features-Package01~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0x24cc Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:38:16 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Client-Features-Package02~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0x6b58 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:38:16 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0xd078 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:38:16 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Client-Features-Package04~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0x37e4 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:38:16 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Client-Features-Package05~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0x6b58 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:38:16 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Client-Features-Package0510~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x758 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:38:16 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-TS-Optional-Client-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x6b58 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:38:16 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Client-Features-Package06~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0x758 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:38:16 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Kernel-Package-Kernel-Power-Events-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x6b58 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:38:16 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Kernel-Package-Kernel-Power-Events-Container-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0x758 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:38:16 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\HyperV-VID-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0xc158 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:38:16 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Client-Features-Package07~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0x2ae0 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:38:16 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Undocked-Hypervisor-Drivers-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0xc158 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:38:16 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Undocked-Hypervisor-Host-Service-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x37e4 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:38:16 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Undocked-Hypervisor-hvservice.inf-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0xc158 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:38:16 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Undocked-Hypervisor-WINHVR-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x5390 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:38:16 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-OneCore-IsolatedUserMode-merged-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0x6350 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:38:16 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Kernel-Package-IsolatedUserMode-Common-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x5390 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:38:16 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Kernel-Package-IsolatedUserMode-Other-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0x6350 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:38:16 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-SecConfig-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x5390 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:38:16 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Client-Features-Package08~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x6350 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:38:16 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-RemoteAssistance-Package-Client~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x5390 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:38:16 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Client-Features-Package09~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x6350 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:38:16 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Client-Features-Package010~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0x5390 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:38:16 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Client-Features-Package011~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x338 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:38:16 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Printing-InternetPrinting-Client-Opt-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x1a410 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:38:16 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Client-Features-Package012~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0x338 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:38:16 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Client-Features-Package013~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x1a410 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:38:16 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-BootEnvironment-Dvd-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x338 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:38:16 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Client-Features-WOW64-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0x1a410 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:38:16 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Client-Features-WOW64-Package00~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x338 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:38:16 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Client-Features-WOW64-Package01~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0x1a410 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:38:16 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Client-Features-WOW64-Package0110~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0x338 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:38:16 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Client-Features-WOW64-Package0111~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0x1a410 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:38:16 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Client-Features-WOW64-Package0112~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0xcad4 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:38:16 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-TS-Optional-Client-WOW64-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x1a410 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:38:16 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Client-Features-WOW64-Package02~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0xd078 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:38:16 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-AppManagement-UEV-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x1a410 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:38:16 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-CoreSystem-MSXML6-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0xd078 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:38:16 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Client-License-Flexible-Platform-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x1a410 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:38:16 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-DesktopEditions-Layer-Data-VersionInfo-Dynamic-Ge-26200-Version-EKB-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0xd078 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:38:16 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Product-Data-Ge-26200-Version-EKB-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0x1a410 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:38:16 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-UpdateTargeting-ClientOS-Ge-26200-Version-EKB-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0xd078 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:38:16 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0x1a410 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:38:16 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-AppManagement-Common-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0xcad4 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:38:16 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Client-AssignedAccess-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x1a410 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:38:16 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-PeerDist-Client-Group-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x1ce10 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:38:16 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x1a410 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:38:16 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x6648 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:38:16 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-TerminalServices-RemoteApplications-Client-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x1a410 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:38:16 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Windows-Defender-ApplicationGuard-Inbox-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x6648 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:38:16 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Embedded-AssignedAccessCsp-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x1a410 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:38:16 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Embedded-KeyboardFilter-Core-Package~31bf3856ad364e35~amd64~~10.0.26100.6725.cat Handle ID: 0x6648 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:38:16 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Shell-CustomShellHost-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x1a410 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:38:16 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Printing-PremiumTools-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x6648 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:38:16 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-ConfigCI-Onecore-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x1a410 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:38:16 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-DeviceGuard-GPEXT-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x6648 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:38:16 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Embedded-UnifiedWriteFilterCSP-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x1a410 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:38:16 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-GroupPolicy-ClientExtensions-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x6648 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:38:16 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-GroupPolicy-ClientTools-merged-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0x1a410 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:38:16 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-OfflineFiles-merged-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0x6648 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:38:16 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-OfflineFiles-UI-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x1a410 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:38:16 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-StorageService-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x6648 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:38:16 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-TerminalServices-WMIProvider-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x1a410 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:38:16 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-ZTDNS-Package-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x6648 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:38:16 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-IIS-WebServer-ServerCommon-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x1a410 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:38:16 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-AppManagement-UEV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x1ce10 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:38:16 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-CoreSystem-MSXML6-WOW64-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x1b198 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:38:16 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-AppManagement-AppV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0x1ce10 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:38:16 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-PeerDist-Client-Group-WOW64-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x1b198 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:38:16 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Windows-Defender-ApplicationGuard-Inbox-WOW64-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x1ce10 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:38:16 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-ConfigCI-Onecore-WOW64-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x1b198 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:38:16 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-GroupPolicy-ClientExtensions-WOW64-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x6b58 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:38:16 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0x1b198 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:38:16 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Multimedia-MF-merged-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x6b58 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:38:16 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-OneCore-Multimedia-MFPMP-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0x1b198 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:38:16 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Multimedia-MFCore-WCOSHeadless-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0x6b58 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:38:16 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Multimedia-MFCore-WCOSMinusHeadless-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0x1b198 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:38:16 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Multimedia-RestrictedCodecs-merged-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x6b58 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:38:16 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Multimedia-RestrictedCodecsCore-WCOSHeadless-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0x1b198 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:38:16 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Multimedia-RestrictedCodecsCore-WCOSMinusHeadless-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x1ce10 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:38:16 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Multimedia-RestrictedCodecsExt-WCOSHeadless-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x1b198 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:38:16 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Multimedia-RestrictedCodecsExt-WCOSMinusHeadless-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x6b58 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:38:16 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Media-Format-merged-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x1b198 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:38:16 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-WPD-LegacyWmdmFeature-Feature-Package~31bf3856ad364e35~amd64~~10.0.26100.6899.cat Handle ID: 0x6b58 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:38:17 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Media-Streaming-merged-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x97b8 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:38:17 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-OneCore-Multimedia-CastingCommon-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x85f0 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:38:17 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-OneCore-Multimedia-CastingReceiver-Media-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x97b8 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:38:17 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-OneCore-Multimedia-CastingTransmitter-Media-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x85f0 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:38:17 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Multimedia-WMPDMC-Package~31bf3856ad364e35~amd64~~10.0.26100.6899.cat Handle ID: 0x97b8 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:38:17 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Portable-Devices-merged-Package~31bf3856ad364e35~amd64~~10.0.26100.6725.cat Handle ID: 0x6eec Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:38:17 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-WPD-UltimatePortableDeviceFeature-Feature-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x758 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:38:17 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-WebcamExperience-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x1b010 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:38:17 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Multimedia-MF-WOW64-merged-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x758 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:38:17 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-OneCore-Multimedia-MFPMP-WOW64-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x1b010 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:38:17 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Multimedia-MFCore-WCOSHeadless-WOW64-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0x758 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:38:17 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Multimedia-MFCore-WCOSMinusHeadless-WOW64-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0x1b010 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:38:17 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Multimedia-RestrictedCodecs-WOW64-merged-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x1bba4 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:38:17 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Multimedia-RestrictedCodecsCore-WCOSHeadless-WOW64-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0x1b010 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:38:17 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Multimedia-RestrictedCodecsCore-WCOSMinusHeadless-WOW64-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x758 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:38:17 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Multimedia-RestrictedCodecsExt-WCOSHeadless-WOW64-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x1b010 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:38:17 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Multimedia-RestrictedCodecsExt-WCOSMinusHeadless-WOW64-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x1bba4 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:38:17 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Media-Format-WOW64-merged-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x1b010 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:38:17 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-WPD-LegacyWmdmFeature-Feature-WOW64-Package~31bf3856ad364e35~amd64~~10.0.26100.6899.cat Handle ID: 0x758 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:38:17 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Media-Streaming-WOW64-merged-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x1b010 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:38:17 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-OneCore-Multimedia-CastingCommon-WOW64-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x758 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:38:17 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-OneCore-Multimedia-CastingReceiver-Media-WOW64-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x1b010 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:38:17 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-WPD-UltimatePortableDeviceFeature-Feature-WOW64-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x758 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:38:17 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-WebcamExperience-WOW64-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x1b010 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:38:17 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-DesktopFileExplorer-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x758 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:38:17 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Runtime-Metadata-Desktop-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x1bba4 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:38:17 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-ShellExperienceHost-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0x758 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:38:17 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Runtime-Metadata-Desktop-WOW64-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x1bba4 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:38:17 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Edge-WebView-FOD-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0x758 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:38:17 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-OneCore-ApplicationModel-Sync-Desktop-FOD-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0x3620 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:38:17 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-OneCore-ApplicationModel-Sync-Desktop-FOD-Package~31bf3856ad364e35~wow64~~10.0.26100.7019.cat Handle ID: 0x6ae8 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:38:17 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-OneCore-DirectX-Database-FOD-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0x3620 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:38:17 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-EnterpriseClientSync-Host-Opt-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x6558 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:38:17 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Ethernet-Client-Intel-E1i68x64-FOD-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0x1d698 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:38:17 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Ethernet-Client-Intel-E2f68-FOD-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0x1ce38 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:38:17 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Ethernet-Client-Realtek-Rtcx21x64-FOD-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0x2ae0 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:38:17 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Ethernet-Client-Vmware-Vmxnet3-FOD-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0x6558 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:38:17 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-FodMetadataServicing-Desktop-Metadata-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0x5390 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:38:17 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Hello-Face-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0x1c90c Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:38:17 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Kernel-Package-IsolatedUserMode-Kernel-LA57-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0x6490 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:38:17 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Kernel-Package-OS-Kernel-LA57-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0x5390 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:38:17 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Spelling-Dictionaries-en-us-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x1b010 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:38:17 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-LanguageFeatures-Handwriting-en-us-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0x6590 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:38:17 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-LanguageFeatures-OCR-en-us-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0x764 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:38:17 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-LanguageFeatures-Speech-en-us-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0xd664 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:38:17 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-LanguageFeatures-TextToSpeech-en-us-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0x1b010 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:38:17 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-MediaPlayer-Opt-merged-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x884c Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:38:17 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Media-Player-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0xa550 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:38:17 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-WMPNetworkSharingService-Opt-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x884c Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:38:17 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Media-Player-WOW64-Package~31bf3856ad364e35~wow64~~10.0.26100.7171.cat Handle ID: 0xa550 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:38:17 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-WMPNetworkSharingService-Opt-WOW64-Package~31bf3856ad364e35~wow64~~10.0.26100.7019.cat Handle ID: 0xc194 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:38:17 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Notepad-System-FoD-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0xa550 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:38:17 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Notepad-System-FoD-Package~31bf3856ad364e35~wow64~~10.0.26100.7171.cat Handle ID: 0x7238 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:38:17 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-PowerShell-ISE-FOD-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0x5390 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:38:17 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-PowerShell-ISE-FOD-Package~31bf3856ad364e35~wow64~~10.0.26100.7171.cat Handle ID: 0xc0c0 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:38:17 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Printing-PMCPPC-FoD-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0x60e4 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:38:17 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-SenseClient-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0x724c Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:38:17 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-StepsRecorder-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0x6350 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:38:17 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-StepsRecorder-Package~31bf3856ad364e35~wow64~~10.0.26100.7171.cat Handle ID: 0xd4d4 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:38:17 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-VBSCRIPT-Package~31bf3856ad364e35~amd64~~10.0.26100.7019.cat Handle ID: 0xbe90 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:38:17 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-VBSCRIPT-WOW64-Package~31bf3856ad364e35~wow64~~10.0.26100.7019.cat Handle ID: 0x338 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:38:17 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Wifi-Client-Broadcom-Bcmpciedhd63-FOD-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0x2640 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:38:17 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Wifi-Client-Broadcom-Bcmwl63a-FOD-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0x96d4 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:38:17 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Wifi-Client-Broadcom-Bcmwl63al-FOD-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0x1d804 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:38:17 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Wifi-Client-Intel-Netwbw02-FOD-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0x338 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:38:17 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Wifi-Client-Intel-Netwew00-FOD-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0x6350 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:38:18 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Wifi-Client-Intel-Netwew01-FOD-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0x2640 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:38:18 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Wifi-Client-Intel-Netwlv64-FOD-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0x96d4 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:38:18 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Wifi-Client-Intel-Netwns64-FOD-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0x1d804 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:38:18 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Wifi-Client-Intel-Netwsw00-FOD-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0x4b3c Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:38:18 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Wifi-Client-Intel-Netwtw02-FOD-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0x338 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:38:18 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Wifi-Client-Intel-Netwtw04-FOD-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0x6350 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:38:18 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Wifi-Client-Intel-Netwtw06-FOD-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0x96d4 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:38:18 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Wifi-Client-Intel-Netwtw08-FOD-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0x1d804 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:38:18 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Wifi-Client-Intel-Netwtw10-FOD-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0x4b3c Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:38:18 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Wifi-Client-Marvel-Mrvlpcie8897-FOD-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0x338 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:38:18 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Wifi-Client-Qualcomm-Athw8x-FOD-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0x6350 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:38:18 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Wifi-Client-Qualcomm-Athwnx-FOD-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0x96d4 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:38:18 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Wifi-Client-Qualcomm-Qcamain10x64-FOD-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0x1d804 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:38:18 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Wifi-Client-Ralink-Netr28x-FOD-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0x4b3c Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:38:19 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Wifi-Client-Realtek-Rtl8192se-FOD-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0x338 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:38:19 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Wifi-Client-Realtek-Rtwlane-FOD-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0x6350 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:38:19 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Wifi-Client-Realtek-Rtwlane01-FOD-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0x96d4 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:38:19 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Wifi-Client-Realtek-Rtwlane13-FOD-Package~31bf3856ad364e35~amd64~~10.0.26100.7171.cat Handle ID: 0xc194 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:38:19 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Editions-Professional-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.7171.cat Handle ID: 0x2640 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:38:19 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Licenses-Professional-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.7171.cat Handle ID: 0xbe7c Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:38:19 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Kernel-Package-Acpi-Pci-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.6899.cat Handle ID: 0x1d804 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:38:19 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Kernel-Package-Ntdll-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.7171.cat Handle ID: 0xc158 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:38:19 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Foundation-Win1-merged-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.7019.cat Handle ID: 0x24cc Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:38:19 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-OneCore-CoreSystem-Core-merged-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.7019.cat Handle ID: 0xc158 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:38:19 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-OneCore-LSA-merged-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.6725.cat Handle ID: 0xd664 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:38:19 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-ErrorReportingCore-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.7019.cat Handle ID: 0x4fa4 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:38:19 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-ErrorReportingFaults-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.7019.cat Handle ID: 0xd664 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:38:19 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Foundation-Group-merged-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.7019.cat Handle ID: 0xa5a8 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:38:19 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Kernel-Package-System-Events-Container-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.7019.cat Handle ID: 0xd664 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:38:19 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Network-Foundation-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.7019.cat Handle ID: 0x4fa4 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:38:19 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-CoreSystem-BootableSKU-Winlogon-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.6725.cat Handle ID: 0xd664 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:38:19 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-CoreSystem-Security-UserMgr-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.6725.cat Handle ID: 0x4fa4 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:38:19 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Windows-ClientCore-Win32Bridge-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.7019.cat Handle ID: 0xd664 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:38:19 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Runlevel-Win4-merged-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.7019.cat Handle ID: 0xa5a8 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:38:19 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-OneCore-Biometrics-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.7019.cat Handle ID: 0xcad4 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:38:19 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-OneCore-Biometrics-Fingerprint-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.6725.cat Handle ID: 0xa5a8 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:38:19 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-OneCore-SD-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.7019.cat Handle ID: 0x7238 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:38:19 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-OneCore-Connectivity-I3C-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.7019.cat Handle ID: 0xcad4 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:38:19 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-OneCore-SecureStartup-Foundation-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.7019.cat Handle ID: 0x4b3c Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:38:19 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-OneCore-EnterpriseNetworking-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.7019.cat Handle ID: 0x97b8 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:38:19 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-OneCore-Graphics-Required-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.7171.cat Handle ID: 0x724c Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:38:19 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-UserSessionManagement-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.6725.cat Handle ID: 0x97b8 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:38:19 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Kernel-Package-Ntdll-WOW64-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.7019.cat Handle ID: 0x724c Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:38:19 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Client-Features-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.7019.cat Handle ID: 0x97b8 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:38:19 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Client-Features-Package01~31bf3856ad364e35~amd64~en-US~10.0.26100.7019.cat Handle ID: 0x724c Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:38:19 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Client-Features-Package0110~31bf3856ad364e35~amd64~en-US~10.0.26100.7019.cat Handle ID: 0x97b8 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:38:19 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Client-Features-Package0111~31bf3856ad364e35~amd64~en-US~10.0.26100.7019.cat Handle ID: 0x724c Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:38:19 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Kernel-Package-Kernel-Power-Events-Container-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.7019.cat Handle ID: 0x97b8 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:38:19 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~en-US~10.0.26100.7019.cat Handle ID: 0x724c Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:38:19 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Client-Features-WOW64-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.7019.cat Handle ID: 0x97b8 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:38:19 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.7019.cat Handle ID: 0x724c Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:38:19 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Help-ClientOOBE-Feature-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.7019.cat Handle ID: 0x97b8 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:38:20 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-GroupPolicy-ClientTools-merged-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.7171.cat Handle ID: 0x724c Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:38:20 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Management-SecureAssessment-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.7019.cat Handle ID: 0x97b8 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:38:20 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Licenses-IoTEnterprise-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.7171.cat Handle ID: 0x724c Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:38:20 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Licenses-IoTEnterpriseK-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.7171.cat Handle ID: 0x97b8 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:38:20 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Client-Desktop-Required-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.7171.cat Handle ID: 0x724c Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:38:20 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Client-Desktop-Required-Package00~31bf3856ad364e35~amd64~en-US~10.0.26100.7171.cat Handle ID: 0x97b8 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:38:20 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Client-Desktop-Required-Package0010~31bf3856ad364e35~amd64~en-US~10.0.26100.7019.cat Handle ID: 0xbe7c Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:38:20 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Client-Desktop-Required-Package0011~31bf3856ad364e35~amd64~en-US~10.0.26100.7171.cat Handle ID: 0x97b8 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:38:20 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Client-Desktop-Required-Package001120~31bf3856ad364e35~amd64~en-US~10.0.26100.7171.cat Handle ID: 0x884c Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:38:20 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Client-Desktop-Required-Package01~31bf3856ad364e35~amd64~en-US~10.0.26100.7171.cat Handle ID: 0x24cc Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:38:20 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Client-Desktop-Required-Package0110~31bf3856ad364e35~amd64~en-US~10.0.26100.7019.cat Handle ID: 0x71a4 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:38:20 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Client-Desktop-Required-Package0111~31bf3856ad364e35~amd64~en-US~10.0.26100.7171.cat Handle ID: 0xcad4 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:38:20 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Client-Desktop-Required-Package0112~31bf3856ad364e35~amd64~en-US~10.0.26100.7171.cat Handle ID: 0x96d4 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:38:20 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Client-Desktop-Required-Package011221~31bf3856ad364e35~amd64~en-US~10.0.26100.7019.cat Handle ID: 0xcad4 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:38:20 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Client-Desktop-Required-Package0113~31bf3856ad364e35~amd64~en-US~10.0.26100.7171.cat Handle ID: 0x7600 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:38:20 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Client-Desktop-Required-Package011320~31bf3856ad364e35~amd64~en-US~10.0.26100.7019.cat Handle ID: 0xcad4 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:38:20 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Client-Desktop-Required-Package0114~31bf3856ad364e35~amd64~en-US~10.0.26100.7171.cat Handle ID: 0x7600 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:38:20 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.7019.cat Handle ID: 0x96d4 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:38:20 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Client-Desktop-Required-WOW64-Package00~31bf3856ad364e35~amd64~en-US~10.0.26100.7019.cat Handle ID: 0x77d8 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:38:20 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Notepad-System-FoD-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.7171.cat Handle ID: 0xcad4 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:38:20 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-PowerShell-ISE-FOD-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.7171.cat Handle ID: 0x764 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:38:20 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Printing-PMCPPC-FoD-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.7171.cat Handle ID: 0x338 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:38:20 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-SenseClient-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.7019.cat Handle ID: 0x77d8 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:38:20 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-StepsRecorder-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.7171.cat Handle ID: 0xb9b4 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 13568 | 2025-11-29 09:38:20 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Packages\Microsoft-Windows-Ge-Client-Server-26200-Version-Enablement-Payload-Package~31bf3856ad364e35~amd64~~10.0.26100.6717.cat Handle ID: 0x2bd8 Process Information: Process ID: 0x1b80 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:AI(AU;SAFA;0x1f0116;;;WD) New Security Descriptor: S:NO_ACCESS_CONTROL
|
| | Security | Audit Success | 12544 | 2025-11-29 09:39:52 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4d4 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12548 | 2025-11-29 09:39:52 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12544 | 2025-11-29 09:41:02 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4d4 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12548 | 2025-11-29 09:41:02 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12544 | 2025-11-29 09:43:55 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4d4 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12548 | 2025-11-29 09:43:55 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12544 | 2025-11-29 09:43:56 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4d4 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-29 09:43:56 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4d4 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-29 09:43:56 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4d4 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12545 | 2025-11-29 09:43:56 | | Microsoft-Windows-Security-Auditing | 4647: User initiated logoff: Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x6033c This event is generated when a logoff is initiated. No further user-initiated activity can occur. This event can be interpreted as a logoff event.
|
| | Security | Audit Success | 12548 | 2025-11-29 09:43:56 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-29 09:43:56 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-29 09:43:56 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 13824 | 2025-11-29 09:43:56 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 09:43:56 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 09:43:56 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 09:43:56 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x6033c Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 09:43:56 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x6033c Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 09:43:56 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x6033c Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 09:43:56 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x6033c Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 09:43:56 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x6033c Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 09:43:56 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x6033c Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 12544 | 2025-11-29 09:43:57 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4d4 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12548 | 2025-11-29 09:43:57 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 13824 | 2025-11-29 09:43:57 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x6033c Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 09:43:57 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x6033c Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 09:43:57 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x6033c Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 09:43:57 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x6033c Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\Boot\EFI\memtest.efi Handle ID: 0x1af0 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\Boot\Misc\PCAT\bootspaces.dll Handle ID: 0x1af0 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\Boot\PCAT\bootmgr Handle ID: 0x1af0 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\Boot\PCAT\bootuwf.dll Handle ID: 0x1af0 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\Boot\PCAT\bootvhd.dll Handle ID: 0x1af0 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\INF\wfplwfs.inf Handle ID: 0x1af0 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\AgentService.exe Handle ID: 0x1af0 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\apisetschema.dll Handle ID: 0x1af0 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\autofstx.exe Handle ID: 0x1af0 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\basesrv.dll Handle ID: 0x1af0 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\BFE.DLL Handle ID: 0x1af0 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\bootim.exe Handle ID: 0x1af0 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\bootux.dll Handle ID: 0x1af0 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\cdd.dll Handle ID: 0x1af0 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\ci.dll Handle ID: 0x1af0 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\csrsrv.dll Handle ID: 0x1af0 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\DrtmAuthTxt.wim Handle ID: 0x1af0 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\fltmgrres.dll Handle ID: 0x1af0 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\fstx.dll Handle ID: 0x1af0 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\FWPUCLNT.DLL Handle ID: 0x8ac Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\IKEEXT.DLL Handle ID: 0x1af0 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\iphlpsvc.dll Handle ID: 0x1af0 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\iumcrypt.dll Handle ID: 0x1af0 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\KerbClientShared.dll Handle ID: 0x1af0 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\lsaadt.dll Handle ID: 0x1af0 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\LsaIso.exe Handle ID: 0x1af0 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\lsasrv.dll Handle ID: 0x1af0 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\mssecuser.dll Handle ID: 0x8ac Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\mssecwfpu.dll Handle ID: 0x8ac Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\ncbservice.dll Handle ID: 0x8ac Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\nsi.dll Handle ID: 0x8ac Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\nsisvc.dll Handle ID: 0x8ac Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\ntdll.dll Handle ID: 0x8ac Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\ntkrla57.exe Handle ID: 0x8ac Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\NtlmShared.dll Handle ID: 0x8ac Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\ntoskrnl.exe Handle ID: 0x8ac Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\offlinelsa.dll Handle ID: 0x8ac Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\plutonfw_AuthenticAMD.dll Handle ID: 0x8ac Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\rasadhlp.dll Handle ID: 0x8ac Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\rasauto.dll Handle ID: 0x8ac Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\rasautou.exe Handle ID: 0x8ac Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\securekernel.exe Handle ID: 0x8ac Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\securekernella57.exe Handle ID: 0x8ac Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\skci.dll Handle ID: 0x8ac Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\smss.exe Handle ID: 0x8ac Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\sstpsvc.dll Handle ID: 0x7c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\symcryptk.dll Handle ID: 0x7c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\tcblaunch.exe Handle ID: 0x7c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\tcbloader.dll Handle ID: 0x7c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\tcpipcfg.dll Handle ID: 0x7c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\winload.efi Handle ID: 0x7c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\winload.exe Handle ID: 0x7c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\winnsi.dll Handle ID: 0x7c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\winresume.efi Handle ID: 0x7c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\winresume.exe Handle ID: 0x7c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\CodeIntegrity\driver.stl Handle ID: 0x7c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\CodeIntegrity\previous.driver.stl Handle ID: 0x7c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\CodeIntegrity\VbsSiPolicy.p7b Handle ID: 0x7c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\drivers\afd.sys Handle ID: 0x7c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\drivers\ahcache.sys Handle ID: 0x7c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\drivers\bam.sys Handle ID: 0x7c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\drivers\bfs.sys Handle ID: 0x7c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\drivers\bowser.sys Handle ID: 0x7c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\drivers\clfs.sys Handle ID: 0x7c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\drivers\cng.sys Handle ID: 0x7c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\drivers\crashdmp.sys Handle ID: 0x7c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\drivers\dam.sys Handle ID: 0x7c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\drivers\dumpfve.sys Handle ID: 0x7c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\drivers\dxgkrnl.sys Handle ID: 0x7c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\drivers\dxgmms1.sys Handle ID: 0x7c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\drivers\dxgmms2.sys Handle ID: 0x7c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\drivers\exfat.sys Handle ID: 0x7c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\drivers\fastfat.sys Handle ID: 0x7c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\drivers\fltMgr.sys Handle ID: 0x7c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\drivers\fvevol.sys Handle ID: 0x7c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\drivers\FWPKCLNT.SYS Handle ID: 0x7c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\drivers\Kerb3961Kernel.sys Handle ID: 0x7c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\drivers\ks.sys Handle ID: 0x828 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\drivers\ksecdd.sys Handle ID: 0x7c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\drivers\ksecpkg.sys Handle ID: 0x7c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\drivers\luafv.sys Handle ID: 0x7c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\drivers\mrxsmb.sys Handle ID: 0x7c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\drivers\mrxsmb20.sys Handle ID: 0x7c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\drivers\mskssrv.sys Handle ID: 0x7c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\drivers\msseccore.sys Handle ID: 0x8ac Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\drivers\mssecflt.sys Handle ID: 0x8ac Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\drivers\mssecwfp.sys Handle ID: 0x8ac Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\drivers\ndis.sys Handle ID: 0x734 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\drivers\ndiswan.sys Handle ID: 0x8ac Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\drivers\netbt.sys Handle ID: 0x8ac Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\drivers\netio.sys Handle ID: 0x734 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\drivers\nsiproxy.sys Handle ID: 0x734 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\drivers\ntfs.sys Handle ID: 0x734 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\drivers\partmgr.sys Handle ID: 0x734 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\drivers\pdc.sys Handle ID: 0x734 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\drivers\rasacd.sys Handle ID: 0x734 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\drivers\rdbss.sys Handle ID: 0x734 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\drivers\rdyboost.sys Handle ID: 0x734 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\drivers\refs.sys Handle ID: 0x484 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\drivers\refsv1.sys Handle ID: 0x484 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\drivers\storport.sys Handle ID: 0x484 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\drivers\tcpip.sys Handle ID: 0x484 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\drivers\tcpipreg.sys Handle ID: 0x484 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\drivers\tdi.sys Handle ID: 0x484 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\drivers\tdx.sys Handle ID: 0x484 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\drivers\tm.sys Handle ID: 0x484 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\drivers\udfs.sys Handle ID: 0x484 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\drivers\volsnap.sys Handle ID: 0x484 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\drivers\wanarp.sys Handle ID: 0x484 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\drivers\watchdog.sys Handle ID: 0x484 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\drivers\Wdf01000.sys Handle ID: 0x484 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\drivers\wfplwfs.sys Handle ID: 0x484 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\drivers\WindowsTrustedRT.sys Handle ID: 0x484 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\drivers\winnat.sys Handle ID: 0x484 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\drivers\WppRecorder.sys Handle ID: 0x484 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\drivers\ws2ifsl.sys Handle ID: 0x484 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\drivers\wtd.sys Handle ID: 0x484 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\autofstx.exe Handle ID: 0x484 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\fstx.dll Handle ID: 0x484 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\KerbClientShared.dll Handle ID: 0x484 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\nsi.dll Handle ID: 0x484 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\ntdll.dll Handle ID: 0x484 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\NtlmShared.dll Handle ID: 0x484 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\winnsi.dll Handle ID: 0x484 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\_0000000000000000.cdf-ms Handle ID: 0x484 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$.cdf-ms Handle ID: 0x484 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_web_3f580d25a4c8e0a0.cdf-ms Handle ID: 0x484 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_web_screen_a1e9c2590bec5884.cdf-ms Handle ID: 0x484 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_waas_401032e7a18c2040.cdf-ms Handle ID: 0x484 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_waas_services_ddfc4ae175ff1678.cdf-ms Handle ID: 0x484 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_waas_regkeys_dbffc348a6fab71c.cdf-ms Handle ID: 0x484 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_vss_3f582555a4c8be22.cdf-ms Handle ID: 0x484 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_vss_writers_08335f148b847d02.cdf-ms Handle ID: 0x484 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_vss_writers_system_e29eb58bafd8a559.cdf-ms Handle ID: 0x484 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_vss_writers_application_85e0c568acb2deec.cdf-ms Handle ID: 0x484 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_uus_3f582921a4c8b86f.cdf-ms Handle ID: 0x484 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_uus_x86_bfd482a045d3d20b.cdf-ms Handle ID: 0x484 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_uus_x86_en-us_2900c691f94a2da7.cdf-ms Handle ID: 0x484 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_uus_packages_preview_63ceb121ca73ab8a.cdf-ms Handle ID: 0x484 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_uus_packages_preview_x86_42a29bdb7e004c8c.cdf-ms Handle ID: 0x484 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_uus_packages_preview_x86_en-us_ad575c918f903e50.cdf-ms Handle ID: 0x484 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_uus_packages_preview_amd64_c5f751b5d0d4a22e.cdf-ms Handle ID: 0x484 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_uus_packages_preview_amd64_en-us_3b1ba9d8fe4860c4.cdf-ms Handle ID: 0x484 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_uus_amd64_1a6fccf0d7e0978b.cdf-ms Handle ID: 0x484 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:34 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_uus_amd64_en-us_ce2cd76bb8f04153.cdf-ms Handle ID: 0x484 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_tapi_401030b7a18c2556.cdf-ms Handle ID: 0x484 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_syswow64_21ffbdd2a2dd92e0.cdf-ms Handle ID: 0x484 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_syswow64_winmetadata_047140633426c833.cdf-ms Handle ID: 0x484 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_syswow64_windowspowershell_v1.0_19ae85881f1c4f2d.cdf-ms Handle ID: 0x484 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_syswow64_windowspowershell_v1.0_modules_b001352a7f7811a4.cdf-ms Handle ID: 0x484 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_syswow64_windowspowershell_v1.0_modules_wdac_71e7f37cc92d930f.cdf-ms Handle ID: 0x484 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_syswow64_windowspowershell_v1.0_modules_uev_85ae9894702fab2e.cdf-ms Handle ID: 0x484 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_syswow64_windowspowershell_v1.0_modules_tls_85aea64a702f964b.cdf-ms Handle ID: 0x484 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_syswow64_windowspowershell_v1.0_modules_storagebuscache_972862338e7b7d73.cdf-ms Handle ID: 0x484 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_syswow64_windowspowershell_v1.0_modules_storage_9e31d07a19ed5a47.cdf-ms Handle ID: 0x484 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_syswow64_windowspowershell_v1.0_modules_provisioning_a90c2174ca14f6c9.cdf-ms Handle ID: 0x484 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_syswow64_windowspowershell_v1.0_modules_printmanagement_f8eb27b4decad438.cdf-ms Handle ID: 0x484 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_syswow64_windowspowershell_v1.0_modules_pki_85aea5cc702f95f6.cdf-ms Handle ID: 0x484 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_syswow64_windowspowershell_v1.0_modules_netconnection_0c47da6c3ce4e77d.cdf-ms Handle ID: 0x484 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_syswow64_windowspowershell_v1.0_modules_msdtc_71e80fac5e2c7ea5.cdf-ms Handle ID: 0x484 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_syswow64_windowspowershell_v1.0_modules_kds_85ae971a702fad0a.cdf-ms Handle ID: 0x484 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_syswow64_windowspowershell_v1.0_modules_iscsi_71e80fce5e287d67.cdf-ms Handle ID: 0x484 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_syswow64_windowspowershell_v1.0_modules_dism_71e7fa86c92d8a17.cdf-ms Handle ID: 0x484 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_syswow64_windowspowershell_v1.0_modules_configci_10d2a1a7f9d9bb92.cdf-ms Handle ID: 0x484 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_syswow64_windowspowershell_v1.0_modules_branchcache_dbfd5dc74f864408.cdf-ms Handle ID: 0x484 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_syswow64_windowspowershell_v1.0_modules_appx_71e80852c92d74cf.cdf-ms Handle ID: 0x484 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_syswow64_windowspowershell_v1.0_modules_appx_en_9673e43225933fd4.cdf-ms Handle ID: 0x484 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_syswow64_windowspowershell_v1.0_modules_appvclient_6909a212b041e3a8.cdf-ms Handle ID: 0x484 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_syswow64_wbem_1bf25d11bb30b33f.cdf-ms Handle ID: 0x484 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_syswow64_wbem_xml_3f8ffc24c43a2ff4.cdf-ms Handle ID: 0x484 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_syswow64_wbem_en-us_04f9ae10d0d40b09.cdf-ms Handle ID: 0x484 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_syswow64_tasks_bad86ed64cd79762.cdf-ms Handle ID: 0x484 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_syswow64_tasks_microsoft_200b1d7e84f3818e.cdf-ms Handle ID: 0x484 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_syswow64_tasks_microsoft_windows_4e7d28a223eef37f.cdf-ms Handle ID: 0x484 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_syswow64_tasks_microsoft_windows_wcm_7b761a76cb4c075c.cdf-ms Handle ID: 0x484 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_syswow64_tasks_microsoft_windows_synccenter_bb7e945a68c8139d.cdf-ms Handle ID: 0x484 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_syswow64_tasks_microsoft_windows_pla_7b760bd0cb4c1e90.cdf-ms Handle ID: 0x484 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_syswow64_tasks_microsoft_windows_pla_system_ef7b624670793a77.cdf-ms Handle ID: 0x484 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_syswow64_sru_1bf25359a7665016.cdf-ms Handle ID: 0x484 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_syswow64_spp_tokens_skus_csvlk-pack_a04c4b36b1c86210.cdf-ms Handle ID: 0x484 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_syswow64_spp_tokens_ppdlic_ee939189101570f7.cdf-ms Handle ID: 0x484 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_syswow64_spp_tokens_pkeyconfig_b2fdf59e46c165ae.cdf-ms Handle ID: 0x484 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_syswow64_speech_onecore_voiceactivation_64af56b9bf516892.cdf-ms Handle ID: 0x484 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_syswow64_speech_onecore_engines_tts_3ffb0757669d4b88.cdf-ms Handle ID: 0x484 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_syswow64_speech_onecore_engines_sr_d9a4a4f7ccdfa5ac.cdf-ms Handle ID: 0x484 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_syswow64_speech_onecore_common_3ac1627a1b848769.cdf-ms Handle ID: 0x484 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_syswow64_speech_common_b84a7a708e507091.cdf-ms Handle ID: 0x484 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_syswow64_setup_b8f1f0fc4fb15499.cdf-ms Handle ID: 0x484 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_syswow64_recovery_359f81e4d381fca3.cdf-ms Handle ID: 0x484 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_syswow64_rastoast_364fa07cd1b29d4f.cdf-ms Handle ID: 0x484 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_syswow64_networklist_fac29f16fb5be78a.cdf-ms Handle ID: 0x484 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_syswow64_networklist_icons_0ad2dfa4d19a0c98.cdf-ms Handle ID: 0x484 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_syswow64_networklist_icons_stockicons_3f4e81997d25c7f4.cdf-ms Handle ID: 0x72c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_syswow64_migration_bdcfa47e8790e0c4.cdf-ms Handle ID: 0x484 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_syswow64_licenses_neutral_volume_professional_81e94ea00d535798.cdf-ms Handle ID: 0x484 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_syswow64_licenses_neutral_oem_professional_4d95b036a354f599.cdf-ms Handle ID: 0x484 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_syswow64_licenses_neutral_oem_iotenterprisek_4682f0c22d2fe09e.cdf-ms Handle ID: 0x484 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_syswow64_licenses_neutral_oem_iotenterprise_fba6b9adfe0ed893.cdf-ms Handle ID: 0x484 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_syswow64_licenses_neutral_default_professional_2a2c080b72ab118c.cdf-ms Handle ID: 0x484 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_syswow64_licenses_neutral_default_iotenterprisek_ccbae5f06baa764f.cdf-ms Handle ID: 0x484 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_syswow64_keywords_287e3848e6b7ce36.cdf-ms Handle ID: 0x484 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_syswow64_installshield_b5853d7fd6c30e20.cdf-ms Handle ID: 0x484 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_syswow64_inputmethod_chs_5a48e65b9306b31f.cdf-ms Handle ID: 0x484 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_syswow64_ime_shared_19ff36aa43ebd16a.cdf-ms Handle ID: 0x484 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_syswow64_ime_shared_res_9e6764b48871dbf2.cdf-ms Handle ID: 0x484 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_syswow64_ime_imetc_0f296d620e0c52d5.cdf-ms Handle ID: 0x484 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_syswow64_ime_imetc_applets_4cc083d5c906ff5a.cdf-ms Handle ID: 0x484 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_syswow64_ime_imekr_0f2989dc0e0c2815.cdf-ms Handle ID: 0x484 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_syswow64_ime_imekr_dicts_ae54c41430477586.cdf-ms Handle ID: 0x484 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_syswow64_ime_imekr_applets_5286033abbf0349a.cdf-ms Handle ID: 0x484 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_syswow64_ime_imejp_0f2986100e0c2dc6.cdf-ms Handle ID: 0x484 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_syswow64_ime_imejp_applets_73e32571896671cb.cdf-ms Handle ID: 0x484 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_syswow64_grouppolicyusers_44ab3d75342e5a9d.cdf-ms Handle ID: 0x484 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_syswow64_grouppolicy_865e318ee53f8967.cdf-ms Handle ID: 0x484 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_syswow64_en-us_9e576ab077991fe8.cdf-ms Handle ID: 0x484 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_syswow64_en-us_licenses_45a768f9c2f8cd4a.cdf-ms Handle ID: 0x484 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_syswow64_en-us_licenses_volume_professional_6b00989273f6c8bd.cdf-ms Handle ID: 0x484 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_syswow64_en-us_licenses_oem_professional_e321c718711a7378.cdf-ms Handle ID: 0x484 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_syswow64_en-us_licenses_oem_iotenterprisek_6861755ad9e8901f.cdf-ms Handle ID: 0x484 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_syswow64_en-us_licenses_oem_iotenterprise_bf7f734bd73b94de.cdf-ms Handle ID: 0x484 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_syswow64_en-us_licenses_default_professional_607e4adef3241c51.cdf-ms Handle ID: 0x484 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_syswow64_en-us_licenses_default_iotenterprisek_15cb7fab919e92ba.cdf-ms Handle ID: 0x484 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_syswow64_en_b03edc160c0d9a6b.cdf-ms Handle ID: 0x484 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_syswow64_driverstore_9d5a0097549f0abb.cdf-ms Handle ID: 0x484 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_syswow64_drivers_193c6528ad70a5e7.cdf-ms Handle ID: 0x72c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_syswow64_dism_1bf2381fbb30eb13.cdf-ms Handle ID: 0x484 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_syswow64_dism_en-us_c5f337028c1b1b59.cdf-ms Handle ID: 0x484 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_syswow64_ddfs_1bf238b9bb30e9f9.cdf-ms Handle ID: 0x484 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_syswow64_config_397022e597c7bf30.cdf-ms Handle ID: 0x484 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_syswow64_config_systemprofile_936cc011f8712e92.cdf-ms Handle ID: 0x484 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_syswow64_config_systemprofile_appdata_09753eb0ca774ef7.cdf-ms Handle ID: 0x484 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_syswow64_config_systemprofile_appdata_roaming_3bee7e22f285c764.cdf-ms Handle ID: 0x484 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_syswow64_config_systemprofile_appdata_locallow_062ee28842850640.cdf-ms Handle ID: 0x484 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_syswow64_config_systemprofile_appdata_local_0bd41f8b89ae9a9e.cdf-ms Handle ID: 0x484 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_syswow64_catroot_19d09cfeaa84d098.cdf-ms Handle ID: 0x484 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_syswow64_catroot_f750e6c3-38ee-11d1-85e5-00c04fc295ee__ada83e5211e1e29e.cdf-ms Handle ID: 0x484 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_syswow64_applocker_9faecc9d3543428d.cdf-ms Handle ID: 0x484 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemresources_0307ca33e1cd9708.cdf-ms Handle ID: 0x484 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemresources_windows.ui.taskmanager_2461830fd03e5519.cdf-ms Handle ID: 0x484 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemresources_windows.ui.taskmanager_pris_19713808297400ab.cdf-ms Handle ID: 0x484 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemresources_windows.ui.shellcommoninetcore_ba4b0b6d658db81d.cdf-ms Handle ID: 0x484 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemresources_windows.ui.shellcommoninetcore_windowsinternal.xaml.controls.tabs_assets_fonts_49d106baa2d3d334.cdf-ms Handle ID: 0x484 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemresources_windows.ui.shellcommoninetcore_pris_6f2278267dd0fe11.cdf-ms Handle ID: 0x484 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemresources_windows.ui.shellcommon_0eb1b891774fd848.cdf-ms Handle ID: 0x484 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemresources_windows.ui.shellcommon_quickactions_assets_23631ec5c3a4623f.cdf-ms Handle ID: 0x484 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemresources_windows.ui.shellcommon_pris_ac5770c7358d5c72.cdf-ms Handle ID: 0x484 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemresources_windows.ui.shellcommon_networkux_assets_fonts_b2b933f3581daf2c.cdf-ms Handle ID: 0x484 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemresources_windows.ui.shellcommon_devicesflowui_fonts_f1a73aa6a3f2ec91.cdf-ms Handle ID: 0x72c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemresources_windows.ui.shellcommon_clockflyoutexperience_7ce6d31c57740cd3.cdf-ms Handle ID: 0x72c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemresources_windows.ui.shellcommon_clockflyoutexperience_assets_15857ed2e840b8f6.cdf-ms Handle ID: 0x484 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemresources_windows.ui.shellcommon_clockflyoutexperience_assets_fonts_3fa5855c97ee0980.cdf-ms Handle ID: 0x484 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemresources_windows.ui.shell_ed9cce24fb22aa2f.cdf-ms Handle ID: 0x484 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemresources_windows.ui.shell_images_7b0bb7853b1139af.cdf-ms Handle ID: 0x484 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemresources_windows.ui.settingshandlers-nt_7298028ee386990a.cdf-ms Handle ID: 0x484 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemresources_windows.ui.settingshandlers-nt_pris_71a69ceed5129daa.cdf-ms Handle ID: 0x484 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemresources_windows.ui.settingsappthreshold_0b97cbddb6bef8ee.cdf-ms Handle ID: 0x484 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemresources_windows.ui.settingsappthreshold_systemsettings_6f826ed139dc38ac.cdf-ms Handle ID: 0x484 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemresources_windows.ui.settingsappthreshold_systemsettings_assets_b04b2dbada91ba13.cdf-ms Handle ID: 0x484 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemresources_windows.ui.settingsappthreshold_systemsettings_assets_fonts_e1429b15bb7a603f.cdf-ms Handle ID: 0x484 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemresources_windows.ui.settingsappthreshold_pris_c69f4420e8b9ac96.cdf-ms Handle ID: 0x484 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemresources_windows.ui.settingsadminflowuithreshold_80571585edc0bc10.cdf-ms Handle ID: 0x484 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemresources_windows.ui.settingsadminflowuithreshold_systemsettingsthresholdadminflowui_a2baca8046478552.cdf-ms Handle ID: 0x484 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemresources_windows.ui.settingsadminflowuithreshold_systemsettingsthresholdadminflowui_assets_5ec4ff00d0d98653.cdf-ms Handle ID: 0x484 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemresources_windows.ui.settingsadminflowuithreshold_systemsettingsthresholdadminflowui_assets_45f5e040701cd097.cdf-ms Handle ID: 0x484 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemresources_windows.ui.settingsadminflowuithreshold_pris_8eb5d62ebc93ca12.cdf-ms Handle ID: 0x484 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemresources_windows.ui.search_ed9cc5a2b23bcffb.cdf-ms Handle ID: 0x72c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemresources_windows.ui.search_images_3ce3c49a17a92a93.cdf-ms Handle ID: 0x484 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemresources_windows.ui.pcshell_f32245a82a039128.cdf-ms Handle ID: 0x484 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemresources_windows.ui.pcshell_pris_d8fd09bd010ee720.cdf-ms Handle ID: 0x484 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemresources_windows.ui.pcshell_peoplepane_assets_1773a8a6e1ab2266.cdf-ms Handle ID: 0x484 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemresources_windows.ui.oobewv2host_06c3b2f4118c86b7.cdf-ms Handle ID: 0x484 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemresources_windows.ui.oobewv2host_assets_images_cdfe7282107fb89a.cdf-ms Handle ID: 0x484 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemresources_windows.ui.logon_ed8ece16fb61b4e6.cdf-ms Handle ID: 0x484 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemresources_windows.ui.cred_bcedbcd156367aa9.cdf-ms Handle ID: 0x484 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemresources_windows.ui.cred_pris_3a09dccabb9004ab.cdf-ms Handle ID: 0x484 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemresources_windows.ui.controlcenter_60de936f47068e7b.cdf-ms Handle ID: 0x484 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemresources_windows.ui.controlcenter_pris_6b5f1de826e9cab3.cdf-ms Handle ID: 0x484 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemresources_windows.ui.controlcenter_assets_39bcb5eb978f5428.cdf-ms Handle ID: 0x484 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemresources_windows.ui.controlcenter_assets_images_3fe992b989c3c280.cdf-ms Handle ID: 0x484 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemresources_windows.ui.blockedshutdown_d158b688ceb68e8d.cdf-ms Handle ID: 0x484 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemresources_windows.ui.biofeedback_43050837db14ffaa.cdf-ms Handle ID: 0x484 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemresources_windows.ui.biofeedback_fonts_95ff9f4f3fcf1508.cdf-ms Handle ID: 0x484 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemresources_windows.systemtoast.presencesensing.onlookerdetection_391ea9fde2f8c041.cdf-ms Handle ID: 0x484 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemresources_windows.systemtoast.presencesensing.onlookerdetection_images_24a7feceaa147037.cdf-ms Handle ID: 0x484 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemresources_windows.parentalcontrolssettings_17e5c3595e118a55.cdf-ms Handle ID: 0x484 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemresources_windows.parentalcontrolssettings_images_c0abb9832f16a4ad.cdf-ms Handle ID: 0x484 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemresources_windows.applicationmodel.lockscreen_d0e0107729c97a93.cdf-ms Handle ID: 0x484 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemresources_windows.applicationmodel.lockscreen_pris_de46d3c67a43a587.cdf-ms Handle ID: 0x484 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemresources_windows-nfc-semanagement_63ed886ef5f2afc3.cdf-ms Handle ID: 0x484 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemresources_smartactionplatform_42f27abecc9db058.cdf-ms Handle ID: 0x484 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemresources_shellcomponents.switcher_5e79548f3d2c4397.cdf-ms Handle ID: 0x484 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemresources_shellcomponents.switcher_pris_94c471057dd46b83.cdf-ms Handle ID: 0x484 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemresources_shellcomponents.desktophosting_fac22972d43496b0.cdf-ms Handle ID: 0x484 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemresources_shellcomponents.desktophosting_pris_fda1d3d84e751906.cdf-ms Handle ID: 0x484 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_windows.printdialog_cw5n1h2txyewy_31caf0ea0e44fba8.cdf-ms Handle ID: 0x484 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_windows.printdialog_cw5n1h2txyewy_pris_3221e587adefdb0e.cdf-ms Handle ID: 0x484 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_windows.printdialog_cw5n1h2txyewy_assets_121de4bdbbe4a709.cdf-ms Handle ID: 0x484 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_sxs_microsoftwindows.59379618.inpapp_cw5n1h2txyewy_c4b49295fdf6eced.cdf-ms Handle ID: 0x8ac Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_sxs_microsoftwindows.59379618.inpapp_cw5n1h2txyewy_windowsinternal.composableshell.exp_0312fbab12137384.cdf-ms Handle ID: 0x484 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_sxs_microsoftwindows.59379618.inpapp_cw5n1h2txyewy_textinput_dc4f3d24046bc2b8.cdf-ms Handle ID: 0x8ac Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_sxs_microsoftwindows.59379618.inpapp_cw5n1h2txyewy_pris_4d37b743740a8267.cdf-ms Handle ID: 0x72c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_sxs_microsoftwindows.59379618.inpapp_cw5n1h2txyewy_inputapp_be463155093c6462.cdf-ms Handle ID: 0x758 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_sxs_microsoftwindows.59379618.inpapp_cw5n1h2txyewy_inputapp_assets_e5f7c862920f890f.cdf-ms Handle ID: 0x484 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_sxs_microsoftwindows.59379618.inpapp_cw5n1h2txyewy_inputapp_assets_smartactions_e9b69bf4e6ede3e9.cdf-ms Handle ID: 0x758 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_sxs_microsoftwindows.59379618.inpapp_cw5n1h2txyewy_inputapp_assets_fonts_cb8e0640fa6c8563.cdf-ms Handle ID: 0x484 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_sxs_microsoftwindows.59379618.inpapp_cw5n1h2txyewy_inputapp_assets_dictation_44631ba5d0c8dc8e.cdf-ms Handle ID: 0x758 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_sxs_microsoftwindows.59379618.inpapp_cw5n1h2txyewy_assets_5d5343229c95e9be.cdf-ms Handle ID: 0x484 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_sxs_microsoftwindows.59337133.voiess_cw5n1h2txyewy_ea39d14f8afe9c2a.cdf-ms Handle ID: 0x758 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_sxs_microsoftwindows.59337133.voiess_cw5n1h2txyewy_voiceaccesshost_96ea623ef27e10e0.cdf-ms Handle ID: 0x484 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_sxs_microsoftwindows.59337133.voiess_cw5n1h2txyewy_voiceaccesshost_strings_c62de8c0f42d3f1c.cdf-ms Handle ID: 0x758 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_sxs_microsoftwindows.59337133.voiess_cw5n1h2txyewy_voiceaccesshost_strings_zh-hk_140cb8c67edd61e4.cdf-ms Handle ID: 0x484 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_sxs_microsoftwindows.59337133.voiess_cw5n1h2txyewy_voiceaccesshost_strings_fr-fr_16dd65427887dac7.cdf-ms Handle ID: 0x758 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_sxs_microsoftwindows.59337133.voiess_cw5n1h2txyewy_voiceaccesshost_strings_fr-ca_16dd61f47887ddf1.cdf-ms Handle ID: 0x484 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_sxs_microsoftwindows.59337133.voiess_cw5n1h2txyewy_voiceaccesshost_strings_es-mx_17017a927836b4c6.cdf-ms Handle ID: 0x758 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_sxs_microsoftwindows.59337133.voiess_cw5n1h2txyewy_voiceaccesshost_strings_es-es_17016c167836c9f9.cdf-ms Handle ID: 0x484 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_sxs_microsoftwindows.59337133.voiess_cw5n1h2txyewy_voiceaccesshost_strings_en-us_17018a6c78369c96.cdf-ms Handle ID: 0x758 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_sxs_microsoftwindows.59337133.voiess_cw5n1h2txyewy_voiceaccesshost_strings_de-de_172574e877e5b4f3.cdf-ms Handle ID: 0x484 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_sxs_microsoftwindows.59337133.voiess_cw5n1h2txyewy_voiceaccesscommon_aea724f70a24c5af.cdf-ms Handle ID: 0x758 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_sxs_microsoftwindows.59337133.voiess_cw5n1h2txyewy_voiceaccess_d648da995bd75880.cdf-ms Handle ID: 0x484 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_sxs_microsoftwindows.59337133.voiess_cw5n1h2txyewy_voiceaccess_masmodels_a0684a62ecfdee41.cdf-ms Handle ID: 0x758 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_sxs_microsoftwindows.59337133.voiess_cw5n1h2txyewy_pris_9cdd8b0d969f183c.cdf-ms Handle ID: 0x938 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_sxs_microsoftwindows.59337133.voiess_cw5n1h2txyewy_intentdefinitions_2d352d32c28a75cc.cdf-ms Handle ID: 0x758 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_sxs_microsoftwindows.59337133.voiess_cw5n1h2txyewy_intentdefinitions_strings_c1b7db0446b36b08.cdf-ms Handle ID: 0x938 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_sxs_microsoftwindows.59337133.voiess_cw5n1h2txyewy_intentdefinitions_strings_hi-in_e625e8aec4342ffb.cdf-ms Handle ID: 0x758 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_sxs_microsoftwindows.59337133.voiess_cw5n1h2txyewy_intentdefinitions_strings_fr-fr_e625f9bec43215fb.cdf-ms Handle ID: 0x938 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_sxs_microsoftwindows.59337133.voiess_cw5n1h2txyewy_intentdefinitions_strings_fr-ca_e625f9b8c4321605.cdf-ms Handle ID: 0x758 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_sxs_microsoftwindows.59337133.voiess_cw5n1h2txyewy_intentdefinitions_strings_es-mx_e625fbb2c43112aa.cdf-ms Handle ID: 0x938 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_sxs_microsoftwindows.59337133.voiess_cw5n1h2txyewy_intentdefinitions_strings_es-es_e625fba2c43112ed.cdf-ms Handle ID: 0x758 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_sxs_microsoftwindows.59337133.voiess_cw5n1h2txyewy_intentdefinitions_strings_en-us_e625f244c431209a.cdf-ms Handle ID: 0x938 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_sxs_microsoftwindows.59337133.voiess_cw5n1h2txyewy_intentdefinitions_strings_en-gb_e625f228c4312107.cdf-ms Handle ID: 0x10f8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_sxs_microsoftwindows.59337133.voiess_cw5n1h2txyewy_intentdefinitions_strings_de-de_e625e10cc4303a87.cdf-ms Handle ID: 0x758 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_sxs_microsoftwindows.59337133.voiess_cw5n1h2txyewy_freuserinterface_18a14d8ee3690cd1.cdf-ms Handle ID: 0x10f8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_sxs_microsoftwindows.59337133.voiess_cw5n1h2txyewy_freuserinterface_assets_d249519a35019168.cdf-ms Handle ID: 0x758 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_sxs_microsoftwindows.59337133.voiess_cw5n1h2txyewy_freuserinterface_assets_content_529ce76a6b00a461.cdf-ms Handle ID: 0x10f8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_sxs_microsoftwindows.59337133.voiess_cw5n1h2txyewy_freuserinterface_assets_content_zh-_f259484c94e2b689.cdf-ms Handle ID: 0x758 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_sxs_microsoftwindows.59337133.voiess_cw5n1h2txyewy_freuserinterface_assets_content_zh-_f259333494e2d4e9.cdf-ms Handle ID: 0x10f8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_sxs_microsoftwindows.59337133.voiess_cw5n1h2txyewy_freuserinterface_assets_content_zh-_f259294a94e2e419.cdf-ms Handle ID: 0x758 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_sxs_microsoftwindows.59337133.voiess_cw5n1h2txyewy_freuserinterface_assets_content_ja-_f499c3fe8fd1921b.cdf-ms Handle ID: 0x10f8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_sxs_microsoftwindows.59337133.voiess_cw5n1h2txyewy_freuserinterface_assets_content_hi-_f4e1d4288f2f6c2c.cdf-ms Handle ID: 0x758 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_sxs_microsoftwindows.59337133.voiess_cw5n1h2txyewy_freuserinterface_assets_content_fr-_f529dfb08e8d4dcc.cdf-ms Handle ID: 0x10f8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_sxs_microsoftwindows.59337133.voiess_cw5n1h2txyewy_freuserinterface_assets_content_fr-_f529dc628e8d50f6.cdf-ms Handle ID: 0x758 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_sxs_microsoftwindows.59337133.voiess_cw5n1h2txyewy_freuserinterface_assets_content_es-_f54df5008e3c27cb.cdf-ms Handle ID: 0x10f8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_sxs_microsoftwindows.59337133.voiess_cw5n1h2txyewy_freuserinterface_assets_content_es-_f54de6848e3c3cfe.cdf-ms Handle ID: 0x758 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_sxs_microsoftwindows.59337133.voiess_cw5n1h2txyewy_freuserinterface_assets_content_en-_f54e04da8e3c0f9b.cdf-ms Handle ID: 0x10f8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_sxs_microsoftwindows.59337133.voiess_cw5n1h2txyewy_freuserinterface_assets_content_en-_f54decaa8e3c3218.cdf-ms Handle ID: 0x758 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_sxs_microsoftwindows.59337133.voiess_cw5n1h2txyewy_freuserinterface_assets_content_de-_f571ef568deb27f8.cdf-ms Handle ID: 0x10f8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_sxs_microsoftwindows.59337133.voiess_cw5n1h2txyewy_assets_5815a194c0d5adf7.cdf-ms Handle ID: 0x758 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_sxs_microsoftwindows.59336768.speion_cw5n1h2txyewy_e0f47d04bc43606e.cdf-ms Handle ID: 0x10f8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_sxs_microsoftwindows.59336768.speion_cw5n1h2txyewy_speechsynthesizer_8fc08c5cc4303036.cdf-ms Handle ID: 0x758 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_sxs_microsoftwindows.59336768.speion_cw5n1h2txyewy_pris_e708263da0bdccb2.cdf-ms Handle ID: 0x10f8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_sxs_microsoftwindows.59336768.speion_cw5n1h2txyewy_assets_072acb4c65826775.cdf-ms Handle ID: 0x758 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_sxs_microsoftwindows.58683691.inpapp_cw5n1h2txyewy_59124f8b31b69b23.cdf-ms Handle ID: 0x758 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_sxs_microsoftwindows.58683691.inpapp_cw5n1h2txyewy_windowsinternal.composableshell.exp_255e6746064c0d48.cdf-ms Handle ID: 0x938 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_sxs_microsoftwindows.58683691.inpapp_cw5n1h2txyewy_textinput_9f46887175d6d866.cdf-ms Handle ID: 0x758 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_sxs_microsoftwindows.58683691.inpapp_cw5n1h2txyewy_pris_5e600bcca55749a3.cdf-ms Handle ID: 0x938 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_sxs_microsoftwindows.58683691.inpapp_cw5n1h2txyewy_inputapp_4c091101f25d6c26.cdf-ms Handle ID: 0x758 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_sxs_microsoftwindows.58683691.inpapp_cw5n1h2txyewy_inputapp_assets_704368cba33d4145.cdf-ms Handle ID: 0x938 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_sxs_microsoftwindows.58683691.inpapp_cw5n1h2txyewy_inputapp_assets_smartactions_dd04509cf7b01125.cdf-ms Handle ID: 0x758 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_sxs_microsoftwindows.58683691.inpapp_cw5n1h2txyewy_inputapp_assets_fonts_f6918ada38031235.cdf-ms Handle ID: 0x938 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_sxs_microsoftwindows.58683691.inpapp_cw5n1h2txyewy_inputapp_assets_dictation_5f7ee71d85a7843c.cdf-ms Handle ID: 0x10f8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_sxs_microsoftwindows.58683691.inpapp_cw5n1h2txyewy_assets_d2ec30e3ca262680.cdf-ms Handle ID: 0x874 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_sxs_microsoftwindows.58681560.livtop_cw5n1h2txyewy_e4be0154e0864f96.cdf-ms Handle ID: 0x10f8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_sxs_microsoftwindows.58681560.livtop_cw5n1h2txyewy_pris_c21a099760af4d36.cdf-ms Handle ID: 0x498 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_sxs_microsoftwindows.58681560.livtop_cw5n1h2txyewy_livecaptions_647494c152ab42ed.cdf-ms Handle ID: 0x758 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_sxs_microsoftwindows.58681560.livtop_cw5n1h2txyewy_assets_0d1cf7c7fd286e11.cdf-ms Handle ID: 0x758 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_sxs_microsoftwindows.58681517.voiess_cw5n1h2txyewy_a72a93cb539bc1ed.cdf-ms Handle ID: 0x874 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_sxs_microsoftwindows.58681517.voiess_cw5n1h2txyewy_voiceaccesshost_a04554f3e4e293a3.cdf-ms Handle ID: 0x758 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_sxs_microsoftwindows.58681517.voiess_cw5n1h2txyewy_voiceaccesshost_strings_d1abf37f5876905f.cdf-ms Handle ID: 0x874 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_sxs_microsoftwindows.58681517.voiess_cw5n1h2txyewy_voiceaccesshost_strings_zh-hk_33164f9bf1ad7a85.cdf-ms Handle ID: 0x758 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_sxs_microsoftwindows.58681517.voiess_cw5n1h2txyewy_voiceaccesshost_strings_fr-fr_35e6fc17eb57f368.cdf-ms Handle ID: 0x938 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_sxs_microsoftwindows.58681517.voiess_cw5n1h2txyewy_voiceaccesshost_strings_fr-ca_35e6f8c9eb57f692.cdf-ms Handle ID: 0x758 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_sxs_microsoftwindows.58681517.voiess_cw5n1h2txyewy_voiceaccesshost_strings_es-mx_360b1167eb06cd67.cdf-ms Handle ID: 0x938 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_sxs_microsoftwindows.58681517.voiess_cw5n1h2txyewy_voiceaccesshost_strings_es-es_360b02ebeb06e29a.cdf-ms Handle ID: 0x758 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_sxs_microsoftwindows.58681517.voiess_cw5n1h2txyewy_voiceaccesshost_strings_en-us_360b2141eb06b537.cdf-ms Handle ID: 0x938 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_sxs_microsoftwindows.58681517.voiess_cw5n1h2txyewy_voiceaccesshost_strings_de-de_362f0bbdeab5cd94.cdf-ms Handle ID: 0x758 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_sxs_microsoftwindows.58681517.voiess_cw5n1h2txyewy_voiceaccesscommon_c4ad180fdcfad44e.cdf-ms Handle ID: 0x938 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_sxs_microsoftwindows.58681517.voiess_cw5n1h2txyewy_voiceaccess_4be3f13485d6f4fd.cdf-ms Handle ID: 0x758 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_sxs_microsoftwindows.58681517.voiess_cw5n1h2txyewy_voiceaccess_masmodels_fd92c49fde4a8762.cdf-ms Handle ID: 0x498 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_sxs_microsoftwindows.58681517.voiess_cw5n1h2txyewy_pris_a90115a2ed715cf3.cdf-ms Handle ID: 0x938 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_sxs_microsoftwindows.58681517.voiess_cw5n1h2txyewy_intentdefinitions_433b1d729560846b.cdf-ms Handle ID: 0x498 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_sxs_microsoftwindows.58681517.voiess_cw5n1h2txyewy_intentdefinitions_strings_2a7833b341ae1a27.cdf-ms Handle ID: 0x938 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_sxs_microsoftwindows.58681517.voiess_cw5n1h2txyewy_intentdefinitions_strings_hi-in_e3bb0b2f97e30fbe.cdf-ms Handle ID: 0x498 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_sxs_microsoftwindows.58681517.voiess_cw5n1h2txyewy_intentdefinitions_strings_fr-fr_e3bb1c3f97e0f5be.cdf-ms Handle ID: 0x938 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_sxs_microsoftwindows.58681517.voiess_cw5n1h2txyewy_intentdefinitions_strings_fr-ca_e3bb1c3997e0f5c8.cdf-ms Handle ID: 0x498 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_sxs_microsoftwindows.58681517.voiess_cw5n1h2txyewy_intentdefinitions_strings_es-mx_e3bb1e3397dff26d.cdf-ms Handle ID: 0x938 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_sxs_microsoftwindows.58681517.voiess_cw5n1h2txyewy_intentdefinitions_strings_es-es_e3bb1e2397dff2b0.cdf-ms Handle ID: 0x498 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_sxs_microsoftwindows.58681517.voiess_cw5n1h2txyewy_intentdefinitions_strings_en-us_e3bb14c597e0005d.cdf-ms Handle ID: 0x874 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_sxs_microsoftwindows.58681517.voiess_cw5n1h2txyewy_intentdefinitions_strings_en-gb_e3bb14a997e000ca.cdf-ms Handle ID: 0x938 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_sxs_microsoftwindows.58681517.voiess_cw5n1h2txyewy_intentdefinitions_strings_de-de_e3bb038d97df1a4a.cdf-ms Handle ID: 0x874 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_sxs_microsoftwindows.58681517.voiess_cw5n1h2txyewy_freuserinterface_733f493b5be9015a.cdf-ms Handle ID: 0x938 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_sxs_microsoftwindows.58681517.voiess_cw5n1h2txyewy_freuserinterface_assets_ddc75f31994ae2ab.cdf-ms Handle ID: 0x874 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_sxs_microsoftwindows.58681517.voiess_cw5n1h2txyewy_freuserinterface_assets_content_50320cba3eaf8424.cdf-ms Handle ID: 0x938 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_sxs_microsoftwindows.58681517.voiess_cw5n1h2txyewy_freuserinterface_assets_content_zh-_a154f7d0c06e8eaa.cdf-ms Handle ID: 0x874 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_sxs_microsoftwindows.58681517.voiess_cw5n1h2txyewy_freuserinterface_assets_content_zh-_a154e2b8c06ead0a.cdf-ms Handle ID: 0x938 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_sxs_microsoftwindows.58681517.voiess_cw5n1h2txyewy_freuserinterface_assets_content_zh-_a154d8cec06ebc3a.cdf-ms Handle ID: 0x874 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_sxs_microsoftwindows.58681517.voiess_cw5n1h2txyewy_freuserinterface_assets_content_ja-_a3957382bb5d6a3c.cdf-ms Handle ID: 0x938 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_sxs_microsoftwindows.58681517.voiess_cw5n1h2txyewy_freuserinterface_assets_content_hi-_a3dd83acbabb444d.cdf-ms Handle ID: 0x874 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_sxs_microsoftwindows.58681517.voiess_cw5n1h2txyewy_freuserinterface_assets_content_fr-_a4258f34ba1925ed.cdf-ms Handle ID: 0x938 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_sxs_microsoftwindows.58681517.voiess_cw5n1h2txyewy_freuserinterface_assets_content_fr-_a4258be6ba192917.cdf-ms Handle ID: 0x874 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_sxs_microsoftwindows.58681517.voiess_cw5n1h2txyewy_freuserinterface_assets_content_es-_a449a484b9c7ffec.cdf-ms Handle ID: 0x938 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_sxs_microsoftwindows.58681517.voiess_cw5n1h2txyewy_freuserinterface_assets_content_es-_a4499608b9c8151f.cdf-ms Handle ID: 0x874 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_sxs_microsoftwindows.58681517.voiess_cw5n1h2txyewy_freuserinterface_assets_content_en-_a449b45eb9c7e7bc.cdf-ms Handle ID: 0x938 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_sxs_microsoftwindows.58681517.voiess_cw5n1h2txyewy_freuserinterface_assets_content_en-_a4499c2eb9c80a39.cdf-ms Handle ID: 0x874 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_sxs_microsoftwindows.58681517.voiess_cw5n1h2txyewy_freuserinterface_assets_content_de-_a46d9edab9770019.cdf-ms Handle ID: 0x938 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_sxs_microsoftwindows.58681517.voiess_cw5n1h2txyewy_assets_09417e41c3666bc6.cdf-ms Handle ID: 0x874 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_sxs_microsoftwindows.58680125.speion_cw5n1h2txyewy_b16d1f4f5d8026da.cdf-ms Handle ID: 0x498 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_sxs_microsoftwindows.58680125.speion_cw5n1h2txyewy_speechsynthesizer_11244c8ae9fa0c2e.cdf-ms Handle ID: 0x874 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_sxs_microsoftwindows.58680125.speion_cw5n1h2txyewy_pris_b4fb5205cad56e8c.cdf-ms Handle ID: 0x498 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_sxs_microsoftwindows.58680125.speion_cw5n1h2txyewy_assets_e66e8554fe1b016d.cdf-ms Handle ID: 0x874 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_sxs_microsoftwindows.54792954.filons_cw5n1h2txyewy_59f86e567df83ffb.cdf-ms Handle ID: 0x874 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_sxs_microsoftwindows.54792954.filons_cw5n1h2txyewy_pris_2f8f565556ca0fdb.cdf-ms Handle ID: 0x874 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_sxs_microsoftwindows.54792954.filons_cw5n1h2txyewy_fileexplorerextensions_9bb41cdb40c11116.cdf-ms Handle ID: 0x874 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_sxs_microsoftwindows.54792954.filons_cw5n1h2txyewy_fileexplorerextensions_assets_f78cf5e52bf34ed7.cdf-ms Handle ID: 0x10f8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_sxs_microsoftwindows.54792954.filons_cw5n1h2txyewy_fileexplorerextensions_assets_image_cd7a1ba4cfbbbd77.cdf-ms Handle ID: 0x874 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_sxs_microsoftwindows.54792954.filons_cw5n1h2txyewy_fileexplorerextensions_assets_image_1768686e27b4f9a9.cdf-ms Handle ID: 0x874 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_sxs_microsoftwindows.54792954.filons_cw5n1h2txyewy_fileexplorerextensions_assets_image_436e1ce3e8f3d4f1.cdf-ms Handle ID: 0x874 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_sxs_microsoftwindows.54792954.filons_cw5n1h2txyewy_fileexplorerextensions_assets_image_f9afdc395f871e9f.cdf-ms Handle ID: 0x874 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_sxs_microsoftwindows.54792954.filons_cw5n1h2txyewy_fileexplorerextensions_assets_image_fdeb5ac74c7ba2cb.cdf-ms Handle ID: 0x874 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_sxs_microsoftwindows.54792954.filons_cw5n1h2txyewy_fileexplorerextensions_assets_image_17687104279fe731.cdf-ms Handle ID: 0x874 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_sxs_microsoftwindows.54792954.filons_cw5n1h2txyewy_assets_9e46375fe24f31fe.cdf-ms Handle ID: 0x874 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_shellexperiencehost_cw5n1h2txyewy_e21c90d9487ed242.cdf-ms Handle ID: 0x874 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_shellexperiencehost_cw5n1h2txyewy_sharepickerui_assets_web_imageeditor_2ed9e23d5ff96068.cdf-ms Handle ID: 0x874 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_shellexperiencehost_cw5n1h2txyewy_sharepickerui_assets_web_imageeditor_static_media_db766d5d4281151e.cdf-ms Handle ID: 0x874 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_shellexperiencehost_cw5n1h2txyewy_sharepickerui_assets_web_imageeditor_static_js_4c6472140753501d.cdf-ms Handle ID: 0x874 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_shellexperiencehost_cw5n1h2txyewy_sharepickerui_assets_web_imageeditor_static_css_9e85678695bed7b5.cdf-ms Handle ID: 0x874 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_shellexperiencehost_cw5n1h2txyewy_pris_3818bc2422f945c8.cdf-ms Handle ID: 0x874 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_shellexperiencehost_cw5n1h2txyewy_assets_7b05f0549cbec22d.cdf-ms Handle ID: 0x874 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_shared_1ca53b1028d383f2.cdf-ms Handle ID: 0x874 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_shared_zip.scale-400_65eb0219cfd576899c9ef71c9ad7b8bb79cb05beb39892306ab6a70f39d31991_93e0e30625517267.cdf-ms Handle ID: 0x874 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_shared_zip.scale-400_3ec2144c2a24ea852b9eaa6957727ec2661172b5a5929eb4aa8cfd4801a914df_d541a7f60942071c.cdf-ms Handle ID: 0x874 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_shared_zip.scale-200_fffed156ee0e35f845cc691cc404967642d8ec4d638fc1eb1a0d17648bf07016_ca78fe146b4eb85d.cdf-ms Handle ID: 0x874 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_shared_zip.scale-200_acc2ff522ccd3fc9794ae522bbca2e550b1dcb7df960e47794c13b5d4f587b7b_7d73e35fb00a5504.cdf-ms Handle ID: 0x874 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_shared_zip.scale-100_de1538796dd06cb56522ee6f06dd13a3e9504175adc7fa638de256179b0cc679_987cce497ba33390.cdf-ms Handle ID: 0x874 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_shared_zip.scale-100_602b4c46076b33750a0ca30fe5cfe1255181b6ade8b1ce1e5ef9fcf83b03fe3c_45960be81dc5c892.cdf-ms Handle ID: 0x874 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_shared_zip_fe2e83d050a14dad1b9a25e4a91ffebd8a3b914db16eba116a61c768c37ff8a2_bcf4069d0c514b2c.cdf-ms Handle ID: 0x874 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_shared_zip_de13545881b030521cca73d912d1a941f057ce41f5b44d231a76ff05db0c6687_cdd054a5e784c022.cdf-ms Handle ID: 0x874 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_shared_xsn.scale-400_e136d12fca587a13d1eb782d8b57b6bdcfa3049d043152e7eb7330a440804c0f_284f7ce65fba6059.cdf-ms Handle ID: 0x10f8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_shared_xsn.scale-400_70413e48d79776d8e53b9e06c172516caf1a85b0bc11a4b522e5bce872b51ebc_0b417c83a26f53f5.cdf-ms Handle ID: 0x874 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_shared_xsn.scale-200_fa04292cbe6e1fd62988aba07ae314a81315087b5c137dc494060fd2c38401f6_410902aaed922b4a.cdf-ms Handle ID: 0x874 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_shared_xsn.scale-200_50db257f607a99f139e4504ec93ade000d3e140ca5e5713007c8b37258d3fa98_d2198c94ef858de7.cdf-ms Handle ID: 0x874 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_shared_xsn.scale-100_7e0ab0e2989b5a4f8a50c86848e6e194ca960574da0feaec63ff5e50e9fc2110_824d6c70beb4c0ad.cdf-ms Handle ID: 0x874 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_shared_xsn.scale-100_0a4fefabb4c75ed950c301e17097eb86dfee851354b20df99adb3647d5b2221d_8573495684740392.cdf-ms Handle ID: 0x874 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_shared_xsn_92ee60c3f8d54ff4618fd7c0da6a44a42e67ebff6e195fa5a4deeeb085af7383_087ba7393a5df75f.cdf-ms Handle ID: 0x874 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_shared_xsn_3ec3cd7a0eeed8de9e6f40e25c67810dd7ffbfd46f3294f31a3c6f6285d23af6_6a07e5e2dd712fe0.cdf-ms Handle ID: 0x874 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_shared_xml.scale-400_b85647b8ed191ce9e2e166384345746136199f8017f561f185236665fdbb0f1f_d50d86b6288a93b2.cdf-ms Handle ID: 0x874 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_shared_xml.scale-400_50a959c42843ee7cac08f9bb72d2f8c3f0a5b9d95a61fe5a7d8755d92b40642b_9ed58f4f6dc61748.cdf-ms Handle ID: 0x874 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_shared_xml.scale-200_6fdc080a5c21f89ae8e9038684be0767b11b8b3a782d10f298a4b5d5adad7858_ccac8d3d6acddc04.cdf-ms Handle ID: 0x874 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_shared_xml.scale-200_3a702a3197a60c9e470f345302437896a8cffc311b89960030d6284f25b09eb3_a7fa7ca415534c20.cdf-ms Handle ID: 0x874 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_shared_xml.scale-100_f7179920cbf2eca6383d338b912f6d4b80ba3bc6bed6dfbde00e87e779ed0d60_f83f915cde256472.cdf-ms Handle ID: 0x874 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_shared_xml.scale-100_8de96c87c84f99bbc1a984503c797614b3bbcebb683f4c95d7abc090a797c220_d5c14f3003395ddf.cdf-ms Handle ID: 0x874 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_shared_xml_fbc6c830edb26fc579e756911c3130fb1340dc001f70302ddb0c41b1c9bbb727_704dc858d33f865c.cdf-ms Handle ID: 0x874 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_shared_xml_7603dc984131b488a7f2b55fb5ddcae04090181c191c1bdd147c1c9005a1fc7c_7505d8443a45e7f3.cdf-ms Handle ID: 0x874 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_shared_xltx.scale-400_42d0aab6e9204c9907ce76f00c5ecd356d02a014c8888610d8c5e1b4277d252b_a1c2409f8f677283.cdf-ms Handle ID: 0x874 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_shared_xltx.scale-400_03fc13f9ab21229d3355e568ead7de2a12cc557bd58c9454786003adfad4ed29_d41ac666bbd42852.cdf-ms Handle ID: 0x874 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_shared_xltx.scale-200_57836a46385b38a80032b7267cd54a80c50d8740fb4df439bbf982cf7c914e76_d526fcff9fc4703a.cdf-ms Handle ID: 0x874 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_shared_xltx.scale-200_4b561749c83ef860a71a4d486599a1a81278f45feec351a65d6854b6584e40d0_0c06c6a2347ebd36.cdf-ms Handle ID: 0x874 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_shared_xltx.scale-100_d907b436d6c0ada56079841e97576a14fe31f660b3b74be9f9a5f9e313b9aadf_98f86d3140ad67b3.cdf-ms Handle ID: 0x874 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_shared_xltx.scale-100_606c43633a2fc7376ac5d9e0a665069efbd0ee4db36a600605aedb5e3b2e8f5d_5579cd86fc95dcd4.cdf-ms Handle ID: 0x498 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_shared_xltx_f2bc0f4c2ea0ced935f8b4e8b89007a3946dfb9d419dc728596607141602e60d_98ede37121f95540.cdf-ms Handle ID: 0x498 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_shared_xltx_f2306b97cf131c32e9ce65dfddea4dfdda0325d7a3d5696ec181f4a91bee3a37_6603f339efeb15d1.cdf-ms Handle ID: 0x498 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_shared_xlsx.scale-400_5d2d0d040d97bbcc7276bf77a5849e5973fdc8d717c971c8da38b9170aee1730_2e548468bea1ac8f.cdf-ms Handle ID: 0x498 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_shared_xlsx.scale-400_5656776c1585f7b18af16060639d2ff5e88934bd8d2768883952a427ab2e81e8_3be2c20af91fee84.cdf-ms Handle ID: 0x498 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_shared_xlsx.scale-200_a8e01a9926c84ca73c6c8e14a9c76b5906e4824e7826f511a5e070909b4f488c_7e4ccad045e9e642.cdf-ms Handle ID: 0x498 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_shared_xlsx.scale-200_679bfa4e72f6a916d060ec16d5e804c53c1620463e14ab7cf48dbd4cd2bf45cb_70697a4bd0dff767.cdf-ms Handle ID: 0x498 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_shared_xlsx.scale-100_c9c2b3646cd8c6727b4dd2445b61e4d3d57b5884dbeaf39f91bcdaaf3ffdb96c_945ec8a6a5941e4c.cdf-ms Handle ID: 0x498 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_shared_xlsx.scale-100_b920d247acaeb50a2f998c5106cb0f2080ff73ef987d2850fd541f3273da5022_9476c19b17b38df4.cdf-ms Handle ID: 0x498 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_shared_xlsx_26eb5efcbd72204a745c0e4cf12395b18b14aa09485cb58186cce40489d18222_bcab1c4acd09e832.cdf-ms Handle ID: 0x498 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_shared_xlsx_16e58b49c2f7e573467fd85cab9accffd3cdf8ecf1be0f2003ad0038e5f3b6ff_fec7b8156c5fe333.cdf-ms Handle ID: 0x498 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_shared_whiteboard.scale-400_3acdd49fa97f92d1918418bf94e2f9b1e2fa4e0d59eedb1748537df84e_2caf19bd3f2c27bc.cdf-ms Handle ID: 0x498 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_shared_whiteboard.scale-400_34a3bd809858a5ec6f7ec4d2e568f19e35fa252ed3b676c0729b4df834_d8ce893fe7e8f8c5.cdf-ms Handle ID: 0x498 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_shared_whiteboard.scale-200_5c42adeae60aa590230c7384c96f88a3607dc9d7d9195d400ee33d19e4_192267f86b414cec.cdf-ms Handle ID: 0x498 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_shared_whiteboard.scale-200_3d7ad478ca02ee15fa115437fb69efffccfe343774c681b4fd8583cba5_eb2243d9cf1347f5.cdf-ms Handle ID: 0x498 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_shared_whiteboard.scale-100_b862b286f8b47184b79bb39a6c76d99d4eefd463f80eaf5823d8abb0fc_01b2366064ecdb86.cdf-ms Handle ID: 0x498 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_shared_whiteboard.scale-100_45735905279926c8e4fffeddb78c7e3f87544ecf34ea6c29b03982e913_eaf8b5781734c479.cdf-ms Handle ID: 0x498 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_shared_whiteboard_8b9362e337d020c98bc102d63baa8512533faa94ec7b32b72913bcbda28e67b6_5c6c109040abab50.cdf-ms Handle ID: 0x498 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_shared_whiteboard_64d6b9e04aa413f5e15ae5ba552132e27fdd289cd5243ec6341adf07a88fe5cf_c1b29d484a72ff1d.cdf-ms Handle ID: 0x498 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_shared_webview2sdk_65d2e94a7880e5d9.cdf-ms Handle ID: 0x498 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_shared_vstx.scale-400_ca57badc8d61b00393a2877f4a59a29bf1163cc64e45a4b5057e54cd2f2d5f76_bbf710be4f9876ac.cdf-ms Handle ID: 0x498 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_shared_vstx.scale-400_038b5f5ee8bfec2b7f1ec754c8e7108fb6d11d7bb8d497f7000ff8aa3ea98737_215383ea0434752e.cdf-ms Handle ID: 0x498 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_shared_vstx.scale-200_b9d2c90819673ab0fbe2986b1ca7169986d9070cec2ec2d6007e0273692543c9_453f37d167649f45.cdf-ms Handle ID: 0x498 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_shared_vstx.scale-200_58d54ad3aa1626cb6b5fead07627851998beb0b42a869dee4256e66f4dfb11e1_6aa13e7be64bd43c.cdf-ms Handle ID: 0x498 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_shared_vstx.scale-100_933ee2fae23c5946f59d70e9b9a1770f438d0882ccba9ad7d2485024b088742a_54ca678bd38ee2e8.cdf-ms Handle ID: 0x498 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_shared_vstx.scale-100_48a1a4b7ec5163d0db1ffbc8ea87f4ff9c0f9c0fb0964696cba2b8add7c17a47_ed2fe66567b85b0a.cdf-ms Handle ID: 0x498 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_shared_vstx_6361d9cd264ffce02cd38243042ed9a4bec9e63861063f35feac63f1c60d3d10_84a3ebd824140150.cdf-ms Handle ID: 0x498 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_shared_vstx_0af9673ee76dc19a50d9a6eb261004cd616dafcc1a6c4689c43c54b879dfeab8_1b04b88164172b0a.cdf-ms Handle ID: 0x498 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_shared_vssx.scale-400_afe1ffd71aa21deedd485d8601de28c350abfa5ced0641e183acc52066da6888_5c19e7af81c9fcc5.cdf-ms Handle ID: 0x498 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_shared_vssx.scale-400_4942fe4d711a0cc83e637b76a054627393564ad074238cda2c29c804a7f8964e_7d30817363a69889.cdf-ms Handle ID: 0x498 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_shared_vssx.scale-200_4cc54713f69f2f28213ed50cd1a2dc6b8f7b7140f14afadd63b686af6912cced_387247354c69264b.cdf-ms Handle ID: 0x874 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_shared_vssx.scale-200_0028fa825bf33bc93bfedcf06e68179e1e1149d1fdd39907c2c62d8d4d6b80c0_7577706edfbd6d98.cdf-ms Handle ID: 0x498 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_shared_vssx.scale-100_eb932e0748f8d61016618a3f9fbb820b8ce57e1d8e741533246156b04d2a4dda_11a215557166d5cf.cdf-ms Handle ID: 0x498 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_shared_vssx.scale-100_5be7f7cda067d833f7cc72c11de632835c8536bf901082e85d505fd4edd62baf_a319ea22e7db9cc9.cdf-ms Handle ID: 0x498 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_shared_vssx_ed314ae472e90c06f0072291879b700c9ae38aa881e49b84fb13350b6d50ece0_5c61dbaca0edf6e5.cdf-ms Handle ID: 0x498 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_shared_vssx_5776adee8961a56f02227117704a250c050570da4c38e28103dc8e0b6a638c98_daff73c98a1a5f79.cdf-ms Handle ID: 0x498 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_shared_vsdx.scale-400_ccb422292e243d57e291be1b5fbe270ddfb4fe680f5e1f38f294d686d6a7c43f_30117da97a54480f.cdf-ms Handle ID: 0x498 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_shared_vsdx.scale-400_3f97a98acc301d6562ea54ac379c2905b5c611e7c161a0cf9c37760dc00fe64f_90a0c2945fd52098.cdf-ms Handle ID: 0x498 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_shared_vsdx.scale-200_bc0e5e53078356ce131616cae360eafb6536ad5e89dc71640a7159bca10fe851_2284fc385fb548ed.cdf-ms Handle ID: 0x498 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_shared_vsdx.scale-200_3be749f8c913f756ab54fe603e9cff6003ba468cdfeedc38355d96c79b9149fc_3fc7c265fb69a151.cdf-ms Handle ID: 0x498 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_shared_vsdx.scale-100_c147798d75ca5ff06349d53ad176479defee8f63fcac618251b602fa87b6e616_9f098adb7fde8e68.cdf-ms Handle ID: 0x498 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_shared_vsdx.scale-100_71771693a9ef8a85b8811052e78000f34fe4b36f7c5a468d77481534ba2da770_c0398ee68045fa7c.cdf-ms Handle ID: 0x498 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_shared_vsdx_3503916f94f545ea1506d6f7ae17d04c6328fd8578e4726a4c55e708eb7d8135_b792f1b0b1739447.cdf-ms Handle ID: 0x498 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_shared_vsdx_0729ea0da237cb89a6f50dd1d5ff5e1e55512bac86edd2bd6877a39b54121e30_a02c709578d97565.cdf-ms Handle ID: 0x498 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_shared_video.scale-400_4b344d1034da2de36ae77d2d3e28570253f87bb18ff786e00fa9c9eef18cee0_2434d77d2b8a7225.cdf-ms Handle ID: 0x498 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_shared_video.scale-400_2b936413df2401e01926903078a6bd6d39e80c29c96218b528333ddf0bd212c_93e8704c3a0d81ad.cdf-ms Handle ID: 0x498 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_shared_video.scale-200_62d95ed6937b1fe811edf79fb06d5e25b869c25e08e7520b5f7fb603c766136_30d13b8b2a6f9e4b.cdf-ms Handle ID: 0x498 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_shared_video.scale-200_2648274532275839beed080b26d4bbe345da8ae158f81fee79bb03cac8d938d_ccf0b33437afa000.cdf-ms Handle ID: 0x498 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_shared_video.scale-100_d788eddb13a9c71bf23496d855a2b60a791f3cda0ae6f6272e137e5159c1eb9_2d6df0161718250f.cdf-ms Handle ID: 0x498 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_shared_video.scale-100_5ecb4bde840bea497e57fb162ceed87bb8d427130674ebfabc3eb247d7e6ba6_9e9fbcb49e0c53e5.cdf-ms Handle ID: 0x498 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_shared_video_8969a2207cedf8662a38f8359f49550dbaf20367635dd0a2ce984d66321219ba_c6588d02ae13a4bb.cdf-ms Handle ID: 0x498 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_shared_video_1a4b6cec54045c220825c17b2a1b46d8bb2840a8b5cd50946fad9f789127296e_c6b899f9ffcf7ba0.cdf-ms Handle ID: 0x498 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_shared_vendor.898b0cbecdb72f285696.bundle.js.license_df7f216f85ef77a507dc08962bcf21ca5_f45a80ba48026470.cdf-ms Handle ID: 0x498 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_shared_vendor.898b0cbecdb72f285696.bundle_ec5a447ccba9cd406aeb9faf678077067007d1c5d5f7_f5ff6c6145f8aaa0.cdf-ms Handle ID: 0x498 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_shared_vector.scale-400_7398faae2c6075d826e2bbafc64ef8b433643e1998b042608cc3b6d6e9e770_4feab18b525f7d4f.cdf-ms Handle ID: 0x498 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_shared_vector.scale-400_1a381d908b788b8e8b6fbdb88318314cbe7de27d0625b68a97e93940a37b75_39f2ce92409ffb49.cdf-ms Handle ID: 0x498 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_shared_vector.scale-200_797d0f5672597bf229c782cc1030f648bd0777c3d109ba2e7d9fd33f3d051b_36d597b7cb05dd04.cdf-ms Handle ID: 0x498 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_shared_vector.scale-200_61f6799ed24ed73bd91c5db6ebcfe8905847550feea36f3954e828cb4119ef_4e7f63c35826e5e3.cdf-ms Handle ID: 0x498 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_shared_vector.scale-100_992ddfb484133ffc7aa06ea52c53f01bdb75c0b09ef045deaff9b8ce791a31_55b6a59932878f15.cdf-ms Handle ID: 0x498 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_shared_vector.scale-100_042dc8a3b08f7307e8a41bf5a0675792251964027c2c25c4f307fc8a59e8c6_47a5d2b054614aae.cdf-ms Handle ID: 0x498 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_shared_vector_bc8a8ac1ea305820360df6948a22b8bfd7b3b75e4ae79e38f32b625698053d27_23e2c6fba5f6e18e.cdf-ms Handle ID: 0x758 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_shared_vector_05b1c5efee8ceeedc01e51e99da435d9dd70218e3c9add4939a911a818fdd54a_b9f5056bce8a82d4.cdf-ms Handle ID: 0x758 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_shared_unplatedfolder.contrast-white_4dfc33bf2848b732f5c32561b863e646f2db28ff1a6b61906_f96d2eca208eb22a.cdf-ms Handle ID: 0x758 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_shared_unplatedfolder.contrast-black_692a4df6711dcf256c233eff27edefb9f658aabf9e6961219_a7df8c73502a5a84.cdf-ms Handle ID: 0x758 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_shared_unplatedfolder_895ebda68a9e66e4e879be3b73dfc4d4287d7a4412a7fb72bede73de611dd932_4bd26ccdbbc407df.cdf-ms Handle ID: 0x758 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_shared_txt.scale-400_94a27b1dfb756da42417e95edbb16c297e92356e7d3e77c5c31cbbc835c70bb3_27b8b23b00d680d6.cdf-ms Handle ID: 0x758 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_shared_txt.scale-400_4ad54e87aaeb3ee84d4df9b90671ca2e6125ac450786549b74fba1c1c984ccca_dd0e9cb35639d059.cdf-ms Handle ID: 0x758 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_shared_txt.scale-200_9c2f7bbe0b61a4bf1de8224b3e5b705be2bb634d56f63f33f51eb0cedd4c233f_fd3f17893d04f458.cdf-ms Handle ID: 0x758 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_shared_txt.scale-200_4c620102bc3bcb36451ac9a19e522f0fbe5dace5a9645761514f4cbb43204335_abfed93e2bab46d9.cdf-ms Handle ID: 0x758 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_shared_txt.scale-100_d964d2736697706e8b4a712af1151ff504e3e01501cf3ffe3b922ae3d3aa6802_26583b48bd37514f.cdf-ms Handle ID: 0x758 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_shared_txt.scale-100_49478287243677d0131f863295dbbcb2db3b79a0ce78e083688929acc2d94875_a17677feb8461984.cdf-ms Handle ID: 0x758 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_shared_txt_9d05e143ca7971b69638b22bd43c8243f06560bc3dd6da3e5a5b81faa068a5e3_49a8b1d9f35bb9f0.cdf-ms Handle ID: 0x758 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_shared_txt_3692ec1a91a9c8a48625121af57431c7471df59fda934e52c32a27e5873e10bd_220a49aa910ab09f.cdf-ms Handle ID: 0x758 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_shared_sysfile.scale-400_7c17e46f16a4030eefcd37dae593b62ddb11b1a067836b7e65a651706ee54_436ded852f4b3c4f.cdf-ms Handle ID: 0x758 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_shared_sysfile.scale-400_13c5ae2eb7bedea00a9963e89c208685543fba50ac070e7adcacbcfb01475_52c19bdf25330eff.cdf-ms Handle ID: 0x758 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_shared_sysfile.scale-200_9ee69ab18d1955c617515c4611c0bd3031bda2f066e90d7d5eeb2928aeb94_66fd8b6ecbaddda7.cdf-ms Handle ID: 0x758 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_shared_sysfile.scale-200_44f4439511c41817d23932c9a91b0386562d3ec4b59387857254c84279ed9_be6d868335c660ce.cdf-ms Handle ID: 0x758 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_shared_sysfile.scale-100_ba6a51577a0b73fb9e9900d6ed0a685ec6db4e548d82c6c183fc408da95f6_4e4fd525e41f0ad6.cdf-ms Handle ID: 0x758 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_shared_sysfile.scale-100_49b1872ac4a635663cfd53205ee829f0f4341481b83538148a1fd91c17b2d_abbf2c30fd3b42df.cdf-ms Handle ID: 0x758 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_shared_sysfile_bbfd189b4ea665884e1b2f33a282715a8cce58efb1751e805b1249d03f466950_4b57b4135a8c03c7.cdf-ms Handle ID: 0x758 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_shared_sysfile_230d8750260d02ea6e92c72546fe55c6eedeecd40c2c8253536dfa6df41cd31c_98402d46cb47e4a6.cdf-ms Handle ID: 0x758 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_shared_sway.scale-400_faa89c4e09cab9b5265968c074ef57f8fde8281396dcf59f3b2ac82af4ead7cc_dda654ff98d98d92.cdf-ms Handle ID: 0x758 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_shared_sway.scale-400_8964f54a394d83ad1661f7c1f87dbe764e27ee017c3a9b6ead7c69fa3b89865e_f63dded0d3b703a0.cdf-ms Handle ID: 0x758 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_shared_sway.scale-200_eb7912a63c5a5a731395792fb775225be183f904d33e38ae9c69dbda7216e1be_5e2388fa70939267.cdf-ms Handle ID: 0x758 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_shared_sway.scale-200_8ce2d53fdca144c85ba7734128d3045f613b227940b388d0bb34e24c05229e17_45a58de900190c9c.cdf-ms Handle ID: 0x758 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_shared_sway.scale-100_9aee1850686f5e84e1be9bbb93c0fb19249bbf9c836867a2fb9ad57d95438acc_a6560d26734f9e81.cdf-ms Handle ID: 0x758 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_shared_sway.scale-100_1baf937d2c2716eff0750ce9948ba2f9ec410522d08b65ab3e5c31b33530e637_82452e44229c804e.cdf-ms Handle ID: 0x758 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_shared_sway_92c090691258f75beda7ef23aeff7beec143bf3acdccd191275f5a7f20fcde11_15d10a2cae6eb646.cdf-ms Handle ID: 0x758 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_shared_sway_7c146a0ecc04d44a70e254ce065903f69e3c81cf479c942141cb121151f4d13e_77d3ab31519fe46d.cdf-ms Handle ID: 0x758 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_shared_spreadsheet.scale-400_a5053bf832a8cf73a23e7c976a3655c21d8d7d37e5f9a295d0d20f42d_057c808ce6b164fc.cdf-ms Handle ID: 0x758 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_shared_spreadsheet.scale-400_392ee544ee812c8bb03f02503ee1141371fcc1d2ffe79540c4d4ff9ea_b6811fbcf1c88bda.cdf-ms Handle ID: 0x758 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_shared_spreadsheet.scale-200_d81accd390f5e93a58f76aa9e963be2a87cb8bad361f05f827a993a28_15fcc29c1c92fc3f.cdf-ms Handle ID: 0x758 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_shared_spreadsheet.scale-200_d3527be05664a71900c2d8a08e15665e889dcde3daf61ada6d7963112_bad5b27f8ba34022.cdf-ms Handle ID: 0x758 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_shared_spreadsheet.scale-100_fed44574a8d43975178e42e20f5d47ce38eb973c0c4d37ead5f8f3912_e85633ea7c1b20e4.cdf-ms Handle ID: 0x758 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_shared_spreadsheet.scale-100_7964b997c2376ea80757c4c951bbbd56e26eb7f8cd656ae1aae45ddbf_78cd6511f45e6b9a.cdf-ms Handle ID: 0x758 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_shared_spreadsheet_a03da6cad400da5cc86d82a0bf479157e1e1ab685d6cff98c4fba9f90090dea3_18c83c0d7b916f17.cdf-ms Handle ID: 0x758 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_shared_spreadsheet_4a78fc94f4b1f31cfd07436f88b524bc821a8f5dae32d50f988c3a8fa43ba251_bedd7005924b924c.cdf-ms Handle ID: 0x758 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_shared_spo.scale-400_f3f8f4118f50f74ae669af3f67683faf7915283643001689c37f3e4d3f5f2793_ff094bee72844a8e.cdf-ms Handle ID: 0x758 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_shared_spo.scale-400_406aca5028ff9ea888d93b6b2933c9e506e0b124e7e45c76583f8cf2b7815aa0_4aba5b16f9bb399d.cdf-ms Handle ID: 0x758 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_shared_spo.scale-200_aa6f5e1da53753ac230d588b6d946839381731616da76f60180623491c8ac957_7556e7620e310475.cdf-ms Handle ID: 0x758 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_shared_spo.scale-200_a05b7cdbedc90a9e9e00e6467172b003af146456607c21742c1b7b52132c41e4_a140181a40d92c14.cdf-ms Handle ID: 0x758 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_shared_spo.scale-100_cceb4bb522f2d93f229c8020d98b07944368631ac1b0db1fe2914af69d8c8477_475122df6b09bd90.cdf-ms Handle ID: 0x758 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_shared_spo.scale-100_818266422c70688b1e5a370a83e71b663244ff8fa4389af3c28988598b118e01_cbc884e0e23d766e.cdf-ms Handle ID: 0x758 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_shared_spo_89a7c895e0a05d9dab94503061e06bfd749822c101639a236da93b9aea099f97_f24aae3679c77306.cdf-ms Handle ID: 0x758 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_shared_spo_7498eac45efc1601b47c6061c3d73ccb1735ad8377450fdb351f61598a284315_5e5d156154fd8262.cdf-ms Handle ID: 0x758 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_shared_splist.scale-400_aa130d92cfcc513b60ef4f3f658f739008ad478e6f35ede3fff1c8bc1bb818_2876516120fd6d74.cdf-ms Handle ID: 0x758 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_shared_splist.scale-400_44f372b7d3c37e38d8bb6fce97e95aa965399e83e0fa1f78316e97dfc70c3f_21445b02fb2fd2f3.cdf-ms Handle ID: 0x758 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_shared_splist.scale-200_73ce6e7e6e227c74f8460f2298c1845f7b84227de1fad41f2ccf03d1f63b94_089395e2f4014cf6.cdf-ms Handle ID: 0x758 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_shared_splist.scale-200_115c8b06c35340256b472603c95ea06b51159e4d2e2628b7f2f3613f9be7d4_79c85e7fa057b9b9.cdf-ms Handle ID: 0x758 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_shared_splist.scale-100_c9c677032b409c50fd138d115e462c0468b5bf93d54ac8b0bf18ee480fb71b_15573f66ed6840ff.cdf-ms Handle ID: 0x758 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_shared_splist.scale-100_c980612407afc219b03f450f8b1d0077aca06f3ae6e4639bf7f1f24b6c2ea7_b5bbb442b97790a9.cdf-ms Handle ID: 0x758 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_shared_splist_8e453c25a6258d60073858cad5b4fa916b66cf17a44fb8d863470aac4e4a527b_63b7ffa3fdbe90a0.cdf-ms Handle ID: 0x758 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_shared_splist_6f94da3e8c6eae5bd7acb5f82caa4e5546399f9be8c6a51c1943e57540d91254_7b885ded9c57c7a0.cdf-ms Handle ID: 0x758 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_shared_searchicononlight.scale-400_01d4af667ecf7ef756f61f3f2dcb04ef60ca24897f46ced448d_6299704fa414f3ff.cdf-ms Handle ID: 0x758 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_shared_searchicononlight.scale-200_7f06f3bfbde2272d713c44196bbe722e24a6e6bdc558633afba_9996b2f3fa65dda7.cdf-ms Handle ID: 0x758 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_shared_searchicononlight.scale-100_5c7df5a8171903ec50972884482b315d6d94c1696bdb93b1e7e_d59450bfcfcdf19f.cdf-ms Handle ID: 0x758 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_shared_searchicononlight-sparkle.scale-400_30d4cf9a45bd362c7910802fadf4a65627755131625_bd91582c1de28358.cdf-ms Handle ID: 0x758 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_shared_searchicononlight-sparkle.scale-200_e7f2691ea5fcff743d440c146cdaabc369e551edccc_5783837e5df9feba.cdf-ms Handle ID: 0x758 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_shared_searchicononlight-sparkle.scale-100_5b55f245d5a5e081525c3f97d1c9ed6c2eb14c73d5f_1897bab1f962fbbc.cdf-ms Handle ID: 0x758 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_shared_searchiconondark.scale-400_e71b4307fd3d6740e543e35cda684c4acc3dfdc87269cf980c19_9d83c149643ad94c.cdf-ms Handle ID: 0x758 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_shared_searchiconondark.scale-200_11ac906f65b8b28f2867f193c35126faee90a40b809d5643b726_d312ae46eed3868a.cdf-ms Handle ID: 0x758 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_shared_searchiconondark.scale-100_8ce06b213c00f3923c193d96b120a0061611a4720a483be45c71_688df1d846b9d772.cdf-ms Handle ID: 0x758 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_shared_searchiconondark-sparkle.scale-400_30d4cf9a45bd362c7910802fadf4a65627755131625d_a8fc65a1e441f5a8.cdf-ms Handle ID: 0x758 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_shared_searchiconondark-sparkle.scale-200_e7f2691ea5fcff743d440c146cdaabc369e551edcccf_9b6b3a46aeb1bb16.cdf-ms Handle ID: 0x758 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_shared_searchiconondark-sparkle.scale-100_5b55f245d5a5e081525c3f97d1c9ed6c2eb14c73d5f4_877d26266b09c784.cdf-ms Handle ID: 0x758 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_shared_searchiconofflight.scale-400_0053e473ae3fbfcf6a1c9a756fcce9b29affa3a96f85737808_a52e3b29957a140e.cdf-ms Handle ID: 0x758 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_shared_searchiconofflight.scale-200_0d7ba2d76f7506d1fd333936b5dbdf96e29233af70db5c1c65_99d1890bc2d7ee9d.cdf-ms Handle ID: 0x758 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_shared_searchiconofflight.scale-100_9de13b9f26cf2432dc4249952e0311e8489044c130556d62d9_7c541908de785e4d.cdf-ms Handle ID: 0x758 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_shared_searchiconofflight-sparkle.scale-400_ff5267fefc337d54321fb1f00f4eaa48d1b06d6cac_4b45164b363cb12c.cdf-ms Handle ID: 0x758 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_shared_searchiconofflight-sparkle.scale-200_d71f848cd57c42d622665d89152416a37023188fa2_ed276b9200c90c9d.cdf-ms Handle ID: 0x758 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_shared_searchiconofflight-sparkle.scale-100_fbb08eb3e3681471272ca44fbb2fdf58e870607d0e_b9a3cafa0a34d836.cdf-ms Handle ID: 0x758 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_shared_searchiconoffdark.scale-400_c55a0aa7b3afdc897887c9279a82df6aa47654935a0d9b4bec7_8747d5d795929206.cdf-ms Handle ID: 0x758 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_shared_searchiconoffdark.scale-200_a18a043d8a68abb5e2314663cb0f4821bfd1b724f58c5cc73bd_51e7a643bb815bfa.cdf-ms Handle ID: 0x758 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_shared_searchiconoffdark.scale-100_ede5ae31bd96a6337a9a6b5b88125c6ad25798c15d4e29a2aa3_93c522a240f200ec.cdf-ms Handle ID: 0x758 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_shared_searchiconoffdark-sparkle.scale-400_3fe346d0d29850ab4cc3c3d7631fe0f4b10b371564d_f8bc4da42e105b7f.cdf-ms Handle ID: 0x758 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_shared_searchiconoffdark-sparkle.scale-200_752ee0e368a51b8c4920961514a9a5e1a8d8803782d_92bf33637317f931.cdf-ms Handle ID: 0x758 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_shared_searchiconoffdark-sparkle.scale-100_1ec8d8fa47e163e9fb8ac3949824e8cb378f1cf165d_0c1ac2213794df79.cdf-ms Handle ID: 0x758 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_shared_runtime.3125b5fa2eda479065df.bundle_45a12b609926368cc2412c456bdcf93aceffa5906c1_e49de110ac2b3027.cdf-ms Handle ID: 0x758 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_shared_rtf.scale-400_754903fda696a9aa888ebe5754e8a36c58ed1b52a0042a6c15809a0d1b37e18b_934e5c02ad967440.cdf-ms Handle ID: 0x758 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_shared_rtf.scale-400_11e4df51e5c36fc2286e7a3c4929375d54a58515623ce951aee2120df8b56007_c97ea539bf28692b.cdf-ms Handle ID: 0x758 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_shared_rtf.scale-200_f1340a5f1e4d162b57277caed0ca901cea0b3b99f6d6bd62e7ed3342357a2e14_c349a262b01216fa.cdf-ms Handle ID: 0x758 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_shared_rtf.scale-200_80631192b312cb58c30f4e76533b3ece237c083e04f8b22263f6f6140b9fc932_a75ec91a67dc5bed.cdf-ms Handle ID: 0x758 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_shared_rtf.scale-100_fe3e8be0a35fb64e784679dbe1298a478cc5d3cbfd8ee08e97111f9e5ec06962_c1190c99e48e32f5.cdf-ms Handle ID: 0x758 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_shared_rtf.scale-100_bd2a568fe8b8324e061b5474c2503d3185319e69f9093ff601241bf30a4d237b_f9fe47015db808c4.cdf-ms Handle ID: 0x758 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_shared_rtf_f5e4455e61102f55c9c265ba6c6f23183af6896f6859f1f270e1ce70f97eaeee_af6025e3d47abb28.cdf-ms Handle ID: 0x758 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_shared_rtf_6bb8e8e781bcd943376f8021630d017e771e57e5d3ea5992db52abea5eedfa27_1b4106274b720c2d.cdf-ms Handle ID: 0x758 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_shared_pub.scale-400_4d49d6c330fcea19cb4bb6ea6d8fdcbde7a32e9fd44724ed31e3eed3b067c98e_3ca01889e4f2e8f6.cdf-ms Handle ID: 0x758 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_shared_pub.scale-400_150c293d15cdb2e78a60a1eaa1f3784bb238826829997a51dec1ae94bb64c300_4bc1609cb74490d5.cdf-ms Handle ID: 0x758 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_shared_pub.scale-200_d339499549f6576fdbd48f08270e13154aa622bd7850d764b0e0d0927dff4c09_9a83d5357dbf59db.cdf-ms Handle ID: 0x758 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_shared_pub.scale-200_5fcb207ed631cef337d085e83b0034c511e8ecabaf05a6a48180549fc035dd90_edcc5cd73249bb28.cdf-ms Handle ID: 0x758 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_shared_pub.scale-100_d11b2fb98887bde8f8e050880cc083b08a43cbf1346d74ac69926fdd4db6f1cb_84aec5e987f670f5.cdf-ms Handle ID: 0x758 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_shared_pub.scale-100_b03c14423b0289c8b7b0c2b188a863d11e6e369cf1c6d03824b1a7d199a67477_7e6e5cc340d9f11e.cdf-ms Handle ID: 0x758 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_shared_pub_eae7e100c7f98f5011e6eb4cfcc8cb9926c122cf428474ed7ff4241eb6bdaa6e_1435471912e62ab2.cdf-ms Handle ID: 0x758 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_shared_pub_6aae63b818bedba96f414b2870d57043c5caf8be50e3ef0719bff3e9f73f6c37_38147f18d1e194a4.cdf-ms Handle ID: 0x758 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_shared_presentation.scale-400_bb1cb668013ec8f2e42f33df60f2fedad06a7809433aeebec4737d2d_a228e75d6e824fe9.cdf-ms Handle ID: 0x758 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_shared_presentation.scale-400_6fc758f416f9f1ffe5fe392840177278bee9de1f0c8a4d15eaa32518_a66451f77888206b.cdf-ms Handle ID: 0x758 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_shared_presentation.scale-200_f771410fdd90fd90bef7aceaa71d4d4182319f469ea8d21a7e1c9630_9475a81e0e575c92.cdf-ms Handle ID: 0x758 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_shared_presentation.scale-200_618ed0b412f8160f9d072cf82d193e40797ad965dd915116fbb0ba07_dc76b94b245b7d90.cdf-ms Handle ID: 0x758 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_shared_presentation.scale-100_2b58c4f9f82585fa7ce922da58c291279de4fe3b3a0a7955583de016_89272153d66620ab.cdf-ms Handle ID: 0x758 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_shared_presentation.scale-100_0c7765927c55545c62aefc663e8d83369a489d497ec211622c311885_f3cacd45f8e72bbe.cdf-ms Handle ID: 0x758 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_shared_presentation_c12c7032fb4b6087dd1544fa4d5f40f844b42d1e0a4f9c0ae2d9f07a02a1cc00_14c1e0b9dad4b2f6.cdf-ms Handle ID: 0x758 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_shared_presentation_1ebcf8e2bf396ff5cbc5fcef357538a2d1cc89c522844f775ee40a67fe68ef96_728dfd1ad406ceac.cdf-ms Handle ID: 0x758 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_shared_pptx.scale-400_c28f460b008bdcddb7cfa79605821b728b927711d981c75b4f4144bf973ab879_e27ca26c3c8a3982.cdf-ms Handle ID: 0x758 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_shared_pptx.scale-400_ae428236c9e12cfcd9d53d5a099328d4c4955057841cd03a980de3b1b21e7027_871eb0b52894d4b6.cdf-ms Handle ID: 0x758 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_shared_pptx.scale-200_c52b6bb74b0a545802354697dc99b5734b19620556414d5e5db371fabcf4931e_d23dbc8b57d00c5e.cdf-ms Handle ID: 0x758 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_shared_pptx.scale-200_2ffa4da66f8ddc9065b71e5fba7e699a84b1601971816c1bda4a793e51f309f1_d1771829d56dcfa5.cdf-ms Handle ID: 0x758 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_shared_pptx.scale-100_13297b953f91631b3576d60a1213346f2716c0c076145ffc7bf93cdd11f4e29f_8a8cbe7119b7f683.cdf-ms Handle ID: 0x758 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_shared_pptx.scale-100_003445c8dd52ca245f20fa93a4ec2b14879967581605352a201483a776f0c1ce_32c259bae24a1ecb.cdf-ms Handle ID: 0x758 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_shared_pptx_5dfc65e2a87b20b3f59908d76cf963bba52f429eaa099f2d28ba7da80f94ceb0_7f6c93ad36f0d60a.cdf-ms Handle ID: 0x758 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_shared_pptx_403f454f54b56842c2ac0cf500384d7c422cbd053ca9df16cc05757d2be060e2_ed566c1c5e904ac9.cdf-ms Handle ID: 0x758 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_shared_ppsx.scale-400_d383480485e77c2c4612afa00b034f414cfed9cb7bd204954162a08a5bba904f_759a4491c76d06b6.cdf-ms Handle ID: 0x758 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_shared_ppsx.scale-400_b0220c8e235615647fc5f9abb47a8b6ddfa927029f86460be0dd44f49f624d33_2e452d5aa4ca2227.cdf-ms Handle ID: 0x758 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_shared_ppsx.scale-200_6ea097454958fb5d421c68f893c0e2ff616e3c6f80fc14756dad7aad77b4c492_816b1d5a985709cc.cdf-ms Handle ID: 0x874 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_shared_ppsx.scale-200_4cde3baa7f8fbfb85b2a684d602a55464fe2dd169b10b653488c8fd7a3ea30f3_ceb6f6f4031db4b1.cdf-ms Handle ID: 0x758 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_shared_ppsx.scale-100_e67fe1b3417f499ce7dfa21ee7937d28677767f9698ae710048394ed8c7ae44f_e7f48313e6313010.cdf-ms Handle ID: 0x758 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:35 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_shared_ppsx.scale-100_d62f6f71052bc21e202669480c319bda73902941d26a985b9c65d93fd7934b84_8f39faabfd5fc575.cdf-ms Handle ID: 0x758 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_shared_ppsx_ecd81c17e48736d75488f159f605fd93f4b9c410f8e3f70032543b4a2b2a4e93_9b85175752f28344.cdf-ms Handle ID: 0x758 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_shared_ppsx_3069249bfe43aa121ee901903b631add86afd53235aa05296071ebcbb77aac79_cedeb9ed30a9ebf3.cdf-ms Handle ID: 0x758 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_shared_powerbi.scale-400_307f63d3dc8181cadb610095fbe5e3c3e63007154babdb793c6db40df2491_ba3cfb1ded4ba3e1.cdf-ms Handle ID: 0x758 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_shared_powerbi.scale-400_0845b0ff17ea28124c08440fe7eff40d096977026800b22ff6c4d280e2a6c_f281456febdefc60.cdf-ms Handle ID: 0x758 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_shared_powerbi.scale-200_d41adba335f7e3cbb1762a374a178124c102a48b3490fa65dd9952f79a8cc_3d0c633e748ef09e.cdf-ms Handle ID: 0x758 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_shared_powerbi.scale-200_1ec35544c98da534fccf91ad47f3f63203f99001bd108539bd6efdf941bf6_d1e284d0de07f91f.cdf-ms Handle ID: 0x758 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_shared_powerbi.scale-100_f85cba1e11e4b915be3cdb8a6d87ee63fefb58fdabb3a74abeffbf264d9a3_6255b5189954fb1f.cdf-ms Handle ID: 0x758 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_shared_powerbi.scale-100_eec0780b4f2f36a3f7d01e60286793b664cbc808a029e10f637f793aca3bc_c059e3a5e9aca455.cdf-ms Handle ID: 0x758 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_shared_powerbi_ee7aff25245f427533946b0953cbcdcf8dd51bac3b8653c42df79945c6b52f18_b49fba9d59e8381e.cdf-ms Handle ID: 0x758 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_shared_powerbi_94cb3e284306092f543cd6bc676ec6d765b0a1170b7beb2f04087a722044906b_4fb308fefc3e8631.cdf-ms Handle ID: 0x758 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_shared_potx.scale-400_8cc6f1ea5a1dea7694a3e34b8a6560d1e49b588f15061a758848b98775f91c32_c498b9b57cc45366.cdf-ms Handle ID: 0x758 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_shared_potx.scale-400_0a3f51514d9a2edb16b848f9115cca5dffc2a2bf44e6ecf4eabc85d436f86efc_6f9b45e11d21da4c.cdf-ms Handle ID: 0x758 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_shared_potx.scale-200_b59ddb3cbd9086cd23306dd0b05c5a6ac0a88a70903d727f5502e0d662088173_3abfb7fa54a60727.cdf-ms Handle ID: 0x758 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_shared_potx.scale-200_39e29e35c87126fa53923e673f157e8af293899f7ff429dd6753dc2f883f6109_e739ac087ebd3abc.cdf-ms Handle ID: 0x758 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_shared_potx.scale-100_63eca61e63e57d16ccf9082e76bb07087b95d45c4afb51564f4aa8fd0814e92e_7406cdaeae5a4fa7.cdf-ms Handle ID: 0x758 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_shared_potx.scale-100_55eccf2caef22167f542b9e9da9a03ac2bbdebf8bcc80c42f99311d43c5488dd_227555dcb0737727.cdf-ms Handle ID: 0x758 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_shared_potx_9f650d4f82d6f0bd7bf9497686a83809fa4ce2d5ce7f23915c468bf5db40d574_739cda59fb610399.cdf-ms Handle ID: 0x758 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_shared_potx_36c77168fdd6cd2a260159032db5fc95b3e3e8cd1aff0767aa5f2cbfb5be74bc_41cb157f237bd97b.cdf-ms Handle ID: 0x758 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_shared_photo.scale-400_b3c8193853d925ae5b945eec84f95276ae22339cddc96fc655a2bda258c4538_16d213e97b935638.cdf-ms Handle ID: 0x758 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_shared_photo.scale-400_31eaa7a8aa3ba338502ba478dbb310ad7b0a93864f382088214faf4422e0190_8b6d92e63ccd9c4e.cdf-ms Handle ID: 0x758 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_shared_photo.scale-200_dfed8f7a31f0da5c2b91c63345b6f10f2ff5f4fb8f7fae8e1e5973bd5828e79_f51639cf40aeba8e.cdf-ms Handle ID: 0x758 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_shared_photo.scale-200_ba8efc8bcf09a5c39498b5f6e2175c7f9cfee07114f4216f68bf9929d705ab6_a6db1dd698f850b4.cdf-ms Handle ID: 0x758 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_shared_photo.scale-100_d99a924f60d4c555b6a0fec1b77f6a403b036126c9a26fcf29ba49c02c8d237_3dd05d2222888402.cdf-ms Handle ID: 0x758 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_shared_photo.scale-100_44342d9d091dcedcf7aeed22f7c264c0cce094de578cdbb1cc6bf6c6fad70bb_80531f95937679ad.cdf-ms Handle ID: 0x758 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_shared_photo_add17f00d3f4ddd38c1434b668e5bf0d730807df83e43819349193a49a8dedf2_e6485b8e23556b4f.cdf-ms Handle ID: 0x758 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_shared_photo_4a7f39ae0f90475a3b34d33d975420466b87928c2497d52fa2001898bc427aa8_74cc7a56ec525840.cdf-ms Handle ID: 0x758 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_shared_pdf.scale-400_7d7569e3af71e9a36a3eb0f19225e0dffff4b5b5a1b9a57d91f6bf4d094adae9_c89af170c9aef16e.cdf-ms Handle ID: 0x758 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_shared_pdf.scale-400_6499e7e99a8d15925a9ccfc12fe90f28b8d40de1f62eca07a6581f39290f22e3_71f64692efa9ef51.cdf-ms Handle ID: 0x758 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_shared_pdf.scale-200_d0a0904ee2dbd87b39531435a1a8c35a7d40bc45f43134b71b877808db367c99_81753c9e48d2ba01.cdf-ms Handle ID: 0x758 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_shared_pdf.scale-200_1761954d15ee313f95303bac23b74ab52e72bb5bb7b466788dca75d99340ecde_0f2c484946d98e1a.cdf-ms Handle ID: 0x758 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_shared_pdf.scale-100_cad87df04e3122305a32670ec088adcc02786cb06ebdb083eb7114f67382958f_a14914610ca22cb2.cdf-ms Handle ID: 0x758 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_shared_pdf.scale-100_9c6edaedfcf9750a0b11dceb069993fdbb7f522f6d2f537fe974146baacfce64_b073071b5ef840e0.cdf-ms Handle ID: 0x758 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_shared_pdf_e475b071d59c1422286f35ee1f50a9783f431320081af6339922ba2daf35d7d5_b0bab9fcb6d50eb8.cdf-ms Handle ID: 0x758 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_shared_pdf_7bae83624b2bb4abd82294487219035edd1a7656b28c4455e2a134e18c62d20e_011eb295913f067b.cdf-ms Handle ID: 0x758 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_shared_onetoc.scale-400_98a0123120cdb46c85bd9ce8e5448fe7b588ceb1cce0f9d7617ddf1f77c382_f0d145856de77570.cdf-ms Handle ID: 0x758 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_shared_onetoc.scale-400_83357cb7936e7c18d9ed8b1161fca6003af18d0c78557cea683e3126808b75_78e230ef18a7ffec.cdf-ms Handle ID: 0x758 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_shared_onetoc.scale-200_606508dab3ecb1127b9213d84e54492d45ed383fb7a111cf07e1a4d3fd9a9a_72b6ba6943df4362.cdf-ms Handle ID: 0x758 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_shared_onetoc.scale-200_562cf6353ea8e2f66b16e4ee8cd0fe2925e7f5f7ebc94f9317be3b1122d87c_d27c12f555d2dcf0.cdf-ms Handle ID: 0x758 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_shared_onetoc.scale-100_89a5d2329cc2dc47315ea0aad646d9075f99c8bd3aaf09793420b30e16b134_471d93cb755158d6.cdf-ms Handle ID: 0x758 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_shared_onetoc.scale-100_223b61c4c5d9ab54741f3f7f94553634ec3b525a232889cda6ad00b1b58e02_efc1a349e0d6d1e6.cdf-ms Handle ID: 0x758 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_shared_onetoc_f6319d3298cc143c645bbd584a11368d416104630328191b71c4ec89d4191374_75871d9ee77a154c.cdf-ms Handle ID: 0x758 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_shared_onetoc_9a0c60e90f7b00a05426d9c2828f3ca67025a1b3c52254ecebe216cd30e0fedb_f73280edd5eb4b9c.cdf-ms Handle ID: 0x758 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_shared_one.scale-400_6a292dde55e01de80b03c4eebf6ef2856aabe2ba3e4e1bba06b5e00be357b272_6646d61110bc8001.cdf-ms Handle ID: 0x758 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_shared_one.scale-400_159e9b29e0b0a7ac2f0f0169988a347ad613f35a24849180f60f09bfcb22828e_4d0a6e5a86e9fae1.cdf-ms Handle ID: 0x758 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_shared_one.scale-200_edab6036afceb05892dcb3d7e67075fa045d1c421f67d1286d9f4995df78461e_f1a1bb69e6779764.cdf-ms Handle ID: 0x72c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_shared_one.scale-200_c4b9f498b8d74baa335e9aff020925a06e2c4de0b221cab460b9f342d8f24178_1b6374282bd6bb14.cdf-ms Handle ID: 0x72c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_shared_one.scale-100_f980b7ff72a6e33e5fd7e624d91398fadcbbc750b58acfc3ac0039b5359120de_e5e465e1b7c7ec91.cdf-ms Handle ID: 0x72c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_shared_one.scale-100_87c05115680d84fd787d1ee890bc1ebf793f39022f417f15d5195d4fb1a8342c_371ed7ac8f4bfcde.cdf-ms Handle ID: 0x72c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_shared_one_e3c3475c232365bb2be5c22131c060db4d3b7430f18ec25554558c4bd509bacb_6ff89de983a5d32d.cdf-ms Handle ID: 0x72c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_shared_one_3e142b483b3b1166319db5b67df1620bed7bac6cd3e5868d4954e406c4d13f97_be4b8b15b352484f.cdf-ms Handle ID: 0x72c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_shared_mpt.scale-400_c97edf47bcfd8d573c1dd0e39a9197c90a9875321de4ffd232eb3ced3a36e396_13bb0b1f4839d63d.cdf-ms Handle ID: 0x72c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_shared_mpt.scale-400_b7f205e492f98e7fccfe06aea6242349b45acd5427ba4ce7e34e0ba679dfb549_ddcc90cbbbdff43e.cdf-ms Handle ID: 0x72c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_shared_mpt.scale-200_8e9b3d7f261f97db48c09eb038e40d1f78470a6b8b694d8c0232b6f7219dfc99_f8162716f189171b.cdf-ms Handle ID: 0x72c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_shared_mpt.scale-200_2891a360734b4ee4b0a8bc44d69e4f9747f811f7d63e0bd48d5a1f6d8d536b48_5578a7450463d597.cdf-ms Handle ID: 0x72c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_shared_mpt.scale-100_9d9a87e8f60419d7e03cc723fe559022c6563d4eebdd0d78ffb7f0fa8a8b98d3_d1b74b24fcbf5b82.cdf-ms Handle ID: 0x72c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_shared_mpt.scale-100_7e16d619aff1b569198c66d05e196d58ee7e16995a4d0d683a58b83a3be05621_4c513bc049001982.cdf-ms Handle ID: 0x72c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_shared_mpt_8caa4792f38e8f933cce96a86e41f39f65efbe632a6d3a524c256fda67765d3f_6307f0ca88f8d979.cdf-ms Handle ID: 0x72c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_shared_mpt_61475d482e33ee2baf10587adee40be7aa7f9023c84c546992d17f6e44df298a_9640ef48cfda7aa7.cdf-ms Handle ID: 0x72c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_shared_mpp.scale-400_d1ed2addd1d7af1fad89fa0055ea0741074cc3f094489b73ebff68ae55fe7b77_f76ef3ee3c8eaabf.cdf-ms Handle ID: 0x758 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_shared_mpp.scale-400_0560da7988481a9be87fe451f7126c5a59a54568255e4e031180ea1a0e108b35_af22b0cc21fe604d.cdf-ms Handle ID: 0x72c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_shared_mpp.scale-200_c04dbab07366dece991059bfac31a292e9d915af9bf0721a9a20361dff6824f0_44bd9236b8edecc4.cdf-ms Handle ID: 0x72c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_shared_mpp.scale-200_7a053ffae67b5242865328354f5f8384671b8070a3d316e8db777cb9b94fdff5_08192328d105ba17.cdf-ms Handle ID: 0x72c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_shared_mpp.scale-100_a0441cf29d5a86f50d3687bfcc015cd011cf6807478043f9544deac68c5d4c03_4fc0c41cba76bab8.cdf-ms Handle ID: 0x758 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_shared_mpp.scale-100_6362ba12b0bb9591eb5733ca6a366d5609f70bc65b585606c9bd6b46f7df723d_bc79e7d5779331c9.cdf-ms Handle ID: 0x72c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_shared_mpp_6f2f5ee74ac278e1671d93596214ee8e290546a392783290b842a2500f835eb0_37d62204b503092f.cdf-ms Handle ID: 0x72c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_shared_mpp_3f74d5870e2ac0db4bd1b08b81caf6d4aa083b818b5ee630e4d719d0fc21dcc3_9713fb6139bca909.cdf-ms Handle ID: 0x72c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_shared_model.scale-400_fb03ec88aeffa8e334d7b330d8972851719d9625eef72372148fb98ba8c19f2_91248c68ca004351.cdf-ms Handle ID: 0x72c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_shared_model.scale-400_3fc5b481817f95cffa8c5500e55140aed1e40f41c1b3db68827c39ee9066fb2_8048766c0e385cd0.cdf-ms Handle ID: 0x72c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_shared_model.scale-200_ef4aa40d37941f43cbdee23d9a917927caab979a7684229b0a3daf2a24e9b26_15b493894c7e67ac.cdf-ms Handle ID: 0x72c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_shared_model.scale-200_88f4e71562a90348540f703870ab832e2dd47c2e231d60673db1c6689238ef6_b8fe52479587a1bd.cdf-ms Handle ID: 0x72c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_shared_model.scale-100_ffe21bd88d12261ba108faea0c9160783fd5d75636d3411a3ff1dde6d8da1af_76a1e749cf87f350.cdf-ms Handle ID: 0x72c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_shared_model.scale-100_c2d254e984d7e444037e7eaeea3681bdf9ae4960a97dd4ae6ffadc5b6d6456f_734f6e411ce77a9a.cdf-ms Handle ID: 0x72c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_shared_model_8ec735d12966dfa9f15d1ca0700c9ec98c4253d704f5f92540ea1239eaa15b5a_30edd239572d3206.cdf-ms Handle ID: 0x72c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_shared_model_48afd3c137f68cbb291e3cbfbfa29ee7935c8d66d2543921ecdb6e7346461647_a86b01e1fc9646f7.cdf-ms Handle ID: 0x72c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_shared_microsoft.cognitiveservices.speech.extension.telemetry_95decaaf9138457377d244b1_6d8a9c23290d993a.cdf-ms Handle ID: 0x72c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_shared_microsoft.cognitiveservices.speech.extension.telemetry_9194dba0dc90151bde9c57e5_55ecd1ab413c7d2b.cdf-ms Handle ID: 0x8ac Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_shared_microsoft.cognitiveservices.speech.extension.telemetry_84c08827cbe8406752748508_e11fb93df38a8012.cdf-ms Handle ID: 0x8ac Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_shared_microsoft.cognitiveservices.speech.extension.onnxruntime_daa0c1ed60e08f7b95361d_f9099b687e8c7e44.cdf-ms Handle ID: 0x8ac Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_shared_microsoft.cognitiveservices.speech.extension.onnxruntime_d279e440efa1ffb1bd06af_3225e35bd9557af1.cdf-ms Handle ID: 0x72c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_shared_microsoft.cognitiveservices.speech.extension.onnxruntime_c20a4f2d2f5cad7779720c_d68a6421e3a2f1f6.cdf-ms Handle ID: 0x72c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_shared_microsoft.cognitiveservices.speech.extension.mas_a95069bc34b7deba398ee56177c11f_9ad96e2259f1c1a5.cdf-ms Handle ID: 0x72c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_shared_microsoft.cognitiveservices.speech.extension.mas_88a921f04841c5a133cbe2940d0cfc_e9c579ef721fa6f2.cdf-ms Handle ID: 0x8ac Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_shared_microsoft.cognitiveservices.speech.extension.lu_e05ce80209d30490b43788e51252653_6d016eb5e151d4f0.cdf-ms Handle ID: 0x72c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_shared_microsoft.cognitiveservices.speech.extension.lu_ad2d27e9ac52995dcfef9860f60dac9_92ea06c973cbf364.cdf-ms Handle ID: 0x72c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_shared_microsoft.cognitiveservices.speech.extension.lu_29c1c91dd59ef9f8bee572856811293_e5bbb04333268195.cdf-ms Handle ID: 0x72c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_shared_microsoft.cognitiveservices.speech.extension.embedded.tts_f0341eb0b18fbe7bdb854_fbf5ed2bcc8ca215.cdf-ms Handle ID: 0x8ac Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_shared_microsoft.cognitiveservices.speech.extension.embedded.tts_e085467f8c185e4034c28_aec866acbd18e2df.cdf-ms Handle ID: 0x8ac Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_shared_microsoft.cognitiveservices.speech.extension.embedded.sr.runtime_b807524322d4aa_433cfc27beb66c9f.cdf-ms Handle ID: 0x72c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_shared_microsoft.cognitiveservices.speech.extension.embedded.sr.runtime_8d44cf1bfd3e3b_fefb61e14f6c39eb.cdf-ms Handle ID: 0x72c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_shared_microsoft.cognitiveservices.speech.extension.embedded.sr.runtime_7f3dbbe9b71c73_b5153e6b1392fcd1.cdf-ms Handle ID: 0x72c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_shared_microsoft.cognitiveservices.speech.extension.embedded.sr_c10e4aed29037cc98df50f_6430cfbc8ff04f40.cdf-ms Handle ID: 0x72c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_shared_microsoft.cognitiveservices.speech.extension.embedded.sr_38c64db7a9a9545d559426_8ad05004be28f03e.cdf-ms Handle ID: 0x72c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_shared_microsoft.cognitiveservices.speech.extension.embedded.sr_1b8f305a7d0ea6462c5a87_39ab3d09fc2aaa4e.cdf-ms Handle ID: 0x8ac Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_shared_microsoft.cognitiveservices.speech.extension.audio.sys_d21a2a332654b34b49895c7d_9029fa4efe57c26e.cdf-ms Handle ID: 0x72c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_shared_microsoft.cognitiveservices.speech.extension.audio.sys_b74424724b200e45e1a7e05c_08715323eb3b912a.cdf-ms Handle ID: 0x72c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_shared_microsoft.cognitiveservices.speech.extension.audio.sys_87dbcd03e462443ac7ef7e7a_dc5de94c74966b9d.cdf-ms Handle ID: 0x72c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_shared_microsoft.cognitiveservices.speech.core_b6728c95bb26c95b8a32717d7b9b4efbf40bba9_7edf5bcfaeb18272.cdf-ms Handle ID: 0x72c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_shared_microsoft.cognitiveservices.speech.core_a77d5587a6604373f1508028836082e1e2763f8_f584dbf9e09efad2.cdf-ms Handle ID: 0x8ac Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_shared_microsoft.cognitiveservices.speech.core_86981802eea07e32db062a2c4bf6c1ec2055077_71892bc8d0c24265.cdf-ms Handle ID: 0x8ac Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_shared_main.6176cbdf3adac6081010.bundle_0c2325edc65092248f68068d100da08dc29f40f9c5ad30_d2c2130c465bdf03.cdf-ms Handle ID: 0x8ac Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_shared_link.scale-400_d78e71c4ae636b13a9d14879bcfd952edb4e49bc0bb2e8e44e05e852477750c1_815c57c5e4548e0d.cdf-ms Handle ID: 0x8ac Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_shared_link.scale-400_2d6ae67cdf3c76f4e4b51815291c962329e125da191d72f740246679c2e23c6b_e7efedd5355bfbe0.cdf-ms Handle ID: 0x8ac Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_shared_link.scale-200_647689a8048cd45bba59a1c6c88acaa250b7381dec5e374e911edd8e41835278_8c320d368071ccc7.cdf-ms Handle ID: 0x8ac Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_shared_link.scale-200_58f5cdb0ff277491d40d69e3b5347bdd77de7e3fec43f2efdd2fae2f04250346_b031e0e432178d5a.cdf-ms Handle ID: 0x8ac Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_shared_link.scale-100_8d2781eb027b4758186ab8defca1f4407c54c130be1cc40d1fc651e5423dda3e_6998bcb57d837094.cdf-ms Handle ID: 0x8ac Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_shared_link.scale-100_4646d5b2321c119e3b1a08aa84af70e196c36d270f0df97f9689ca51aed4b401_fb747cc7787ef79e.cdf-ms Handle ID: 0x8ac Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_shared_link_b488806db59d79ea2a35d1b168ca405a2e1b22ce8ba7898e239240745cc0c913_c2afb817395c170f.cdf-ms Handle ID: 0x8ac Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_shared_link_3c82b30dc3ca072afcc0e3b39e1dadbbda15f28abcec9eb87caa4b80b9f8f291_5dc917b2bfd624b0.cdf-ms Handle ID: 0x8ac Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_shared_index_c98d93564795b903d382d300b065e0bedb957b2f1f92ee4d9f95f1adb1c56667_6228430b185b6573.cdf-ms Handle ID: 0x8ac Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_shared_html.scale-400_b84744e57027947f9e48c3f84da52da5ddbdac0ae3860c27d246a572685e5721_674a043bc8c86c4e.cdf-ms Handle ID: 0x8ac Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_shared_html.scale-400_67a6a6ad37765bbd02a82b2cde0066ba50d49a2ee5c551f1cbfaabefce6fa673_c0cc4f9fc0e0c6ac.cdf-ms Handle ID: 0x8ac Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_shared_html.scale-200_d9367c7ad6d7e9b3e7068ebdc4ed67f446542f7f1f54c4512da2652791d57fef_08ae014cb6f9079d.cdf-ms Handle ID: 0x8ac Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_shared_html.scale-200_71f6fde8a70bae8f9556eb3eb763d587b985b7a7cb13d27b589fab844f1f27b6_3172987dbba3b1bd.cdf-ms Handle ID: 0x72c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_shared_html.scale-100_fe1c0917d53effcaf53ae7f1dbf2f90c61a4316697f45c44b4a7f31beb5977ac_f1c9dc9c674e4785.cdf-ms Handle ID: 0x734 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_shared_html.scale-100_e67b3abdbe7753a4d2e211a06327b6ee0ddf1fc2f03aec2d0fda7cdb2be51b8d_2d53eb67f1ff6fb1.cdf-ms Handle ID: 0x828 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_shared_html_ea2a156b3bbe949e4698329fdbca166fd16b2e54d3df923cf174b5b69f8d1848_56fd816e44c7e2cf.cdf-ms Handle ID: 0x734 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_shared_html_92d9179f6d50bc90ff2b2172d36a39891bc1a0df92574907341e715df127481d_39e8192dec1f2d30.cdf-ms Handle ID: 0x734 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_shared_genericfile.scale-400_f0e5b8e6397d26dd5d99f5b75dd0ce9116d2a6267fb74dbbc962c7b8a_0b91ba7ee096e4ab.cdf-ms Handle ID: 0x734 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_shared_genericfile.scale-400_41e49084127930fe62a64c374191b6947a8f7347d81e9736055a8b9c2_4f724071139ed838.cdf-ms Handle ID: 0x734 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_shared_genericfile.scale-200_729f785a45c9d0d966c619914515e9a1d02fb143ec0d057b186b0e0b4_10c22b354db5a81a.cdf-ms Handle ID: 0x734 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_shared_genericfile.scale-200_1724c580478ffc1ecafa1c73c22323ed6e71852028bf81e6a021dea71_649d93db1d13e4c9.cdf-ms Handle ID: 0x734 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_shared_genericfile.scale-100_f761768c72542a412e3e713e2d0db7e2b1f09e20f5c62fe9eb28eec69_8cddf71e1242c517.cdf-ms Handle ID: 0x734 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_shared_genericfile.scale-100_90aba98501cd79fa1c111fb1be3ecfd90bec6abca1a7817cbfa7ff5c1_1f06a35ab95db554.cdf-ms Handle ID: 0x734 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_shared_genericfile_ef67bcc5266e05868cbaa1fe5f30ae10bd6077ba5dd2c15737ec0d10789f2e28_56c0ec141a6c726c.cdf-ms Handle ID: 0x734 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_shared_genericfile_7e3cde10769bb8c8e500adf6be0a4c94562a4542a75469351959ed030aecf4d6_845ab9ff88f80125.cdf-ms Handle ID: 0x734 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_shared_fpieprocessor_6425904d6f9f95f674a3693e677a787c6c22846488dbb132cf5433d606332bad_a64bad74016e495b.cdf-ms Handle ID: 0x734 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_shared_fpieprocessor_3cb6b3391b58582237a3a5c640ced0440cf26e35a610cb8bf633b13a06890efd_9f67fad3a3ac5029.cdf-ms Handle ID: 0x8c0 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_shared_form.scale-400_f78061c4effbff05e172ae1705a8a980359416256dfe2a156f1c97989e1aedec_776c6f3f6e24270a.cdf-ms Handle ID: 0x8c0 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_shared_form.scale-400_c4e8028f0c3359e44cea01dd714e1c2914e6d2ee5b97c9fb67458c897bf6d361_424b909ff73597a5.cdf-ms Handle ID: 0x734 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_shared_form.scale-200_bf4e14a50100d94d0cd721c1c1f51ac628e2e59a32f8efaa24e67609e545069d_ebd7f6404b48b002.cdf-ms Handle ID: 0x734 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_shared_form.scale-200_8b57571124c91f1297093eaa9379c403fd15ec61f9e800c5c18142dffaaa12f6_181c20639b3dc376.cdf-ms Handle ID: 0x734 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_shared_form.scale-100_dd74c47fef0560a6eb660644e6410c4e06d81b315adcd78cc31043ccfbb3d813_1062f52dcbada82a.cdf-ms Handle ID: 0x734 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_shared_form.scale-100_d823321a9b3913d7ba475b8fc9150ba0a20817b913bba117dcc4b982315c63bd_057e3c98e70ceb52.cdf-ms Handle ID: 0x734 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_shared_form_9ef0650d4ec30e7e667c94307d7dc3469345ff8f635074798b423a9c06c553e9_b6df04449611e581.cdf-ms Handle ID: 0x734 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_shared_form_7e11d4d22e9310c7ae8b0a3bc1f4ff474c926db14cab0bc32aebe568aa72a370_57242cf739ae41ee.cdf-ms Handle ID: 0x7c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_shared_font.scale-400_b46c1309d02e885233b5ec74bf95ddb5acf59dad12534304965b82e6232cb87d_4b734d3ceba2ae38.cdf-ms Handle ID: 0x1af0 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_shared_font.scale-400_2a55fb3d5e48d96a41ba145c837eb88bc557d463c542ee8257605db4ffd135cb_5e64d96ff64524ca.cdf-ms Handle ID: 0x1af0 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_shared_font.scale-200_c1bc6718c07a86fd828bf01dd2c9bc853110c4000ef2f25a37b70a049a4f8c81_ecceca3975a2525c.cdf-ms Handle ID: 0x1f8c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_shared_font.scale-200_b9652eb777930565e1c6b1fb6018ce25e82b2946956583f2950bc4c79cc37d4e_bdb671845ab3f9b3.cdf-ms Handle ID: 0x1af0 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_shared_font.scale-100_de03cae22a42212c301c3dd72423a24355545957be316c5fa30fe7ccede9d8d6_4222644f9bda9f48.cdf-ms Handle ID: 0x1f8c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_shared_font.scale-100_8e7668733f923a2e08748c97b60eb26818f7923733efc4f7226f1bb03e616116_38b23db9dbb4f2df.cdf-ms Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_shared_font_b8a2ea53359da4a3900cc4cc01a6770450c9b2da793fb102bd435882c859e774_4e3c7140d5bb4779.cdf-ms Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_shared_font_32c05a20581000107220e94c99833601f300546e7fb80a6f7e5e392430222546_8dbe2c5cca68f414.cdf-ms Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_shared_folder.scale-400_661654a01d53d0ae4fe890de4dc97ef0831db574aae2eed2f09de13d83ca4d_5c4800d2864c1a05.cdf-ms Handle ID: 0x1f8c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_shared_folder.scale-400_1304c3d45a0ff0e175ed312b9c606e282642b9cfada50c436b686cbf00358a_4602b173ebbf54ba.cdf-ms Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_shared_folder.scale-200_cf5c3d72f38def76edd67e121b2cf8a15ebe2ed7b59fa15bb770c414e0586f_8e9940086d422526.cdf-ms Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_shared_folder.scale-200_a7187b3d33121b3d90e0a62e2a661d5bdb48097e8793d239046dc7d5a3b0a2_eb4676603039105d.cdf-ms Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_shared_folder.scale-100_f0288864dc54e868c02921b951f573c7c8c938420ae0b71d449becb753bf04_2bb4271f59e46692.cdf-ms Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_shared_folder.scale-100_23ace72a86ed46416d08404797868d390e48802c289427edc1fc32469c3854_ebc7fc6316e759a5.cdf-ms Handle ID: 0x1868 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_shared_folder_72c6c2efbac68a128bbdec1dc74b8effa0213746b7b785ad35df378c372302f4_3d1f5d229ef956a4.cdf-ms Handle ID: 0x1868 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_shared_folder_534ab13405166b10ea22fecdedea30fa0e94895added795cad81a32428979c93_f5ed49f98d0060a3.cdf-ms Handle ID: 0x1868 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_shared_fluid.scale-400_7a578974d0410e0046879a84ef8599c9a9575cff2c2d41cd9b140b6e5c43a87_0c14ac0ab4ae31b4.cdf-ms Handle ID: 0x1868 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_shared_fluid.scale-400_36f0554eaf05c66e3a03b911d2ceff3961e9683f0cd8d587e95d900b23944ba_fa7a761df5e4d9b4.cdf-ms Handle ID: 0x1868 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_shared_fluid.scale-200_dc460cce973f38894f5abc2852cb5bfc28b45ff149c2f496e38c1c752f79a5b_9a0b6636308debf8.cdf-ms Handle ID: 0x1868 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_shared_fluid.scale-200_2648a4e5aee44f800b8e238179feda0735140a691d438180c8798399d9f2c52_d2372525b44fe874.cdf-ms Handle ID: 0x1868 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_shared_fluid.scale-100_52757bd980ca8ad46022ab232d10acf056e5677315ed980c98cce17afb44b0c_f784bc66d9ea7584.cdf-ms Handle ID: 0x734 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_shared_fluid.scale-100_0214e3733979a6a1b4fa78e5d8bbce753aa981ed6a2a32086342b6843f63c44_ee358cc0a6784b16.cdf-ms Handle ID: 0x1868 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_shared_fluid_b842c9ed41b27f1ee119b384834b892df1d3df925f71af06b6065a7953288dcb_2914ba98dec360f6.cdf-ms Handle ID: 0x1868 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_shared_fluid_77aa484c12b2e5f405dd4551051b4d56c2e89e8e5b3db33fffe4dca27d502526_afd154674b0f7a34.cdf-ms Handle ID: 0x1868 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_shared_exe.scale-400_bc6d04316ab12019fa5e5b8dd024c705e1b8f8ca6fdfc50a130be4687f96b707_2e9c9e0038d39c5b.cdf-ms Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_shared_exe.scale-400_7371a43a882b71ccfa72aad890c8eea7191ad1631ddc3dadd5295d7cc34f1cf3_7468cc321a053fde.cdf-ms Handle ID: 0x1868 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_shared_exe.scale-200_af778df4102a41591181e624948583df1ceeb582109f236bde07dc6f0dbe1c0d_b155ea24fbab7ffc.cdf-ms Handle ID: 0x1868 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_shared_exe.scale-200_54ad8a1394a7780094981a8b71b6a1973c9423ba27d869956861d44245aaa900_9b304d997f68a2c9.cdf-ms Handle ID: 0x718 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_shared_exe.scale-100_de0f1ff7e7b4946dfa1152a76bf42d2da32288c4b85404552893014ec6c02fbd_9a6144a77ea6d8c8.cdf-ms Handle ID: 0x718 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_shared_exe.scale-100_bdd71cd6862b012f441191aaff6c129698abb360c1227c893d906199d70f6289_3be55e3615cfdb44.cdf-ms Handle ID: 0x718 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_shared_exe_fd92a99627392f018506869faa567abede34f278e357737d6377198edf5430fd_b9084c89c56304e2.cdf-ms Handle ID: 0x718 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_shared_exe_67d3f74be1d0c97c65dc191549fed4337ff73937fc20f9945e0acc8b142865d2_10ae5d40adf2bd57.cdf-ms Handle ID: 0x718 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_shared_errorimage_60b9100215bc80d13742c15d59fc2ea903c35015ddc495b6bed6cdf60d278848_65f52371003f8b5c.cdf-ms Handle ID: 0x728 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_shared_email.scale-400_bdd95d107b0fdf43ce7bd0067a263586863abe5842a35379d001e5547dd50d9_9aa8065b76eef9ef.cdf-ms Handle ID: 0x1b9c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_shared_email.scale-400_77bea41105ededf9b36d51a42202d1aade055c12d9900dbf9366a24d18ccaa5_d59db3d9fb7735de.cdf-ms Handle ID: 0x728 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_shared_email.scale-200_8996e683e9eb342bf40b6a3e206145adb8af5ebec8e1eb675d89c00c2af8b5d_bdd96024e6fbd4b8.cdf-ms Handle ID: 0x1b9c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_shared_email.scale-200_6e1cb83db66ffeb6db2150d8db5528c04f4155cfd244d10f19e4c2449368882_dc9d576f5b36a916.cdf-ms Handle ID: 0x1b9c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_shared_email.scale-100_d710a599df0ba104b2bb77a844a9248745a0573a49bfa39e7de53ccacc4a2f7_1642b090316e1c53.cdf-ms Handle ID: 0x1b9c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_shared_email.scale-100_565fb61fb49736969811b8b5b7b56c59b52a7468bc6b8332bfef7b11bbabf6f_80ebaa84389f00ec.cdf-ms Handle ID: 0x1b9c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_shared_email_55f724301af17f6584021f26ca93a9a712d56d630c73064ce8a428ab761f16f7_e6560efe5272a80e.cdf-ms Handle ID: 0x1b9c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_shared_email_38569b2ee68636d5b0ff6d84b6a001613ed0edc9c54b3b2103dad61e2ac095cd_6ac638518146b286.cdf-ms Handle ID: 0x780 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_shared_e_sqlite3_dccbabb2bc7e7d4302c44d9ce41b70721a7d0914fa4d289e2f340d39766ad102_5e166b3aa5e0b092.cdf-ms Handle ID: 0x780 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_shared_dotx.scale-400_f0598bde040eaf7e9ebd8ffc45ede066d23c9bb49da3a32a9b4910b830b32a57_d1f0ad671263bfe2.cdf-ms Handle ID: 0xae8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_shared_dotx.scale-400_80bc31d7ec9064370981a5afb98975a5a2d9ea73fb63cac5a3455604aec4847e_ee97108e208c8f06.cdf-ms Handle ID: 0xae8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_shared_dotx.scale-200_8c831abc3d93d3f232aee70308608e04b69f9b5d49e6c4997fadc509ac29ece2_c88c8e540d2a5ebb.cdf-ms Handle ID: 0xae8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_shared_dotx.scale-200_305ff9a8b5fd1ac789ede55f005d0c27afc919bc215a6fbdc79a5931694fee87_0298187a75bc85f0.cdf-ms Handle ID: 0xae8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_shared_dotx.scale-100_ef649a20f609cd4f33bd8d9b8c8a64b50cf054112090daa73295407af9710e55_4b2a1049c70b7d2f.cdf-ms Handle ID: 0xae8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_shared_dotx.scale-100_399e74943f722a11e49e8f6213655a8894eaea84a27e3c4e90b6007fe9d803d1_dfc57562e2c56f5b.cdf-ms Handle ID: 0xae8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_shared_dotx_96fdd1e555b226db9da22c4f295f80296ab2a0d67fe94a38b44cd02518b2a956_5326ebcff4802fba.cdf-ms Handle ID: 0xae8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_shared_dotx_2867f8a0ec249c3132fc7505abee191c8a68a1dc67cd290d468b1291db36d4de_bb2e9088db96326f.cdf-ms Handle ID: 0x8b8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_shared_docx.scale-400_9ceabfb9c70fb7f120dd39123ad5dc11a4891b20b16069903b5bddd657f43969_38a49e7a4d246740.cdf-ms Handle ID: 0x8b8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_shared_docx.scale-400_2c2d26cb2029a8809af07cfb4ae9b3dd8f51deb0a31061acb4e5eb2bf58a3d64_8f0cf60da59799d4.cdf-ms Handle ID: 0x8b8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_shared_docx.scale-200_99799d0ca5a714b9fd32e2ad3450247e3a503c32d46d3f03e3a49cdec8460984_b233731d21d5bc44.cdf-ms Handle ID: 0x8b8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_shared_docx.scale-200_0894b65b4eb64c3ff744135d5e5f33303ea255d9a33307c5f3ac6a2cc8b86afc_0a7b3b92fa0b08e5.cdf-ms Handle ID: 0x8b8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_shared_docx.scale-100_df68ae14ee9a2f4f2dd95dc22ac1bd34a3ac39a693bbb333083c85164dd3fca5_80aba7e14a1a172c.cdf-ms Handle ID: 0x8b8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_shared_docx.scale-100_6e00b119e08a8b8f26de8fd88f95538c2a74c9673bde37e56f37b48305326743_227923bbca6d7060.cdf-ms Handle ID: 0x8b8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_shared_docx_e4bc79e45774b7f89e7d7c20db91d89f6e3b57365f6a711b4741429f421bd512_ac08a9293e4efdeb.cdf-ms Handle ID: 0x8b8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_shared_docx_0807b625ac9b7b70da60566fb8e77ff7eec3e9d1d1e3e6ef69308e1095674222_589f25e55056fa32.cdf-ms Handle ID: 0x8b8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_shared_csv.scale-400_c83b1a780e29a4adb0d70c410131b7cef1887ed2ac81b0502c4772b0773acaa5_18c465e2c8356b9f.cdf-ms Handle ID: 0x8b8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_shared_csv.scale-400_23d3730c4ff49289425191c647a589bb58d4aa90b0b987d77a042f02544e6923_c633cd976ccff044.cdf-ms Handle ID: 0x8b8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_shared_csv.scale-200_9f4cbc18c9659bbedd46f5cf5bc44414d2014f2a0eb0d13742a68b1a33ce2683_097bafaea8dc3caf.cdf-ms Handle ID: 0x9b8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_shared_csv.scale-200_6a9bbd07e114b9020ef3c09b25d04788a0c02fb0eec4704a055f1f6ee77f60df_873384d8649ec740.cdf-ms Handle ID: 0x9b8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_shared_csv.scale-100_81d109e8d9f31ecf5eba11e3f9d00da8e588b94676a925fa380e39d853a6ce15_24eb81d79f922bb1.cdf-ms Handle ID: 0x8b8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_shared_csv.scale-100_7a4b1b1a2e3cb1abff40615d0bf620558034975babb4ee6241fe10413e1b10c6_4bec300d89a03700.cdf-ms Handle ID: 0xae8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_shared_csv_7f0d9ca20faead2de3237ef425a4ae7d6eb2c27e3b0dcf3d3da7a5b989a28eca_54cac87e42960981.cdf-ms Handle ID: 0x9b8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_shared_csv_247e06b667ea38bdd0b02209e9231a17131136cdfa0e4f02c58e0fe9bf153e15_449bdb0ed2f85ced.cdf-ms Handle ID: 0x1b88 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_shared_contact.scale-400_670896d7f34b210ad38cbf2b8a97b54f29103b7f5711169a916b58901bcae_f4a53162d0f4fa06.cdf-ms Handle ID: 0x1b88 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_shared_contact.scale-400_243204f2a485133ee5403a8451eadbe87a42ab4629a74dbcfbbc0385bf31d_70e25482aea686e2.cdf-ms Handle ID: 0x1b88 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_shared_contact.scale-200_e73a40a5fee3b9d35c12dcea714281900adf1719882d1eea90759b63714c4_b12758647d49eb04.cdf-ms Handle ID: 0x1b88 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_shared_contact.scale-200_596050365e03a366cb9e2a7c608861a4b74b76ab1c7dd9bbb22bb8f9dac3d_7a872ad7d55e1e2d.cdf-ms Handle ID: 0x1b88 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_shared_contact.scale-100_73f01e1b413b424059117b7b1d57ffa605b2d1f53bdf3960bdc62b885055d_afb92bd3bdabbc44.cdf-ms Handle ID: 0x1b88 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_shared_contact.scale-100_2c720fc949320712c482fba3692c7fb441de68ba6328748993ba2ded828d9_58617e1d748d5bfe.cdf-ms Handle ID: 0x1b88 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_shared_contact_c2aca8fe54946ef8743bafec988ae843b670c21e73cb710f51e8fe8cc9701fc0_3ad88364e3d3041c.cdf-ms Handle ID: 0x1b88 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_shared_contact_b59272ee713bbed1bfc3ed05b94bf55c03af85bc764e72059203a3adfc8e8714_59f0ab32b6d48705.cdf-ms Handle ID: 0x1b88 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_shared_code.scale-400_aae6831a563fd9b38ce403a9a81d9fe5109ea431cdcfa2c02a27b0b6dbfd3937_baa81065522f9bd0.cdf-ms Handle ID: 0x1b88 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_shared_code.scale-400_6402de12219c724a1d41238fed54cce2b759ace83fce82c7c9703bd3621d8931_17bba3b6a9be69c7.cdf-ms Handle ID: 0x1b88 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_shared_code.scale-200_1f99698cfdeacf13970ac1763871705e7c5884006c12ce5d26bddea91b115e76_a243d91b4f5cb77b.cdf-ms Handle ID: 0x1b88 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_shared_code.scale-200_017bcf4fa9154392e4c6d980784ed629e017110f476957de5f0dbf5141a34219_55daa354d2e9e1c9.cdf-ms Handle ID: 0xbd0 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_shared_code.scale-100_d29c79f8ce99291a8718647c16fcfa8cb9455d837076330b9366b2da2f7f3872_764c458ab3d8b16c.cdf-ms Handle ID: 0xbd0 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_shared_code.scale-100_4d44821a824bb13718f67dc5f46d50d35e94743491dab7ffea5e1f6c712e3d59_e8cea9d7dc187dcb.cdf-ms Handle ID: 0x734 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_shared_code_6552339c028a307b940376cf18e4e60dd917f8e7285a469104f0f6d392c1e782_9120208e7b2bd02c.cdf-ms Handle ID: 0x734 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_shared_code_11a9961118e6d937f9149af7fb84cc5a7ca5d39815b0473595d8ba497320c195_bc2061326a2850e9.cdf-ms Handle ID: 0x734 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_shared_calendar.scale-400_f40d2268b22608bdcb872fb113c432c01bda07688416d6b9f682ed52943e_972b59552c46aba1.cdf-ms Handle ID: 0x734 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_shared_calendar.scale-400_b14eb6c87d3c058338ea9bd492ea16e4aab7d1a453f790f69a8611872a8d_8b974103ef0de703.cdf-ms Handle ID: 0x734 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_shared_calendar.scale-200_c098670d90b54e97d08b4e5ffefd25a6f6949790b92e18e8b524210083e4_86f44f2bcac28045.cdf-ms Handle ID: 0x734 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_shared_calendar.scale-200_b1c7f91102007f4aea0a0f4f66ec8d0ce5426700b97ec2a54b0b3178b159_77e3886490fbb0a4.cdf-ms Handle ID: 0x734 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_shared_calendar.scale-100_ffe70dcb3eb0639c539d8878a5e7346666acbd53e175231fc0041941d6f9_50c2d211dd107e51.cdf-ms Handle ID: 0x734 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_shared_calendar.scale-100_0cd4bee518d672ca4bad36423bd1ff3b8df197727657ff2290e0710c6831_3e16b0ea1b79b64d.cdf-ms Handle ID: 0x734 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_shared_calendar_1de3bf1209ba01c0e3c5bf6848c7345a47aaaab1d38be63e5658195903d9448e_cce09df0a8edbe68.cdf-ms Handle ID: 0x734 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_shared_calendar_1c9d7efa142f4f46c4ba381e659dd8d307061d71dc1dd5951621371a6adaa00c_09d51dedbc062ac8.cdf-ms Handle ID: 0x734 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_shared_audio.scale-400_a2e0b160d837caf97dd06899eaf4a4505d49b39b0da656f9129effaf6352456_6134b2061efd9c21.cdf-ms Handle ID: 0x734 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_shared_audio.scale-400_25cf865b3aab4928535005109e834a401b2275327770c50c71595bf8a668e61_db2d44d425d9d85c.cdf-ms Handle ID: 0x734 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_shared_audio.scale-200_4e35b19db3e252c3f81f01e6969d4ead1a94a7f443d628faac18961ace499f1_1f51661f7404808c.cdf-ms Handle ID: 0x734 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_shared_audio.scale-200_41117167a4eef4340cee434dbe161a122282d4eabb42c356be09ca0d909860b_64cd9af08077fd00.cdf-ms Handle ID: 0x734 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_shared_audio.scale-100_a941b80f08cb8f82daf6db9f462f0d8766558a06d91b4245f62374591a68f4e_684e5b1a942b02ca.cdf-ms Handle ID: 0x1b88 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_shared_audio.scale-100_72f635b69cf681fea5f56a972b5fd72a05f3b2ca5b2181458b4947014f9d177_955ac461f124e844.cdf-ms Handle ID: 0x734 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_shared_audio_928d0780a738183d334e0d12176180f85fb65be762f80bf8c90f49f8a4177457_e18339832b04534f.cdf-ms Handle ID: 0x734 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_shared_audio_7814be17f03c1367ce306b2cbde40d10ded0fedd76a20a002b616a574c08dc55_5232dd394dc89fb1.cdf-ms Handle ID: 0x734 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_shared_archive.scale-400_5a0399b83127379dd3c380cd8d03f9b38b5a25191162fff92cdc677e46e26_93ed3e1328550c74.cdf-ms Handle ID: 0x734 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_shared_archive.scale-400_260288b5077f7a02888e20796d9c7c16928f3912c876277ea0bd5f0970e8c_8c0fc09b937bc519.cdf-ms Handle ID: 0x734 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_shared_archive.scale-200_4646136f49303b8c969ea44f5d2229e22fea50b60b5c031946c6535c7d5a3_2abbc88ce42a08a3.cdf-ms Handle ID: 0x734 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_shared_archive.scale-200_1c3e4890779240d4fff793cabb3ae9e616d6147e0f48436efd6bfea3613c3_5c24cce727abc406.cdf-ms Handle ID: 0x734 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_shared_archive.scale-100_4e53562a562c11c623af489c8999a7a9bc78a3b45612da00efba219e278d9_b63fcd186dc1a82c.cdf-ms Handle ID: 0x734 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_shared_archive.scale-100_3142e6824d988db78882a9e2c159768b95d6883a7016234b54f21c5724b07_7fe7d671d0c1c885.cdf-ms Handle ID: 0x734 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_shared_archive_b5c52f9b1050276f6d55a98b8f27a3ad8d57ba1456d83cffd3c00a9126707caf_6d02b782a13932db.cdf-ms Handle ID: 0x734 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_shared_archive_132848b246418e30422702e8b3ce3d5eb05443078d927feeabb6ec0ede10d5bc_5a6ec4fd1a65d292.cdf-ms Handle ID: 0x734 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_shared_aot_4a02bc458ffe84b0.cdf-ms Handle ID: 0x734 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_shared_allappcategorymappings_ad5f74ef4f881c8414b1341ca4a5a04ca9a1610f1613befec72a3ba1_bd544d7056f96df5.cdf-ms Handle ID: 0x9b8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_shared_aec_v1_1eaa07f073fa65f20469479300dfefc504849dc534209d665e4d06f767cc769c_a24871f094a0ef29.cdf-ms Handle ID: 0x9b8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_shared_adaptivecards.rendering.uwp_2b583bbd2838723cc3380a9c91f1495cd4dcd09c1783b9262fc_dbdc6151e9159e8a.cdf-ms Handle ID: 0x9b8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_shared_adaptivecards.objectmodel.uwp_ea6bcda30fd38ed2cc0d99fee96e88cd468fdc53800be0b6e_cb6e2f9c589997c8.cdf-ms Handle ID: 0x9b8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_shared_accdb.scale-400_f4ac38f23931e5e3011eec46a7a5c4f0f82021eebe64b90e1e36c1be2aab96d_ad80c1cb8bab6b9e.cdf-ms Handle ID: 0x9b8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_shared_accdb.scale-400_562593d0af681739b8701afb733f5295fe5fcd6edd9e0693d3397389b47ed52_a81b0cdbf1123f50.cdf-ms Handle ID: 0x9b8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_shared_accdb.scale-200_958459dd7bd5e8a15d180add2f34b8d88d75b4dd0ca1fe919657f4de0bf9e5c_eb48ee3b696341b2.cdf-ms Handle ID: 0x9b8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_shared_accdb.scale-200_5312fadc92cd87cde06aa0c934375779552b7742f5560a079fd4754152fd144_9c549aab180927df.cdf-ms Handle ID: 0x9b8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_shared_accdb.scale-100_a74cd04ef2b55cee5d4519c72422bc82a3230dcdba5492f24c1fcc08def4bbd_2716fce779ba9371.cdf-ms Handle ID: 0x9b8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_shared_accdb.scale-100_9d099375f5d92ccc795e84ab9c07cf15f9d424371dde1f7dd23a53b594eac2a_c3f22ef327090da5.cdf-ms Handle ID: 0x9b8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_shared_accdb_fe653521a57bd720cd06b6f66cd8c3e087197aa7bb04dece82da9ffef97f613f_cdc5770b935441d4.cdf-ms Handle ID: 0x9b8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_shared_accdb_2c6f270d9104e6500c879927b07d02fac8624bfcfc0d35663335e77fc25e2c85_665c32c6292aa89b.cdf-ms Handle ID: 0x9b8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_parentalcontrols_cw5n1h2txyewy_279dce154aea2ac9.cdf-ms Handle ID: 0x9b8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_parentalcontrols_cw5n1h2txyewy_pris_dce7f2ada50375cf.cdf-ms Handle ID: 0x9b8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_parentalcontrols_cw5n1h2txyewy_assets_a55aa1bc343589de.cdf-ms Handle ID: 0x9b8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoftwindows.undockeddevkit_cw5n1h2txyewy_77a329df185f5721.cdf-ms Handle ID: 0x9b8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoftwindows.undockeddevkit_cw5n1h2txyewy_assets_ebc1b7ef05677316.cdf-ms Handle ID: 0x9b8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoftwindows.client.photon_cw5n1h2txyewy_19ab8b24f8962b56.cdf-ms Handle ID: 0x9b8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoftwindows.client.photon_cw5n1h2txyewy_public_1ec24f4538a54b6d.cdf-ms Handle ID: 0x9b8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoftwindows.client.photon_cw5n1h2txyewy_public_wsxpacks_e7ccfb7f54269ec9.cdf-ms Handle ID: 0x9b8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoftwindows.client.photon_cw5n1h2txyewy_public_wsxpacks_startmenu_959a08751dd6f6dc.cdf-ms Handle ID: 0x9b8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoftwindows.client.photon_cw5n1h2txyewy_public_wsxpacks_startmenu_assets_913acce506f0f609.cdf-ms Handle ID: 0x9b8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoftwindows.client.photon_cw5n1h2txyewy_public_wsxpacks_startmenu_assets_strings_419f52bee1c2784d.cdf-ms Handle ID: 0x9b8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoftwindows.client.photon_cw5n1h2txyewy_public_wsxpacks_startmenu_assets_assets_4faf684abc2e0f38.cdf-ms Handle ID: 0x9b8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoftwindows.client.photon_cw5n1h2txyewy_public_wsxpacks_startmenu_assets_assets_i_140c849f514347ae.cdf-ms Handle ID: 0x9b8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoftwindows.client.photon_cw5n1h2txyewy_public_wsxpacks_settingssearchdata_fae00e48a8308ce4.cdf-ms Handle ID: 0x9b8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoftwindows.client.photon_cw5n1h2txyewy_public_wsxpacks_settingssearchdata_zh-cn_3c64e348d4c4168e.cdf-ms Handle ID: 0x9b8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoftwindows.client.photon_cw5n1h2txyewy_public_wsxpacks_settingssearchdata_pt-br_3c50de88d51e2c4b.cdf-ms Handle ID: 0x9b8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoftwindows.client.photon_cw5n1h2txyewy_public_wsxpacks_settingssearchdata_ja-jp_3c44da70d5543c1c.cdf-ms Handle ID: 0x9b8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoftwindows.client.photon_cw5n1h2txyewy_public_wsxpacks_settingssearchdata_it-it_3c42da1ed55d3df1.cdf-ms Handle ID: 0x9b8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoftwindows.client.photon_cw5n1h2txyewy_public_wsxpacks_settingssearchdata_fr-fr_3c3cd90cd57843b3.cdf-ms Handle ID: 0x9b8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoftwindows.client.photon_cw5n1h2txyewy_public_wsxpacks_settingssearchdata_fr-ca_3c3cd956d5784359.cdf-ms Handle ID: 0x9b8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoftwindows.client.photon_cw5n1h2txyewy_public_wsxpacks_settingssearchdata_es-mx_3c3ad79ed58147ec.cdf-ms Handle ID: 0x9b8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoftwindows.client.photon_cw5n1h2txyewy_public_wsxpacks_settingssearchdata_es-es_3c3ad8b4d5814591.cdf-ms Handle ID: 0x9b8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoftwindows.client.photon_cw5n1h2txyewy_public_wsxpacks_settingssearchdata_en-us_3c3ad674d5814a9c.cdf-ms Handle ID: 0x9b8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoftwindows.client.photon_cw5n1h2txyewy_public_wsxpacks_settingssearchdata_en-in_3c3ad81ad58146fd.cdf-ms Handle ID: 0x9b8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoftwindows.client.photon_cw5n1h2txyewy_public_wsxpacks_settingssearchdata_en-gb_3c3ad84ad58146c7.cdf-ms Handle ID: 0x9b8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoftwindows.client.photon_cw5n1h2txyewy_public_wsxpacks_settingssearchdata_en-ca_3c3ad8d8d581458c.cdf-ms Handle ID: 0x9b8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoftwindows.client.photon_cw5n1h2txyewy_public_wsxpacks_settingssearchdata_en-au_3c3ad948d5814436.cdf-ms Handle ID: 0x9b8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoftwindows.client.photon_cw5n1h2txyewy_public_wsxpacks_settingssearchdata_de-de_3c38d83ed58a47e7.cdf-ms Handle ID: 0x9b8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoftwindows.client.photon_cw5n1h2txyewy_public_wsxpacks_accountcontrol_9c6c76028e8e64ed.cdf-ms Handle ID: 0x9b8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoftwindows.client.photon_cw5n1h2txyewy_public_wsxpacks_accountcontrol_assets_900deeeca25eecdc.cdf-ms Handle ID: 0x9b8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoftwindows.client.photon_cw5n1h2txyewy_public_wsxpacks_accountcontrol_assets_str_faa4a5a00767dd18.cdf-ms Handle ID: 0x9b8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoftwindows.client.photon_cw5n1h2txyewy_public_wsxpacks_accountcontrol_assets_ass_fd2b3c4244b65309.cdf-ms Handle ID: 0x9b8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoftwindows.client.photon_cw5n1h2txyewy_public_wsxpacks_accountcontrol_assets_ass_72519997ffc04513.cdf-ms Handle ID: 0x9b8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoftwindows.client.photon_cw5n1h2txyewy_public_wsxpacks_account_3d03dc0c24f38c20.cdf-ms Handle ID: 0x9b8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoftwindows.client.photon_cw5n1h2txyewy_public_wsxpacks_account_assets_a61ee5a67f5e9553.cdf-ms Handle ID: 0x9b8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoftwindows.client.photon_cw5n1h2txyewy_public_wsxpacks_account_assets_strings_3ec808f0691253d7.cdf-ms Handle ID: 0x9b8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoftwindows.client.photon_cw5n1h2txyewy_public_wsxpacks_account_assets_assets_6533bef52fdbdea6.cdf-ms Handle ID: 0x9b8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoftwindows.client.photon_cw5n1h2txyewy_public_wsxpacks_account_assets_assets_ima_0125836afb85fa2c.cdf-ms Handle ID: 0x9b8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoftwindows.client.photon_cw5n1h2txyewy_public_wsxpacks_account_assets_assets_ima_cc21ecbe2a4f9502.cdf-ms Handle ID: 0x9b8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoftwindows.client.photon_cw5n1h2txyewy_pris_673f46d9eba74e52.cdf-ms Handle ID: 0x9b8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoftwindows.client.photon_cw5n1h2txyewy_assets_1af57bff3e4986a5.cdf-ms Handle ID: 0x9b8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoftwindows.client.oobe_cw5n1h2txyewy_bf0381b31e201cc3.cdf-ms Handle ID: 0x9b8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoftwindows.client.oobe_cw5n1h2txyewy_windowsoobeapphost_99c08eebd0f48b40.cdf-ms Handle ID: 0x734 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoftwindows.client.oobe_cw5n1h2txyewy_webapps_46bb38544afd0d9d.cdf-ms Handle ID: 0x734 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoftwindows.client.oobe_cw5n1h2txyewy_webapps_templates_bacf80df668d5972.cdf-ms Handle ID: 0x734 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoftwindows.client.oobe_cw5n1h2txyewy_webapps_templates_view_682b2a89689a1807.cdf-ms Handle ID: 0x734 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoftwindows.client.oobe_cw5n1h2txyewy_webapps_templates_js_616bf95c0e986bcf.cdf-ms Handle ID: 0x734 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoftwindows.client.oobe_cw5n1h2txyewy_webapps_scoobe_260807f3e25c5536.cdf-ms Handle ID: 0x734 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoftwindows.client.oobe_cw5n1h2txyewy_webapps_scoobe_view_65eb0b130054c1a1.cdf-ms Handle ID: 0x734 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoftwindows.client.oobe_cw5n1h2txyewy_webapps_scoobe_media_928071933d74a6a4.cdf-ms Handle ID: 0x734 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoftwindows.client.oobe_cw5n1h2txyewy_webapps_scoobe_js_cc07988b3e6d5445.cdf-ms Handle ID: 0x734 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoftwindows.client.oobe_cw5n1h2txyewy_webapps_inclusiveoobe_417a65954783e31a.cdf-ms Handle ID: 0x1b88 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoftwindows.client.oobe_cw5n1h2txyewy_webapps_inclusiveoobe_view_c187e7cb665c716f.cdf-ms Handle ID: 0x1b88 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoftwindows.client.oobe_cw5n1h2txyewy_webapps_inclusiveoobe_view_templates_f68262fd6ff848b2.cdf-ms Handle ID: 0x734 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoftwindows.client.oobe_cw5n1h2txyewy_webapps_inclusiveoobe_media_c187e03b6cbc5c68.cdf-ms Handle ID: 0x734 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoftwindows.client.oobe_cw5n1h2txyewy_webapps_inclusiveoobe_js_1a690ec7e97ac279.cdf-ms Handle ID: 0x734 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoftwindows.client.oobe_cw5n1h2txyewy_webapps_inclusiveoobe_js_common_98cca3adfd3de936.cdf-ms Handle ID: 0x734 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoftwindows.client.oobe_cw5n1h2txyewy_webapps_inclusiveoobe_css_83b5d0967c8e0e55.cdf-ms Handle ID: 0x734 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoftwindows.client.oobe_cw5n1h2txyewy_pris_595655f2c70d38ff.cdf-ms Handle ID: 0x734 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoftwindows.client.oobe_cw5n1h2txyewy_microsoft.winjs-reduced_24ea490bbebf48f9.cdf-ms Handle ID: 0x734 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoftwindows.client.oobe_cw5n1h2txyewy_microsoft.winjs-reduced_js_612d397d49cea0c0.cdf-ms Handle ID: 0x734 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoftwindows.client.oobe_cw5n1h2txyewy_microsoft.winjs-reduced_css_612d3a793a0b01e6.cdf-ms Handle ID: 0x734 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoftwindows.client.oobe_cw5n1h2txyewy_media_28a965ac34924783.cdf-ms Handle ID: 0x734 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoftwindows.client.oobe_cw5n1h2txyewy_lib_8443ba9486a923be.cdf-ms Handle ID: 0x734 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoftwindows.client.oobe_cw5n1h2txyewy_js_8443baf0b87a3f66.cdf-ms Handle ID: 0x734 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoftwindows.client.oobe_cw5n1h2txyewy_fonts_29a5b61e325aa209.cdf-ms Handle ID: 0x1b88 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoftwindows.client.oobe_cw5n1h2txyewy_data_59563554c70d6919.cdf-ms Handle ID: 0x734 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoftwindows.client.oobe_cw5n1h2txyewy_data_prod_f6421906f016672c.cdf-ms Handle ID: 0x734 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoftwindows.client.oobe_cw5n1h2txyewy_css_8443bbec86a9209c.cdf-ms Handle ID: 0x734 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoftwindows.client.oobe_cw5n1h2txyewy_core_59563d2cc70d5ce4.cdf-ms Handle ID: 0x734 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoftwindows.client.oobe_cw5n1h2txyewy_core_js_499ff44c445d6559.cdf-ms Handle ID: 0x734 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoftwindows.client.oobe_cw5n1h2txyewy_assets_49f0092da2a13a32.cdf-ms Handle ID: 0x734 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoftwindows.client.fileexp_cw5n1h2txyewy_6afcdcefb1268517.cdf-ms Handle ID: 0x734 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoftwindows.client.fileexp_cw5n1h2txyewy_pris_3347700cca60d80d.cdf-ms Handle ID: 0x734 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoftwindows.client.fileexp_cw5n1h2txyewy_fileexplorerextensions_09e8fe9ecfb13570.cdf-ms Handle ID: 0x734 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoftwindows.client.fileexp_cw5n1h2txyewy_fileexplorerextensions_assets_c98058332c4991cd.cdf-ms Handle ID: 0x734 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoftwindows.client.fileexp_cw5n1h2txyewy_fileexplorerextensions_assets_images_a67e329ea0d1c1b1.cdf-ms Handle ID: 0x734 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoftwindows.client.fileexp_cw5n1h2txyewy_fileexplorerextensions_assets_images_con_e07e7651bdc8e505.cdf-ms Handle ID: 0x734 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoftwindows.client.fileexp_cw5n1h2txyewy_fileexplorerextensions_assets_images_con_173fcf6ac0afecdd.cdf-ms Handle ID: 0x734 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoftwindows.client.fileexp_cw5n1h2txyewy_fileexplorerextensions_assets_images_con_4fe3075f562fffd3.cdf-ms Handle ID: 0x734 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoftwindows.client.fileexp_cw5n1h2txyewy_fileexplorerextensions_assets_images_con_b982eed0e8883be1.cdf-ms Handle ID: 0x734 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoftwindows.client.fileexp_cw5n1h2txyewy_fileexplorerextensions_assets_images_con_e0545f3bbe8624bd.cdf-ms Handle ID: 0x734 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoftwindows.client.fileexp_cw5n1h2txyewy_assets_dad30912523ea548.cdf-ms Handle ID: 0x734 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoftwindows.client.coreai_cw5n1h2txyewy_3bb88a8b39a656cf.cdf-ms Handle ID: 0x734 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoftwindows.client.coreai_cw5n1h2txyewy_pris_486763b854f2aac7.cdf-ms Handle ID: 0x734 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoftwindows.client.coreai_cw5n1h2txyewy_images_687751d4a9cc226b.cdf-ms Handle ID: 0x734 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoftwindows.client.coreai_cw5n1h2txyewy_discoveryoverlay_b82ed99e6ecfe4b1.cdf-ms Handle ID: 0x1b88 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoftwindows.client.coreai_cw5n1h2txyewy_discoveryoverlay_assets_17240027c16cf260.cdf-ms Handle ID: 0x734 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoftwindows.client.coreai_cw5n1h2txyewy_discoveryoverlay_assets_tutorialmode_cd6c0935aa8987bd.cdf-ms Handle ID: 0x734 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoftwindows.client.coreai_cw5n1h2txyewy_discoveryoverlay_assets_toolbar_14d8e33a5a4733af.cdf-ms Handle ID: 0x734 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoftwindows.client.coreai_cw5n1h2txyewy_discoveryoverlay_assets_titlebar_56e4218f8d4ad9d5.cdf-ms Handle ID: 0x734 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoftwindows.client.coreai_cw5n1h2txyewy_discoveryoverlay_assets_fonts_df057f31f5dd5182.cdf-ms Handle ID: 0x734 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoftwindows.client.coreai_cw5n1h2txyewy_discoveryoverlay_assets_firstrunexperienc_c258b6156680afbf.cdf-ms Handle ID: 0x734 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoftwindows.client.coreai_cw5n1h2txyewy_discoveryoverlay_assets_effects_0503226c710595ac.cdf-ms Handle ID: 0x734 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoftwindows.client.coreai_cw5n1h2txyewy_discoveryoverlay_assets_directactionicons_503bc1c4d4bc1fa1.cdf-ms Handle ID: 0x734 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoftwindows.client.coreai_cw5n1h2txyewy_discoveryoverlay_assets_directactionicons_79c19ba53edafdcf.cdf-ms Handle ID: 0x734 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoftwindows.client.coreai_cw5n1h2txyewy_discoveryoverlay_assets_directactionicons_79c18aef94de5347.cdf-ms Handle ID: 0x734 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoftwindows.client.coreai_cw5n1h2txyewy_discoveryoverlay_assets_directactionicons_2a84c556dee3a997.cdf-ms Handle ID: 0x734 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoftwindows.client.coreai_cw5n1h2txyewy_discoveryoverlay_assets_directactionicons_2a5aae40dfa0e94f.cdf-ms Handle ID: 0x734 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoftwindows.client.coreai_cw5n1h2txyewy_discoveryoverlay_assets_audio_df058be7f5d83c66.cdf-ms Handle ID: 0x734 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoftwindows.client.coreai_cw5n1h2txyewy_assets_73de1ce498a9f1dc.cdf-ms Handle ID: 0x1b88 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoftwindows.client.coreai_cw5n1h2txyewy_aixhost_c757a3eece980153.cdf-ms Handle ID: 0x734 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoftwindows.client.coreai_cw5n1h2txyewy_aixhost_assets_9b47ee10bae089e8.cdf-ms Handle ID: 0x734 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoftwindows.client.coreai_cw5n1h2txyewy_aixhost_assets_clicktodo_70a836f2cd59106e.cdf-ms Handle ID: 0x734 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoftwindows.client.core_cw5n1h2txyewy_9fdf437fe75132bf.cdf-ms Handle ID: 0x734 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoftwindows.client.core_cw5n1h2txyewy_widgets.taskbar_149348b3be85f53e.cdf-ms Handle ID: 0x734 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoftwindows.client.core_cw5n1h2txyewy_voiceaccesshost_2806ba0dc50df275.cdf-ms Handle ID: 0x734 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoftwindows.client.core_cw5n1h2txyewy_voiceaccesshost_strings_e68eb571843ba631.cdf-ms Handle ID: 0x734 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoftwindows.client.core_cw5n1h2txyewy_voiceaccesshost_strings_zh-hk_5170e79a3c59d66f.cdf-ms Handle ID: 0x734 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoftwindows.client.core_cw5n1h2txyewy_voiceaccesshost_strings_fr-fr_5441941636044f52.cdf-ms Handle ID: 0x734 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoftwindows.client.core_cw5n1h2txyewy_voiceaccesshost_strings_fr-ca_544190c83604527c.cdf-ms Handle ID: 0x734 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoftwindows.client.core_cw5n1h2txyewy_voiceaccesshost_strings_es-mx_5465a96635b32951.cdf-ms Handle ID: 0x734 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoftwindows.client.core_cw5n1h2txyewy_voiceaccesshost_strings_es-es_54659aea35b33e84.cdf-ms Handle ID: 0x734 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoftwindows.client.core_cw5n1h2txyewy_voiceaccesshost_strings_en-us_5465b94035b31121.cdf-ms Handle ID: 0x734 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoftwindows.client.core_cw5n1h2txyewy_voiceaccesshost_strings_de-de_5489a3bc3562297e.cdf-ms Handle ID: 0x734 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoftwindows.client.core_cw5n1h2txyewy_voiceaccesscommon_71ad3123ca43c8e4.cdf-ms Handle ID: 0x734 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoftwindows.client.core_cw5n1h2txyewy_voiceaccess_d1fc7915efccc1ab.cdf-ms Handle ID: 0x734 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoftwindows.client.core_cw5n1h2txyewy_voiceaccess_masmodels_ab3550b037d4b84c.cdf-ms Handle ID: 0x734 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoftwindows.client.core_cw5n1h2txyewy_valuebanner_e66943cdfbf8d5bc.cdf-ms Handle ID: 0x734 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoftwindows.client.core_cw5n1h2txyewy_valuebanner_assets_2f3b93b83a03317d.cdf-ms Handle ID: 0x734 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoftwindows.client.core_cw5n1h2txyewy_valuebanner_assets_images_615ca9c6b4a361c9.cdf-ms Handle ID: 0x734 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoftwindows.client.core_cw5n1h2txyewy_valuebanner_assets_fonts_5342435ad0184ee3.cdf-ms Handle ID: 0x734 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoftwindows.client.core_cw5n1h2txyewy_systemtray_316a4dcd8b540850.cdf-ms Handle ID: 0x734 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoftwindows.client.core_cw5n1h2txyewy_systemtray_assets_a3112db89c1c2e25.cdf-ms Handle ID: 0x734 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoftwindows.client.core_cw5n1h2txyewy_startmenu_51f3d34068b0157e.cdf-ms Handle ID: 0x734 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoftwindows.client.core_cw5n1h2txyewy_startmenu_assets_cfc6a4ee4f21adf1.cdf-ms Handle ID: 0x734 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoftwindows.client.core_cw5n1h2txyewy_startmenu_assets_unplatedfolder_f53c106fb9b92622.cdf-ms Handle ID: 0x734 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoftwindows.client.core_cw5n1h2txyewy_startmenu_assets_searchicons_850e449ceb94f78d.cdf-ms Handle ID: 0x734 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoftwindows.client.core_cw5n1h2txyewy_startmenu_assets_fileicons_8f86059d6f3be77d.cdf-ms Handle ID: 0x734 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoftwindows.client.core_cw5n1h2txyewy_startmenu_assets_fileicons_32_114cf1468d9b7362.cdf-ms Handle ID: 0x734 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoftwindows.client.core_cw5n1h2txyewy_startmenu_assets_fileicons_24_114cef188d9b76dd.cdf-ms Handle ID: 0x734 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoftwindows.client.core_cw5n1h2txyewy_speechsynthesizer_2fd5add8f8bf0c87.cdf-ms Handle ID: 0x734 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoftwindows.client.core_cw5n1h2txyewy_snaplayout_1de6cdd7ca0c858f.cdf-ms Handle ID: 0x734 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoftwindows.client.core_cw5n1h2txyewy_snaplayout_assets_4aa93b01e378c39c.cdf-ms Handle ID: 0x734 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoftwindows.client.core_cw5n1h2txyewy_snaplayout_assets_fonts_478725347ada0e2c.cdf-ms Handle ID: 0x734 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoftwindows.client.core_cw5n1h2txyewy_settingsmodelservice_1af68d951e86ec1a.cdf-ms Handle ID: 0x734 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoftwindows.client.core_cw5n1h2txyewy_settingsmodelservice_assets_1b4bb7994cf00bed.cdf-ms Handle ID: 0x734 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoftwindows.client.core_cw5n1h2txyewy_screenclipping_6837bae365e14dd7.cdf-ms Handle ID: 0x734 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoftwindows.client.core_cw5n1h2txyewy_screenclipping_assets_1f811b7c8bee6746.cdf-ms Handle ID: 0x734 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoftwindows.client.core_cw5n1h2txyewy_screenclipping_assets_sounds_faad5195e6624232.cdf-ms Handle ID: 0x734 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoftwindows.client.core_cw5n1h2txyewy_screenclipping_assets_fonts_3f42bdc27f751de6.cdf-ms Handle ID: 0x734 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoftwindows.client.core_cw5n1h2txyewy_pris_c937136adbb77923.cdf-ms Handle ID: 0x734 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoftwindows.client.core_cw5n1h2txyewy_logonwebhost_72b2d2e0793bdd0a.cdf-ms Handle ID: 0x734 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoftwindows.client.core_cw5n1h2txyewy_livecaptions_373081506b02485a.cdf-ms Handle ID: 0x734 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoftwindows.client.core_cw5n1h2txyewy_intentdefinitions_f03b395f82a97901.cdf-ms Handle ID: 0x734 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoftwindows.client.core_cw5n1h2txyewy_intentdefinitions_strings_71dcbf707b9a23bd.cdf-ms Handle ID: 0x734 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoftwindows.client.core_cw5n1h2txyewy_intentdefinitions_strings_hi-in_52d1299cefd65c90.cdf-ms Handle ID: 0x734 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoftwindows.client.core_cw5n1h2txyewy_intentdefinitions_strings_fr-fr_52d13aacefd44290.cdf-ms Handle ID: 0x734 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoftwindows.client.core_cw5n1h2txyewy_intentdefinitions_strings_fr-ca_52d13aa6efd4429a.cdf-ms Handle ID: 0x734 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoftwindows.client.core_cw5n1h2txyewy_intentdefinitions_strings_es-mx_52d13ca0efd33f3f.cdf-ms Handle ID: 0x734 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoftwindows.client.core_cw5n1h2txyewy_intentdefinitions_strings_es-es_52d13c90efd33f82.cdf-ms Handle ID: 0x734 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoftwindows.client.core_cw5n1h2txyewy_intentdefinitions_strings_en-us_52d13332efd34d2f.cdf-ms Handle ID: 0x734 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoftwindows.client.core_cw5n1h2txyewy_intentdefinitions_strings_en-gb_52d13316efd34d9c.cdf-ms Handle ID: 0x734 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoftwindows.client.core_cw5n1h2txyewy_intentdefinitions_strings_de-de_52d121faefd2671c.cdf-ms Handle ID: 0x734 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoftwindows.client.core_cw5n1h2txyewy_freuserinterface_7c39956c7a3f092a.cdf-ms Handle ID: 0x734 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoftwindows.client.core_cw5n1h2txyewy_freuserinterface_assets_f2aa2174c50ff87d.cdf-ms Handle ID: 0x734 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoftwindows.client.core_cw5n1h2txyewy_freuserinterface_assets_content_bf482b3196a2d0f6.cdf-ms Handle ID: 0x734 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoftwindows.client.core_cw5n1h2txyewy_freuserinterface_assets_content_zh-tw_39409fd4b7d79594.cdf-ms Handle ID: 0x734 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoftwindows.client.core_cw5n1h2txyewy_freuserinterface_assets_content_zh-hk_39408abcb7d7b3f4.cdf-ms Handle ID: 0x734 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoftwindows.client.core_cw5n1h2txyewy_freuserinterface_assets_content_zh-cn_394080d2b7d7c324.cdf-ms Handle ID: 0x734 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoftwindows.client.core_cw5n1h2txyewy_freuserinterface_assets_content_ja-jp_3b811b86b2c67126.cdf-ms Handle ID: 0x734 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoftwindows.client.core_cw5n1h2txyewy_freuserinterface_assets_content_hi-in_3bc92bb0b2244b37.cdf-ms Handle ID: 0x734 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoftwindows.client.core_cw5n1h2txyewy_freuserinterface_assets_content_fr-fr_3c113738b1822cd7.cdf-ms Handle ID: 0x734 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoftwindows.client.core_cw5n1h2txyewy_freuserinterface_assets_content_fr-ca_3c1133eab1823001.cdf-ms Handle ID: 0x734 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoftwindows.client.core_cw5n1h2txyewy_freuserinterface_assets_content_es-mx_3c354c88b13106d6.cdf-ms Handle ID: 0x734 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoftwindows.client.core_cw5n1h2txyewy_freuserinterface_assets_content_es-es_3c353e0cb1311c09.cdf-ms Handle ID: 0x734 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoftwindows.client.core_cw5n1h2txyewy_freuserinterface_assets_content_en-us_3c355c62b130eea6.cdf-ms Handle ID: 0x734 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoftwindows.client.core_cw5n1h2txyewy_freuserinterface_assets_content_en-gb_3c354432b1311123.cdf-ms Handle ID: 0x734 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoftwindows.client.core_cw5n1h2txyewy_freuserinterface_assets_content_de-de_3c5946deb0e00703.cdf-ms Handle ID: 0x734 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoftwindows.client.core_cw5n1h2txyewy_familyvalueprop_f34cb3b52f2383a1.cdf-ms Handle ID: 0x734 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoftwindows.client.core_cw5n1h2txyewy_familyvalueprop_assets_77158b96e768e6e8.cdf-ms Handle ID: 0x734 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoftwindows.client.core_cw5n1h2txyewy_familyvalueprop_assets_images_a38abae512ddcd80.cdf-ms Handle ID: 0x734 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoftwindows.client.core_cw5n1h2txyewy_copilotnudges_ce778410cb8e92d3.cdf-ms Handle ID: 0x734 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoftwindows.client.core_cw5n1h2txyewy_copilotnudges_assets_4ffd7a2bc0369f54.cdf-ms Handle ID: 0x734 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoftwindows.client.core_cw5n1h2txyewy_assets_b9f38875b6af122e.cdf-ms Handle ID: 0x734 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoftwindows.client.cbs_cw5n1h2txyewy_da484f523662e470.cdf-ms Handle ID: 0x734 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoftwindows.client.cbs_cw5n1h2txyewy_windowsmigration_6ce00a064ab6d1b3.cdf-ms Handle ID: 0x734 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoftwindows.client.cbs_cw5n1h2txyewy_windowsmigration_assets_d8beda1f32fc3c86.cdf-ms Handle ID: 0x734 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoftwindows.client.cbs_cw5n1h2txyewy_windowsinternal.composableshell.experiences._32bedd53fad7ec23.cdf-ms Handle ID: 0x734 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoftwindows.client.cbs_cw5n1h2txyewy_windowsbackup_1de07ee24c305ec9.cdf-ms Handle ID: 0x734 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoftwindows.client.cbs_cw5n1h2txyewy_windowsbackup_assets_92d587f407f7cc9e.cdf-ms Handle ID: 0x734 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoftwindows.client.cbs_cw5n1h2txyewy_windowsbackup_assets_migrationassets_6e58d8c0ccafb783.cdf-ms Handle ID: 0x734 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoftwindows.client.cbs_cw5n1h2txyewy_widgetswin2dwinui3_54e7b3e8c29a7e90.cdf-ms Handle ID: 0x734 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoftwindows.client.cbs_cw5n1h2txyewy_widgets.widgetpicker_a9efe6ca1d9e77fb.cdf-ms Handle ID: 0x734 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoftwindows.client.cbs_cw5n1h2txyewy_widgets.widgetpicker_assets_265ae2a852442594.cdf-ms Handle ID: 0x734 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoftwindows.client.cbs_cw5n1h2txyewy_widgets_496b5460bf713711.cdf-ms Handle ID: 0x734 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoftwindows.client.cbs_cw5n1h2txyewy_webapps_49f78c46be3ecb26.cdf-ms Handle ID: 0x734 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoftwindows.client.cbs_cw5n1h2txyewy_webapps_templates_363b2922306cc94b.cdf-ms Handle ID: 0x9b8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:36 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoftwindows.client.cbs_cw5n1h2txyewy_webapps_templates_view_92ca8ac5930c0d48.cdf-ms Handle ID: 0x9b8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoftwindows.client.cbs_cw5n1h2txyewy_webapps_templates_js_283009ecbdf5132a.cdf-ms Handle ID: 0x9b8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoftwindows.client.cbs_cw5n1h2txyewy_webapps_scoobe_e4924bfc737bc241.cdf-ms Handle ID: 0x9b8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoftwindows.client.cbs_cw5n1h2txyewy_webapps_scoobe_view_4aca5a2a5310db0c.cdf-ms Handle ID: 0x9b8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoftwindows.client.cbs_cw5n1h2txyewy_webapps_scoobe_media_4aca5299e953a58d.cdf-ms Handle ID: 0x9b8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoftwindows.client.cbs_cw5n1h2txyewy_webapps_scoobe_js_3435206db332c620.cdf-ms Handle ID: 0x9b8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoftwindows.client.cbs_cw5n1h2txyewy_webapps_inclusiveoobe_8c09dbc93da3ffe9.cdf-ms Handle ID: 0x9b8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoftwindows.client.cbs_cw5n1h2txyewy_webapps_inclusiveoobe_view_96b36ba75480eb32.cdf-ms Handle ID: 0x9b8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoftwindows.client.cbs_cw5n1h2txyewy_webapps_inclusiveoobe_view_templates_475a7354a3c3beaf.cdf-ms Handle ID: 0x9b8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoftwindows.client.cbs_cw5n1h2txyewy_webapps_inclusiveoobe_js_d6e206cfe67c23ee.cdf-ms Handle ID: 0x9b8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoftwindows.client.cbs_cw5n1h2txyewy_webapps_inclusiveoobe_js_common_35fc866d9a4ece85.cdf-ms Handle ID: 0x9b8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoftwindows.client.cbs_cw5n1h2txyewy_webapps_inclusiveoobe_css_53b203b82b442910.cdf-ms Handle ID: 0x9b8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoftwindows.client.cbs_cw5n1h2txyewy_webapps_guidedsetup_d3beacb206be0221.cdf-ms Handle ID: 0x9b8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoftwindows.client.cbs_cw5n1h2txyewy_webapps_guidedsetup_network_8f764ddbc9094af1.cdf-ms Handle ID: 0x9b8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoftwindows.client.cbs_cw5n1h2txyewy_webapps_guidedsetup_network_static_88b9440763fd1b9f.cdf-ms Handle ID: 0x9b8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoftwindows.client.cbs_cw5n1h2txyewy_webapps_guidedsetup_network_static_media_9c2335faad3aae0f.cdf-ms Handle ID: 0x9b8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoftwindows.client.cbs_cw5n1h2txyewy_webapps_guidedsetup_network_static_js_10c885541fe4c22e.cdf-ms Handle ID: 0x9b8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoftwindows.client.cbs_cw5n1h2txyewy_webapps_guidedsetup_network_static_css_ea1c6db7b6e7f710.cdf-ms Handle ID: 0x9b8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoftwindows.client.cbs_cw5n1h2txyewy_webapps_guidedsetup_network_area-content_ba7f4359d03bcdc6.cdf-ms Handle ID: 0x9b8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoftwindows.client.cbs_cw5n1h2txyewy_webapps_guidedsetup_network_area-content_zh-_1e441b2f7e7a6d88.cdf-ms Handle ID: 0x9b8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoftwindows.client.cbs_cw5n1h2txyewy_webapps_guidedsetup_network_area-content_zh-_1e43fc2d7e7a9b18.cdf-ms Handle ID: 0x9b8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoftwindows.client.cbs_cw5n1h2txyewy_webapps_guidedsetup_network_area-content_vi-_1ed443b17d361538.cdf-ms Handle ID: 0x9b8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoftwindows.client.cbs_cw5n1h2txyewy_webapps_guidedsetup_network_area-content_uz-_9486f98e914eb659.cdf-ms Handle ID: 0x9b8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoftwindows.client.cbs_cw5n1h2txyewy_webapps_guidedsetup_network_area-content_ur-_1ef841a77ce5111b.cdf-ms Handle ID: 0x9b8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoftwindows.client.cbs_cw5n1h2txyewy_webapps_guidedsetup_network_area-content_uk-_1ef84c7f7ce4fff3.cdf-ms Handle ID: 0x9b8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoftwindows.client.cbs_cw5n1h2txyewy_webapps_guidedsetup_network_area-content_ug-_1ef828777ce53776.cdf-ms Handle ID: 0x9b8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoftwindows.client.cbs_cw5n1h2txyewy_webapps_guidedsetup_network_area-content_tt-_1f1c4ceb7c93fa92.cdf-ms Handle ID: 0x9b8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoftwindows.client.cbs_cw5n1h2txyewy_webapps_guidedsetup_network_area-content_tr-_1f1c511f7c93f3ff.cdf-ms Handle ID: 0x9b8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoftwindows.client.cbs_cw5n1h2txyewy_webapps_guidedsetup_network_area-content_th-_1f1c52737c93f12f.cdf-ms Handle ID: 0x9b8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoftwindows.client.cbs_cw5n1h2txyewy_webapps_guidedsetup_network_area-content_te-_1f1c3cb37c941283.cdf-ms Handle ID: 0x9b8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoftwindows.client.cbs_cw5n1h2txyewy_webapps_guidedsetup_network_area-content_ta-_1f1c3cab7c9412a7.cdf-ms Handle ID: 0x9b8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoftwindows.client.cbs_cw5n1h2txyewy_webapps_guidedsetup_network_area-content_sv-_1f4059f17c42dea8.cdf-ms Handle ID: 0x9b8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoftwindows.client.cbs_cw5n1h2txyewy_webapps_guidedsetup_network_area-content_sr-_b01a5e2464fd424b.cdf-ms Handle ID: 0x9b8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoftwindows.client.cbs_cw5n1h2txyewy_webapps_guidedsetup_network_area-content_sr-_9b9b541e865073be.cdf-ms Handle ID: 0x9b8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoftwindows.client.cbs_cw5n1h2txyewy_webapps_guidedsetup_network_area-content_sr-_9b9b563a86506f50.cdf-ms Handle ID: 0x9b8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoftwindows.client.cbs_cw5n1h2txyewy_webapps_guidedsetup_network_area-content_sq-_1f4036bf7c43144e.cdf-ms Handle ID: 0x9b8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoftwindows.client.cbs_cw5n1h2txyewy_webapps_guidedsetup_network_area-content_sl-_1f40594d7c42e046.cdf-ms Handle ID: 0x9b8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoftwindows.client.cbs_cw5n1h2txyewy_webapps_guidedsetup_network_area-content_sk-_1f4059037c42e0f1.cdf-ms Handle ID: 0x9b8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoftwindows.client.cbs_cw5n1h2txyewy_webapps_guidedsetup_network_area-content_ru-_1f645ea57bf1d2ab.cdf-ms Handle ID: 0x9b8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoftwindows.client.cbs_cw5n1h2txyewy_webapps_guidedsetup_network_area-content_ro-_1f645f717bf1d0fb.cdf-ms Handle ID: 0x9b8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoftwindows.client.cbs_cw5n1h2txyewy_webapps_guidedsetup_network_area-content_quz_daf9b5d2b0220d5c.cdf-ms Handle ID: 0x9b8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoftwindows.client.cbs_cw5n1h2txyewy_webapps_guidedsetup_network_area-content_pt-_1fac6cb37b4fb037.cdf-ms Handle ID: 0x9b8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoftwindows.client.cbs_cw5n1h2txyewy_webapps_guidedsetup_network_area-content_pt-_1fac52677b4fd773.cdf-ms Handle ID: 0x9b8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoftwindows.client.cbs_cw5n1h2txyewy_webapps_guidedsetup_network_area-content_pl-_1fac6dc37b4fadf7.cdf-ms Handle ID: 0x9b8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoftwindows.client.cbs_cw5n1h2txyewy_webapps_guidedsetup_network_area-content_pa-_1fac601b7b4fc2eb.cdf-ms Handle ID: 0x9b8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoftwindows.client.cbs_cw5n1h2txyewy_webapps_guidedsetup_network_area-content_or-_1fd069197afeae63.cdf-ms Handle ID: 0x9b8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoftwindows.client.cbs_cw5n1h2txyewy_webapps_guidedsetup_network_area-content_nn-_1ff47b477aad8cac.cdf-ms Handle ID: 0x9b8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoftwindows.client.cbs_cw5n1h2txyewy_webapps_guidedsetup_network_area-content_nl-_1ff47baf7aad8bcb.cdf-ms Handle ID: 0x9b8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoftwindows.client.cbs_cw5n1h2txyewy_webapps_guidedsetup_network_area-content_ne-_1ff47b117aad8d4e.cdf-ms Handle ID: 0x9b8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoftwindows.client.cbs_cw5n1h2txyewy_webapps_guidedsetup_network_area-content_nb-_1ff47b2f7aad8d18.cdf-ms Handle ID: 0x9b8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoftwindows.client.cbs_cw5n1h2txyewy_webapps_guidedsetup_network_area-content_mt-_201881957a5c7cf5.cdf-ms Handle ID: 0x9b8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoftwindows.client.cbs_cw5n1h2txyewy_webapps_guidedsetup_network_area-content_ms-_201880df7a5c7e93.cdf-ms Handle ID: 0x9b8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoftwindows.client.cbs_cw5n1h2txyewy_webapps_guidedsetup_network_area-content_mr-_20187ad17a5c8685.cdf-ms Handle ID: 0x9b8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoftwindows.client.cbs_cw5n1h2txyewy_webapps_guidedsetup_network_area-content_ml-_20187ac57a5c86bb.cdf-ms Handle ID: 0x9b8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoftwindows.client.cbs_cw5n1h2txyewy_webapps_guidedsetup_network_area-content_mk-_201882c77a5c7a6d.cdf-ms Handle ID: 0x9b8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoftwindows.client.cbs_cw5n1h2txyewy_webapps_guidedsetup_network_area-content_mi-_2018828d7a5c7c65.cdf-ms Handle ID: 0x9b8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoftwindows.client.cbs_cw5n1h2txyewy_webapps_guidedsetup_network_area-content_lv-_203c88477a0b6c6f.cdf-ms Handle ID: 0x9b8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoftwindows.client.cbs_cw5n1h2txyewy_webapps_guidedsetup_network_area-content_lt-_203c888b7a0b6bdf.cdf-ms Handle ID: 0x9b8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoftwindows.client.cbs_cw5n1h2txyewy_webapps_guidedsetup_network_area-content_lo-_203c8b2d7a0b6609.cdf-ms Handle ID: 0x9b8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoftwindows.client.cbs_cw5n1h2txyewy_webapps_guidedsetup_network_area-content_lb-_203c88437a0b6cd2.cdf-ms Handle ID: 0x9b8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoftwindows.client.cbs_cw5n1h2txyewy_webapps_guidedsetup_network_area-content_ky-_2060915f79ba567f.cdf-ms Handle ID: 0x9b8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoftwindows.client.cbs_cw5n1h2txyewy_webapps_guidedsetup_network_area-content_kok_dbc5e914ae71a075.cdf-ms Handle ID: 0x9b8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoftwindows.client.cbs_cw5n1h2txyewy_webapps_guidedsetup_network_area-content_ko-_20608fbf79ba5a54.cdf-ms Handle ID: 0x9b8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoftwindows.client.cbs_cw5n1h2txyewy_webapps_guidedsetup_network_area-content_kn-_20608c8179ba5ecb.cdf-ms Handle ID: 0x9b8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoftwindows.client.cbs_cw5n1h2txyewy_webapps_guidedsetup_network_area-content_km-_2060912379ba573c.cdf-ms Handle ID: 0x9b8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoftwindows.client.cbs_cw5n1h2txyewy_webapps_guidedsetup_network_area-content_kk-_20608e9779ba5d00.cdf-ms Handle ID: 0x9b8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoftwindows.client.cbs_cw5n1h2txyewy_webapps_guidedsetup_network_area-content_ka-_206089df79ba6219.cdf-ms Handle ID: 0x9b8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoftwindows.client.cbs_cw5n1h2txyewy_webapps_guidedsetup_network_area-content_ja-_208496e17969491a.cdf-ms Handle ID: 0x9b8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoftwindows.client.cbs_cw5n1h2txyewy_webapps_guidedsetup_network_area-content_it-_20a89d6d7918389d.cdf-ms Handle ID: 0x9b8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoftwindows.client.cbs_cw5n1h2txyewy_webapps_guidedsetup_network_area-content_is-_20a89d8f79183855.cdf-ms Handle ID: 0x9b8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoftwindows.client.cbs_cw5n1h2txyewy_webapps_guidedsetup_network_area-content_id-_20a89f8d7918341d.cdf-ms Handle ID: 0x9b8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoftwindows.client.cbs_cw5n1h2txyewy_webapps_guidedsetup_network_area-content_hy-_20cc981f78c73912.cdf-ms Handle ID: 0x9b8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoftwindows.client.cbs_cw5n1h2txyewy_webapps_guidedsetup_network_area-content_hu-_20cca44178c727cf.cdf-ms Handle ID: 0x9b8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoftwindows.client.cbs_cw5n1h2txyewy_webapps_guidedsetup_network_area-content_hr-_20cca4a778c726f7.cdf-ms Handle ID: 0x9b8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoftwindows.client.cbs_cw5n1h2txyewy_webapps_guidedsetup_network_area-content_hi-_20cca70b78c7232b.cdf-ms Handle ID: 0x9b8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoftwindows.client.cbs_cw5n1h2txyewy_webapps_guidedsetup_network_area-content_he-_20cca74b78c722ad.cdf-ms Handle ID: 0x9b8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoftwindows.client.cbs_cw5n1h2txyewy_webapps_guidedsetup_network_area-content_gu-_20f0afff78760ed0.cdf-ms Handle ID: 0x9b8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoftwindows.client.cbs_cw5n1h2txyewy_webapps_guidedsetup_network_area-content_gl-_20f0a7a178761c1a.cdf-ms Handle ID: 0x9b8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoftwindows.client.cbs_cw5n1h2txyewy_webapps_guidedsetup_network_area-content_gd-_20f0adc17876114f.cdf-ms Handle ID: 0x9b8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoftwindows.client.cbs_cw5n1h2txyewy_webapps_guidedsetup_network_area-content_ga-_20f0b11b78760cab.cdf-ms Handle ID: 0x9b8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoftwindows.client.cbs_cw5n1h2txyewy_webapps_guidedsetup_network_area-content_fr-_2114b293782504cb.cdf-ms Handle ID: 0x9b8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoftwindows.client.cbs_cw5n1h2txyewy_webapps_guidedsetup_network_area-content_fr-_2114af45782507f5.cdf-ms Handle ID: 0x9b8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoftwindows.client.cbs_cw5n1h2txyewy_webapps_guidedsetup_network_area-content_fil_dc6e1164ad124c82.cdf-ms Handle ID: 0x9b8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoftwindows.client.cbs_cw5n1h2txyewy_webapps_guidedsetup_network_area-content_fi-_2114b3c578250243.cdf-ms Handle ID: 0x9b8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoftwindows.client.cbs_cw5n1h2txyewy_webapps_guidedsetup_network_area-content_fa-_2114b8237824fcd9.cdf-ms Handle ID: 0x9b8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoftwindows.client.cbs_cw5n1h2txyewy_webapps_guidedsetup_network_area-content_eu-_2138b96b77d3f3eb.cdf-ms Handle ID: 0x9b8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoftwindows.client.cbs_cw5n1h2txyewy_webapps_guidedsetup_network_area-content_et-_2138bb6177d3ef86.cdf-ms Handle ID: 0x9b8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoftwindows.client.cbs_cw5n1h2txyewy_webapps_guidedsetup_network_area-content_es-_2138c7e377d3deca.cdf-ms Handle ID: 0x9b8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoftwindows.client.cbs_cw5n1h2txyewy_webapps_guidedsetup_network_area-content_es-_2138b96777d3f3fd.cdf-ms Handle ID: 0x9b8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoftwindows.client.cbs_cw5n1h2txyewy_webapps_guidedsetup_network_area-content_en-_2138d7bd77d3c69a.cdf-ms Handle ID: 0x9b8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoftwindows.client.cbs_cw5n1h2txyewy_webapps_guidedsetup_network_area-content_en-_2138bf8d77d3e917.cdf-ms Handle ID: 0x9b8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoftwindows.client.cbs_cw5n1h2txyewy_webapps_guidedsetup_network_area-content_el-_2138bd4977d3ee39.cdf-ms Handle ID: 0x9b8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoftwindows.client.cbs_cw5n1h2txyewy_webapps_guidedsetup_network_area-content_de-_215cc2397782def7.cdf-ms Handle ID: 0x9b8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoftwindows.client.cbs_cw5n1h2txyewy_webapps_guidedsetup_network_area-content_da-_215cc1597782e101.cdf-ms Handle ID: 0x9b8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoftwindows.client.cbs_cw5n1h2txyewy_webapps_guidedsetup_network_area-content_cy-_2180d15b7731c0d6.cdf-ms Handle ID: 0x9b8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoftwindows.client.cbs_cw5n1h2txyewy_webapps_guidedsetup_network_area-content_cs-_2180c6577731d408.cdf-ms Handle ID: 0x9b8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoftwindows.client.cbs_cw5n1h2txyewy_webapps_guidedsetup_network_area-content_chr_869bc27e27e94541.cdf-ms Handle ID: 0x9b8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoftwindows.client.cbs_cw5n1h2txyewy_webapps_guidedsetup_network_area-content_ca-_6c2d1fe971efe253.cdf-ms Handle ID: 0x9b8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoftwindows.client.cbs_cw5n1h2txyewy_webapps_guidedsetup_network_area-content_ca-_2180cafb7731ccc1.cdf-ms Handle ID: 0x9b8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoftwindows.client.cbs_cw5n1h2txyewy_webapps_guidedsetup_network_area-content_bs-_de738fa3ba7d4d73.cdf-ms Handle ID: 0x9b8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoftwindows.client.cbs_cw5n1h2txyewy_webapps_guidedsetup_network_area-content_bn-_21a4dc3d76e0ab64.cdf-ms Handle ID: 0x9b8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoftwindows.client.cbs_cw5n1h2txyewy_webapps_guidedsetup_network_area-content_bg-_21a4cfe176e0bd5b.cdf-ms Handle ID: 0x9b8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoftwindows.client.cbs_cw5n1h2txyewy_webapps_guidedsetup_network_area-content_az-_f712972b739493b1.cdf-ms Handle ID: 0x9b8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoftwindows.client.cbs_cw5n1h2txyewy_webapps_guidedsetup_network_area-content_as-_21c8e523768f9748.cdf-ms Handle ID: 0x9b8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoftwindows.client.cbs_cw5n1h2txyewy_webapps_guidedsetup_network_area-content_ar-_21c8f9f1768f76ba.cdf-ms Handle ID: 0x9b8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoftwindows.client.cbs_cw5n1h2txyewy_webapps_guidedsetup_network_area-content_am-_21c8dca7768fa4c8.cdf-ms Handle ID: 0x9b8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoftwindows.client.cbs_cw5n1h2txyewy_webapps_guidedsetup_network_area-content_af-_21c90723768f6337.cdf-ms Handle ID: 0x9b8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoftwindows.client.cbs_cw5n1h2txyewy_webapps_guidedsetup_common-public_9602bdd29f84786e.cdf-ms Handle ID: 0x9b8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoftwindows.client.cbs_cw5n1h2txyewy_visualassist_7f4d43a832fa481d.cdf-ms Handle ID: 0x9b8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoftwindows.client.cbs_cw5n1h2txyewy_visualassist_assets_a9c27f9a3e03f19c.cdf-ms Handle ID: 0x9b8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoftwindows.client.cbs_cw5n1h2txyewy_textinput_a691fe569c7db009.cdf-ms Handle ID: 0x9b8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoftwindows.client.cbs_cw5n1h2txyewy_pris_07f2444136ecbb7a.cdf-ms Handle ID: 0x9b8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoftwindows.client.cbs_cw5n1h2txyewy_personacardmanager_890bad0a2619919f.cdf-ms Handle ID: 0x9b8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoftwindows.client.cbs_cw5n1h2txyewy_personacardmanager_assets_ef4f540eb81f203e.cdf-ms Handle ID: 0x9b8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoftwindows.client.cbs_cw5n1h2txyewy_personacardmanager_assets_images_4ae34727ed89e1d2.cdf-ms Handle ID: 0x9b8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoftwindows.client.cbs_cw5n1h2txyewy_microsoft.winjs-reduced_5526e6653c4a806a.cdf-ms Handle ID: 0x9b8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoftwindows.client.cbs_cw5n1h2txyewy_microsoft.winjs-reduced_js_b4ff528c05af4e79.cdf-ms Handle ID: 0x9b8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoftwindows.client.cbs_cw5n1h2txyewy_microsoft.winjs-reduced_css_dbdf5e0c56bef2ff.cdf-ms Handle ID: 0x9b8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoftwindows.client.cbs_cw5n1h2txyewy_media_f52fb46ed31093b8.cdf-ms Handle ID: 0x9b8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoftwindows.client.cbs_cw5n1h2txyewy_lib_07f23ddf46c57447.cdf-ms Handle ID: 0x9b8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoftwindows.client.cbs_cw5n1h2txyewy_js_f75793eb917d6283.cdf-ms Handle ID: 0x9b8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoftwindows.client.cbs_cw5n1h2txyewy_inputapp_2e34c2b1522dcef5.cdf-ms Handle ID: 0x9b8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoftwindows.client.cbs_cw5n1h2txyewy_inputapp_assets_2da43068333158be.cdf-ms Handle ID: 0x9b8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoftwindows.client.cbs_cw5n1h2txyewy_inputapp_assets_smartactions_8f4c6577829c5228.cdf-ms Handle ID: 0x9b8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoftwindows.client.cbs_cw5n1h2txyewy_inputapp_assets_fonts_c527b2ea8958a424.cdf-ms Handle ID: 0x9b8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoftwindows.client.cbs_cw5n1h2txyewy_inputapp_assets_dictation_39a0f8a370b329c3.cdf-ms Handle ID: 0x9b8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoftwindows.client.cbs_cw5n1h2txyewy_featurediscoverability_b124a0344662072d.cdf-ms Handle ID: 0x9b8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoftwindows.client.cbs_cw5n1h2txyewy_featurediscoverability_assets_e7e811d3ade7b920.cdf-ms Handle ID: 0x9b8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoftwindows.client.cbs_cw5n1h2txyewy_featurediscoverability_assets_voiceaccess_as_bd95389695526888.cdf-ms Handle ID: 0x9b8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoftwindows.client.cbs_cw5n1h2txyewy_featurediscoverability_assets_narrator_asset_4e850d552aa98357.cdf-ms Handle ID: 0x9b8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoftwindows.client.cbs_cw5n1h2txyewy_featurediscoverability_assets_magnifier_asse_6fd5fee155b77688.cdf-ms Handle ID: 0x754 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoftwindows.client.cbs_cw5n1h2txyewy_dragtray_24063f5b622bc36c.cdf-ms Handle ID: 0x754 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoftwindows.client.cbs_cw5n1h2txyewy_dragtray_assets_ae2df7b9f62389c7.cdf-ms Handle ID: 0x754 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoftwindows.client.cbs_cw5n1h2txyewy_desktopstickereditorwin32exe_cebfcad7e00ca431.cdf-ms Handle ID: 0x754 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoftwindows.client.cbs_cw5n1h2txyewy_desktopspotlight_72c93dc89527c802.cdf-ms Handle ID: 0x754 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoftwindows.client.cbs_cw5n1h2txyewy_desktopspotlight_assets_74c6500951c8ece1.cdf-ms Handle ID: 0x754 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoftwindows.client.cbs_cw5n1h2txyewy_desktopspotlight_assets_images_1ffc5d5a6c7cfdf1.cdf-ms Handle ID: 0x754 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoftwindows.client.cbs_cw5n1h2txyewy_data_07f22ff336ecd7d0.cdf-ms Handle ID: 0x754 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoftwindows.client.cbs_cw5n1h2txyewy_data_prod_d61df34ed4c4a781.cdf-ms Handle ID: 0x754 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoftwindows.client.cbs_cw5n1h2txyewy_css_07f22b8346c59079.cdf-ms Handle ID: 0x754 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoftwindows.client.cbs_cw5n1h2txyewy_crossdeviceresume_57ebd2af67fc3287.cdf-ms Handle ID: 0x754 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoftwindows.client.cbs_cw5n1h2txyewy_crossdeviceresume_assets_79e12529299d2898.cdf-ms Handle ID: 0x754 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoftwindows.client.cbs_cw5n1h2txyewy_cortana.ui_bcec9a48b397c5d8.cdf-ms Handle ID: 0x754 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoftwindows.client.cbs_cw5n1h2txyewy_cortana.ui_constraintindex_061629d40e47abd1.cdf-ms Handle ID: 0x754 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoftwindows.client.cbs_cw5n1h2txyewy_cortana.ui_cache_9e8768602b934ac2.cdf-ms Handle ID: 0x754 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoftwindows.client.cbs_cw5n1h2txyewy_cortana.ui_cache_wv2local_a49a9117c0653570.cdf-ms Handle ID: 0x754 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoftwindows.client.cbs_cw5n1h2txyewy_cortana.ui_cache_wv2local_desktopdefault_1359f107606027d5.cdf-ms Handle ID: 0x754 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoftwindows.client.cbs_cw5n1h2txyewy_cortana.ui_cache_wv2local_desktop_e2e2c47d5caf2894.cdf-ms Handle ID: 0x754 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoftwindows.client.cbs_cw5n1h2txyewy_cortana.ui_cache_svlocal_2d0ceffc73678db4.cdf-ms Handle ID: 0x754 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoftwindows.client.cbs_cw5n1h2txyewy_cortana.ui_cache_svlocal_desktopdefault_60d430b3b30517d9.cdf-ms Handle ID: 0x754 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoftwindows.client.cbs_cw5n1h2txyewy_cortana.ui_cache_svlocal_desktop_748eb87f04458450.cdf-ms Handle ID: 0x754 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoftwindows.client.cbs_cw5n1h2txyewy_cortana.ui_assets_c59aeb47f0f4059d.cdf-ms Handle ID: 0x754 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoftwindows.client.cbs_cw5n1h2txyewy_cortana.ui_assets_icons_cfb6f3b18db3edab.cdf-ms Handle ID: 0x754 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoftwindows.client.cbs_cw5n1h2txyewy_cortana.ui_assets_icons_contrast-white_7ce46ed217a793ed.cdf-ms Handle ID: 0x754 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoftwindows.client.cbs_cw5n1h2txyewy_cortana.ui_assets_icons_contrast-black_7fd907c811012375.cdf-ms Handle ID: 0x754 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoftwindows.client.cbs_cw5n1h2txyewy_cortana.ui_assets_fonts_cfb0ef798dcef91b.cdf-ms Handle ID: 0x754 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoftwindows.client.cbs_cw5n1h2txyewy_cortana.ui_assets_app_8e84f73051a998f6.cdf-ms Handle ID: 0x754 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoftwindows.client.cbs_cw5n1h2txyewy_core_07f22c1136ecdf2d.cdf-ms Handle ID: 0x754 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoftwindows.client.cbs_cw5n1h2txyewy_core_js_22adfb26f9db4f0a.cdf-ms Handle ID: 0x754 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoftwindows.client.cbs_cw5n1h2txyewy_assets_636244f24a04b545.cdf-ms Handle ID: 0x754 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoftwindows.client.cbs_cw5n1h2txyewy_assets_contrast-white_aa5f84a288082145.cdf-ms Handle ID: 0x754 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoftwindows.client.cbs_cw5n1h2txyewy_assets_contrast-black_8277bfc4c3e3c91d.cdf-ms Handle ID: 0x754 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoftwindows.client.cbs_cw5n1h2txyewy_actionui_20955e05654f953e.cdf-ms Handle ID: 0x754 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoftwindows.client.cbs_cw5n1h2txyewy_actionui_assets_6cc463129597043d.cdf-ms Handle ID: 0x754 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoftwindows.client.cbs_cw5n1h2txyewy_actionfxruntime_48233ac2fb23c39e.cdf-ms Handle ID: 0x754 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoftwindows.client.cbs_cw5n1h2txyewy_actionfxruntime_assets_9b0c3f0f91a1cc15.cdf-ms Handle ID: 0x754 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoftwindows.client.aix_cw5n1h2txyewy_6e48488ecd271838.cdf-ms Handle ID: 0x754 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoftwindows.client.aix_cw5n1h2txyewy_assets_83f3d2b5be759669.cdf-ms Handle ID: 0x754 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoft.windowsappruntime.vnext.cbs_8wekyb3d8bbwe_ef6a968a2e3dbd28.cdf-ms Handle ID: 0x1b88 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoft.windowsappruntime.vnext.cbs_8wekyb3d8bbwe_npudetect_e6d07a449f56937e.cdf-ms Handle ID: 0x754 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoft.windowsappruntime.vnext.cbs_8wekyb3d8bbwe_microsoft.ui.xaml_5e6c5b1b3fd5c844.cdf-ms Handle ID: 0x754 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoft.windowsappruntime.vnext.cbs_8wekyb3d8bbwe_microsoft.ui.xaml_assets_921de336bc9e8b8d.cdf-ms Handle ID: 0x754 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoft.windowsappruntime.vnext.cbs_8wekyb3d8bbwe_appxmetadata_47b73f3387ea6416.cdf-ms Handle ID: 0x754 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoft.windowsappruntime.cbs_8wekyb3d8bbwe_d5a81c814a8b7f09.cdf-ms Handle ID: 0x754 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoft.windowsappruntime.cbs_8wekyb3d8bbwe_npudetect_1b576a55fee71945.cdf-ms Handle ID: 0x9b8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoft.windowsappruntime.cbs_8wekyb3d8bbwe_microsoft.ui.xaml_e79cdc771405e0cb.cdf-ms Handle ID: 0x9b8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoft.windowsappruntime.cbs_8wekyb3d8bbwe_microsoft.ui.xaml_assets_bad6ca352b4a9ddc.cdf-ms Handle ID: 0x9b8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoft.windowsappruntime.cbs_8wekyb3d8bbwe_en-us_a709b01b8af743c9.cdf-ms Handle ID: 0x9b8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoft.windowsappruntime.cbs_8wekyb3d8bbwe_appxmetadata_958cdfc6c3c2b657.cdf-ms Handle ID: 0x9b8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy_d32a9d6ca3506cf2.cdf-ms Handle ID: 0x9b8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy_assets_84da0fa1380edf65.cdf-ms Handle ID: 0x9b8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoft.windows.secureassessmentbrowser_cw5n1h2txyewy_5c9bcd2fbb5568e6.cdf-ms Handle ID: 0x9b8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoft.windows.secureassessmentbrowser_cw5n1h2txyewy_pris_4411c1f8ffbde214.cdf-ms Handle ID: 0x9b8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoft.windows.secureassessmentbrowser_cw5n1h2txyewy_css_97fe2d3982e9ff53.cdf-ms Handle ID: 0x9b8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoft.windows.secureassessmentbrowser_cw5n1h2txyewy_assets_2482c5a7df075309.cdf-ms Handle ID: 0x9b8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoft.windows.printqueueactioncenter_cw5n1h2txyewy_662766d4899a20da.cdf-ms Handle ID: 0x1b88 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoft.windows.printqueueactioncenter_cw5n1h2txyewy_pris_521814e4d360ac76.cdf-ms Handle ID: 0x9b8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoft.windows.printqueueactioncenter_cw5n1h2txyewy_assets_5b52676a20cb98cd.cdf-ms Handle ID: 0x9b8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoft.windows.pinningconfirmationdialog_cw5n1h2txyewy_46d0147d9d0e7625.cdf-ms Handle ID: 0x9b8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoft.windows.pinningconfirmationdialog_cw5n1h2txyewy_pris_818d8e38ea51703d.cdf-ms Handle ID: 0x9b8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoft.windows.peopleexperiencehost_cw5n1h2txyewy_f7fd95c23bab9f94.cdf-ms Handle ID: 0x9b8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoft.windows.peopleexperiencehost_cw5n1h2txyewy_pris_9edd48d3cfd2afbe.cdf-ms Handle ID: 0x9b8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoft.windows.peopleexperiencehost_cw5n1h2txyewy_assets_cf68ccdf60246487.cdf-ms Handle ID: 0x9b8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoft.windows.oobenetworkconnectionflow_cw5n1h2txyewy_80e99b2c380ce386.cdf-ms Handle ID: 0x9b8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoft.windows.oobenetworkconnectionflow_cw5n1h2txyewy_speech_67783f6849153b36.cdf-ms Handle ID: 0x9b8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoft.windows.oobenetworkconnectionflow_cw5n1h2txyewy_speech_4009_22164123daca0b0b.cdf-ms Handle ID: 0x9b8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoft.windows.oobenetworkconnectionflow_cw5n1h2txyewy_speech_1009_22164123daca0b08.cdf-ms Handle ID: 0x9b8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoft.windows.oobenetworkconnectionflow_cw5n1h2txyewy_speech_0c0c_22166549dac9d492.cdf-ms Handle ID: 0x9b8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoft.windows.oobenetworkconnectionflow_cw5n1h2txyewy_speech_0c0a_22166545dac9d4a4.cdf-ms Handle ID: 0x9b8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoft.windows.oobenetworkconnectionflow_cw5n1h2txyewy_speech_0c09_22166535dac9d4ec.cdf-ms Handle ID: 0x9b8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoft.windows.oobenetworkconnectionflow_cw5n1h2txyewy_speech_080a_22165063dac9f3f7.cdf-ms Handle ID: 0x9b8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoft.windows.oobenetworkconnectionflow_cw5n1h2txyewy_speech_0809_22165053dac9f43f.cdf-ms Handle ID: 0x9b8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoft.windows.oobenetworkconnectionflow_cw5n1h2txyewy_speech_0804_22165049dac9f46c.cdf-ms Handle ID: 0x9b8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoft.windows.oobenetworkconnectionflow_cw5n1h2txyewy_speech_0416_22164891daca000f.cdf-ms Handle ID: 0x9b8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoft.windows.oobenetworkconnectionflow_cw5n1h2txyewy_speech_0411_22164887daca003c.cdf-ms Handle ID: 0x9b8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoft.windows.oobenetworkconnectionflow_cw5n1h2txyewy_speech_0410_22164885daca0045.cdf-ms Handle ID: 0x9b8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoft.windows.oobenetworkconnectionflow_cw5n1h2txyewy_speech_040c_221648cfdac9ff49.cdf-ms Handle ID: 0x9b8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoft.windows.oobenetworkconnectionflow_cw5n1h2txyewy_speech_0409_221648bbdac9ffa3.cdf-ms Handle ID: 0x9b8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoft.windows.oobenetworkconnectionflow_cw5n1h2txyewy_speech_0407_221648b7dac9ffb5.cdf-ms Handle ID: 0x9b8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoft.windows.oobenetworkconnectionflow_cw5n1h2txyewy_pris_565e254797fba24a.cdf-ms Handle ID: 0x9b8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoft.windows.oobenetworkcaptiveportal_cw5n1h2txyewy_e1ee1f244749a46e.cdf-ms Handle ID: 0x9b8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoft.windows.oobenetworkcaptiveportal_cw5n1h2txyewy_speech_c1f3c63b8b44e44e.cdf-ms Handle ID: 0x9b8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoft.windows.oobenetworkcaptiveportal_cw5n1h2txyewy_speech_4009_8f459d394bfe2379.cdf-ms Handle ID: 0x9b8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoft.windows.oobenetworkcaptiveportal_cw5n1h2txyewy_speech_1009_8f459d334bfe2394.cdf-ms Handle ID: 0x9b8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoft.windows.oobenetworkcaptiveportal_cw5n1h2txyewy_speech_0c0c_8f459bc94bfe26da.cdf-ms Handle ID: 0x9b8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoft.windows.oobenetworkcaptiveportal_cw5n1h2txyewy_speech_0c0a_8f459c114bfe2638.cdf-ms Handle ID: 0x9b8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoft.windows.oobenetworkcaptiveportal_cw5n1h2txyewy_speech_0c09_8f459d314bfe23b0.cdf-ms Handle ID: 0x9b8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoft.windows.oobenetworkcaptiveportal_cw5n1h2txyewy_speech_080a_8f459c114bfe262d.cdf-ms Handle ID: 0x9b8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoft.windows.oobenetworkcaptiveportal_cw5n1h2txyewy_speech_0809_8f459d314bfe23a5.cdf-ms Handle ID: 0x9b8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoft.windows.oobenetworkcaptiveportal_cw5n1h2txyewy_speech_0804_8f459de54bfe2210.cdf-ms Handle ID: 0x9b8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoft.windows.oobenetworkcaptiveportal_cw5n1h2txyewy_speech_0416_8f459f834bfe1fd5.cdf-ms Handle ID: 0x9b8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoft.windows.oobenetworkcaptiveportal_cw5n1h2txyewy_speech_0411_8f45a0374bfe1e40.cdf-ms Handle ID: 0x9b8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoft.windows.oobenetworkcaptiveportal_cw5n1h2txyewy_speech_0410_8f45a05b4bfe1def.cdf-ms Handle ID: 0x9b8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoft.windows.oobenetworkcaptiveportal_cw5n1h2txyewy_speech_040c_8f459bc94bfe26cb.cdf-ms Handle ID: 0x8c0 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoft.windows.oobenetworkcaptiveportal_cw5n1h2txyewy_speech_0409_8f459d314bfe23a1.cdf-ms Handle ID: 0x9b8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoft.windows.oobenetworkcaptiveportal_cw5n1h2txyewy_speech_0407_8f459d794bfe22ff.cdf-ms Handle ID: 0x9b8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoft.windows.oobenetworkcaptiveportal_cw5n1h2txyewy_pris_06146a5d54fa2c00.cdf-ms Handle ID: 0x9b8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoft.windows.oobenetworkcaptiveportal_cw5n1h2txyewy_assets_c7a73ff382a5aad7.cdf-ms Handle ID: 0x8c0 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoft.windows.oobenetworkcaptiveportal_cw5n1h2txyewy_assets_fonts_5970b081af9a7fbb.cdf-ms Handle ID: 0x9b8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoft.windows.narratorquickstart_8wekyb3d8bbwe_aa4229d57e07074a.cdf-ms Handle ID: 0x9b8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoft.windows.narratorquickstart_8wekyb3d8bbwe_pris_2fcc74e35c7bd23c.cdf-ms Handle ID: 0x9b8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoft.windows.narratorquickstart_8wekyb3d8bbwe_assets_3c2c27c2cd8c0a67.cdf-ms Handle ID: 0x9b8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoft.windows.filepicker_cw5n1h2txyewy_7f0cdb3cdcf67613.cdf-ms Handle ID: 0x9b8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoft.windows.filepicker_cw5n1h2txyewy_pris_b04c47d5ff5f14ed.cdf-ms Handle ID: 0x9b8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoft.windows.filepicker_cw5n1h2txyewy_assets_fb9af0810a32fb5e.cdf-ms Handle ID: 0x9b8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoft.windows.fileexplorer_cw5n1h2txyewy_4a81d77affb96b12.cdf-ms Handle ID: 0x9b8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoft.windows.fileexplorer_cw5n1h2txyewy_pris_bf3c7b21cedb4b7a.cdf-ms Handle ID: 0x9b8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoft.windows.fileexplorer_cw5n1h2txyewy_assets_b49608cc4f09e72b.cdf-ms Handle ID: 0x9b8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoft.windows.contentdeliverymanager_cw5n1h2txyewy_6369fdd3e5ab0989.cdf-ms Handle ID: 0x9b8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoft.windows.contentdeliverymanager_cw5n1h2txyewy_images_f48d365ca6bf839f.cdf-ms Handle ID: 0x9b8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoft.windows.cloudexperiencehost_cw5n1h2txyewy_e92250ef2519d1f6.cdf-ms Handle ID: 0x9b8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoft.windows.cloudexperiencehost_cw5n1h2txyewy_webapps_0c3414e5ea9b964c.cdf-ms Handle ID: 0x9b8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoft.windows.cloudexperiencehost_cw5n1h2txyewy_webapps_unifiedenrollment_608128e0971fe102.cdf-ms Handle ID: 0x8c0 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoft.windows.cloudexperiencehost_cw5n1h2txyewy_webapps_unifiedenrollment_views_ab3b53e7951674ac.cdf-ms Handle ID: 0x9b8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoft.windows.cloudexperiencehost_cw5n1h2txyewy_webapps_unifiedenrollment_js_c50fa6bbbb7c87b1.cdf-ms Handle ID: 0x8c0 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoft.windows.cloudexperiencehost_cw5n1h2txyewy_webapps_templates_2902e194c40c2d99.cdf-ms Handle ID: 0x9b8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoft.windows.cloudexperiencehost_cw5n1h2txyewy_webapps_templates_view_fa144ce8b696a5f6.cdf-ms Handle ID: 0x9b8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoft.windows.cloudexperiencehost_cw5n1h2txyewy_webapps_templates_js_30c977d57667d018.cdf-ms Handle ID: 0x9b8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoft.windows.cloudexperiencehost_cw5n1h2txyewy_webapps_surfacehubdeviceuser_40a8494b26aff035.cdf-ms Handle ID: 0x9b8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoft.windows.cloudexperiencehost_cw5n1h2txyewy_webapps_surfacehubdeviceuser_view_878bf08afd4f7608.cdf-ms Handle ID: 0x9b8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoft.windows.cloudexperiencehost_cw5n1h2txyewy_webapps_surfacehubdeviceuser_js_b837e3558be51686.cdf-ms Handle ID: 0x9b8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoft.windows.cloudexperiencehost_cw5n1h2txyewy_webapps_scoobe_47e577bfb89f66ff.cdf-ms Handle ID: 0x9b8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoft.windows.cloudexperiencehost_cw5n1h2txyewy_webapps_scoobe_view_ffe5b70b18357b66.cdf-ms Handle ID: 0x9b8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoft.windows.cloudexperiencehost_cw5n1h2txyewy_webapps_scoobe_media_2e29d64a701c210b.cdf-ms Handle ID: 0x9b8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoft.windows.cloudexperiencehost_cw5n1h2txyewy_webapps_scoobe_js_2be3c432c2ce3ede.cdf-ms Handle ID: 0x9b8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoft.windows.cloudexperiencehost_cw5n1h2txyewy_webapps_scoobe_js_common_5c49fd1a5570d1f3.cdf-ms Handle ID: 0x9b8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoft.windows.cloudexperiencehost_cw5n1h2txyewy_webapps_inclusivesspr_d9ae0f7fd2cccc94.cdf-ms Handle ID: 0x9b8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoft.windows.cloudexperiencehost_cw5n1h2txyewy_webapps_inclusivesspr_view_a30cd40228c98533.cdf-ms Handle ID: 0x9b8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoft.windows.cloudexperiencehost_cw5n1h2txyewy_webapps_inclusivesspr_js_04768872769d851d.cdf-ms Handle ID: 0x9b8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoft.windows.cloudexperiencehost_cw5n1h2txyewy_webapps_inclusiveoobe_d9ae09c5d2ccd3fb.cdf-ms Handle ID: 0x9b8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoft.windows.cloudexperiencehost_cw5n1h2txyewy_webapps_inclusiveoobe_view_9d516b3c2e3e1a84.cdf-ms Handle ID: 0x9b8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoft.windows.cloudexperiencehost_cw5n1h2txyewy_webapps_inclusiveoobe_view_templat_72e2a4dd8431fbed.cdf-ms Handle ID: 0x9b8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoft.windows.cloudexperiencehost_cw5n1h2txyewy_webapps_inclusiveoobe_media_fff1539a1a4e3fb7.cdf-ms Handle ID: 0x9b8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoft.windows.cloudexperiencehost_cw5n1h2txyewy_webapps_inclusiveoobe_js_fed525f87d913b20.cdf-ms Handle ID: 0x9b8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoft.windows.cloudexperiencehost_cw5n1h2txyewy_webapps_inclusiveoobe_js_common_9b35fdf5c98f69bb.cdf-ms Handle ID: 0x9b8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoft.windows.cloudexperiencehost_cw5n1h2txyewy_webapps_inclusiveoobe_css_9d5145ddb46283ae.cdf-ms Handle ID: 0x9b8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoft.windows.cloudexperiencehost_cw5n1h2txyewy_webapps_hololensdiagnostics_views_d5eef763b212983a.cdf-ms Handle ID: 0x9b8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoft.windows.cloudexperiencehost_cw5n1h2txyewy_webapps_hololensdiagnostics_js_8c1a5a20ff89a7b5.cdf-ms Handle ID: 0x9b8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoft.windows.cloudexperiencehost_cw5n1h2txyewy_webapps_enterprisengcenrollment_82255765359ba571.cdf-ms Handle ID: 0x9b8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoft.windows.cloudexperiencehost_cw5n1h2txyewy_webapps_enterprisengcenrollment_vi_7e71e645381609fd.cdf-ms Handle ID: 0x9b8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoft.windows.cloudexperiencehost_cw5n1h2txyewy_webapps_enterprisengcenrollment_js_c58adfa13ec3cacc.cdf-ms Handle ID: 0x9b8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoft.windows.cloudexperiencehost_cw5n1h2txyewy_views_f55d581a0acbb522.cdf-ms Handle ID: 0x9b8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoft.windows.cloudexperiencehost_cw5n1h2txyewy_speech_f55759080d09bc14.cdf-ms Handle ID: 0x9b8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoft.windows.cloudexperiencehost_cw5n1h2txyewy_speech_4009_f24be8641cd5eaeb.cdf-ms Handle ID: 0x9b8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoft.windows.cloudexperiencehost_cw5n1h2txyewy_speech_1009_f24be8d01cd5e9f8.cdf-ms Handle ID: 0x9b8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoft.windows.cloudexperiencehost_cw5n1h2txyewy_speech_0c0c_f24bfc161cd5cc82.cdf-ms Handle ID: 0x9b8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoft.windows.cloudexperiencehost_cw5n1h2txyewy_speech_0c0a_f24bf84a1cd5d234.cdf-ms Handle ID: 0x9b8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoft.windows.cloudexperiencehost_cw5n1h2txyewy_speech_0c09_f24be91a1cd5e8fc.cdf-ms Handle ID: 0x9b8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoft.windows.cloudexperiencehost_cw5n1h2txyewy_speech_080a_f24bf8341cd5d297.cdf-ms Handle ID: 0x9b8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoft.windows.cloudexperiencehost_cw5n1h2txyewy_speech_0809_f24be9041cd5e95f.cdf-ms Handle ID: 0x9b8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoft.windows.cloudexperiencehost_cw5n1h2txyewy_speech_0804_f24bdf861cd5f79c.cdf-ms Handle ID: 0x9b8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoft.windows.cloudexperiencehost_cw5n1h2txyewy_speech_0416_f24be34a1cd5f20f.cdf-ms Handle ID: 0x9b8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoft.windows.cloudexperiencehost_cw5n1h2txyewy_speech_0411_f24bd9cc1cd6004c.cdf-ms Handle ID: 0x9b8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoft.windows.cloudexperiencehost_cw5n1h2txyewy_speech_0410_f24bd7e61cd60325.cdf-ms Handle ID: 0x9b8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoft.windows.cloudexperiencehost_cw5n1h2txyewy_speech_040c_f24bfbf81cd5cd09.cdf-ms Handle ID: 0x9b8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoft.windows.cloudexperiencehost_cw5n1h2txyewy_speech_0409_f24be8fc1cd5e983.cdf-ms Handle ID: 0x9b8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoft.windows.cloudexperiencehost_cw5n1h2txyewy_speech_0407_f24be5301cd5ef35.cdf-ms Handle ID: 0x9b8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoft.windows.cloudexperiencehost_cw5n1h2txyewy_retaildemo_d6007de2c4449ca2.cdf-ms Handle ID: 0x9b8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoft.windows.cloudexperiencehost_cw5n1h2txyewy_pris_4436110b27fc8d08.cdf-ms Handle ID: 0x9b8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoft.windows.cloudexperiencehost_cw5n1h2txyewy_microsoft.winjs-reduced_36e69b3b0e7ecf70.cdf-ms Handle ID: 0x9b8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoft.windows.cloudexperiencehost_cw5n1h2txyewy_microsoft.winjs-reduced_js_c3e6a46e6987d93b.cdf-ms Handle ID: 0x9b8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoft.windows.cloudexperiencehost_cw5n1h2txyewy_microsoft.winjs-reduced_css_1f290cb460a43b49.cdf-ms Handle ID: 0x9b8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoft.windows.cloudexperiencehost_cw5n1h2txyewy_media_f54b539a0b1cc81a.cdf-ms Handle ID: 0x9b8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoft.windows.cloudexperiencehost_cw5n1h2txyewy_lib_b0f47f90f3500a51.cdf-ms Handle ID: 0x9b8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoft.windows.cloudexperiencehost_cw5n1h2txyewy_js_91283bc423026fc5.cdf-ms Handle ID: 0x9b8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoft.windows.cloudexperiencehost_cw5n1h2txyewy_images_f5434c400d60dd7c.cdf-ms Handle ID: 0x9b8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoft.windows.cloudexperiencehost_cw5n1h2txyewy_fonts_f53d61bc0b5bbe04.cdf-ms Handle ID: 0x9b8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoft.windows.cloudexperiencehost_cw5n1h2txyewy_data_4436285d27fc685e.cdf-ms Handle ID: 0x9b8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoft.windows.cloudexperiencehost_cw5n1h2txyewy_data_prod_c85cee3a7af640ef.cdf-ms Handle ID: 0x754 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoft.windows.cloudexperiencehost_cw5n1h2txyewy_css_b0f49fc4f34fda43.cdf-ms Handle ID: 0x754 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoft.windows.cloudexperiencehost_cw5n1h2txyewy_core_443623ff27fc6f6b.cdf-ms Handle ID: 0x754 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoft.windows.cloudexperiencehost_cw5n1h2txyewy_core_view_c303ad0c866a9c46.cdf-ms Handle ID: 0x754 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoft.windows.cloudexperiencehost_cw5n1h2txyewy_core_js_2a738435bdbe8f70.cdf-ms Handle ID: 0x754 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoft.windows.cloudexperiencehost_cw5n1h2txyewy_core_js_applaunchers_de40849bf361043c.cdf-ms Handle ID: 0x754 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoft.windows.capturepicker_cw5n1h2txyewy_a6a11caf60726833.cdf-ms Handle ID: 0x754 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoft.windows.capturepicker_cw5n1h2txyewy_pris_1f26cd22beec03f3.cdf-ms Handle ID: 0x8c0 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoft.windows.appresolverux_cw5n1h2txyewy_b9e567f99535ffbf.cdf-ms Handle ID: 0x754 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoft.windows.appresolverux_cw5n1h2txyewy_pris_298da63cdcd2b7c3.cdf-ms Handle ID: 0x754 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoft.windows.appresolverux_cw5n1h2txyewy_assets_3e7d93c07af8d918.cdf-ms Handle ID: 0x754 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoft.lockapp_cw5n1h2txyewy_6f26550558264bb4.cdf-ms Handle ID: 0x8c0 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoft.lockapp_cw5n1h2txyewy_pris_f142abc869dcc9c6.cdf-ms Handle ID: 0x754 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoft.lockapp_cw5n1h2txyewy_assets_e61eed4a8582e20d.cdf-ms Handle ID: 0x754 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoft.ecapp_8wekyb3d8bbwe_ac10c70bb3589f82.cdf-ms Handle ID: 0x754 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoft.ecapp_8wekyb3d8bbwe_assets_ae58e904a4695adf.cdf-ms Handle ID: 0x754 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoft.bioenrollment_cw5n1h2txyewy_0e6f6a5d1f5a1430.cdf-ms Handle ID: 0x8c0 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoft.bioenrollment_cw5n1h2txyewy_pris_f9ee3e9148083766.cdf-ms Handle ID: 0x754 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoft.bioenrollment_cw5n1h2txyewy_fonts_f2b30f7dd2e0fe08.cdf-ms Handle ID: 0x754 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoft.accountscontrol_cw5n1h2txyewy_fc38de406c5c8223.cdf-ms Handle ID: 0x754 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoft.accountscontrol_cw5n1h2txyewy_pris_f2961b1ae98936c3.cdf-ms Handle ID: 0x754 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoft.accountscontrol_cw5n1h2txyewy_assets_b23e6d9669ed5578.cdf-ms Handle ID: 0x8c0 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoft.aad.brokerplugin_cw5n1h2txyewy_d48a5fb790740a92.cdf-ms Handle ID: 0x754 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoft.aad.brokerplugin_cw5n1h2txyewy_pris_8c9cc4e4b2c16ab2.cdf-ms Handle ID: 0x754 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoft.aad.brokerplugin_cw5n1h2txyewy_css_af32787f971fc4dd.cdf-ms Handle ID: 0x754 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoft.aad.brokerplugin_cw5n1h2txyewy_assets_4318eb5d347aa2b1.cdf-ms Handle ID: 0x754 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_system32_21f9a9c4a2f8b514.cdf-ms Handle ID: 0x754 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_system32_zh-tw_6a84aa664900aad6.cdf-ms Handle ID: 0x754 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_system32_zh-cn_6a8499504900c466.cdf-ms Handle ID: 0x754 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_system32_winmetadata_0c48e99293678cff.cdf-ms Handle ID: 0x754 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_system32_windowspowershell_v1.0_3f102d555ee05d33.cdf-ms Handle ID: 0x754 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_system32_windowspowershell_v1.0_modules_a349059b05097caa.cdf-ms Handle ID: 0x754 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_system32_windowspowershell_v1.0_modules_wdac_6a8267cbd13e65db.cdf-ms Handle ID: 0x9b8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_system32_windowspowershell_v1.0_modules_uev_36c96168b9ff01a8.cdf-ms Handle ID: 0x754 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_system32_windowspowershell_v1.0_modules_tls_36c96f1eb9feecc5.cdf-ms Handle ID: 0x754 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_system32_windowspowershell_v1.0_modules_storagebuscache_f8ef06c6464c2279.cdf-ms Handle ID: 0x754 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_system32_windowspowershell_v1.0_modules_storage_fcdb4bda9a6da24d.cdf-ms Handle ID: 0x754 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_system32_windowspowershell_v1.0_modules_provisioning_59992d8d97512395.cdf-ms Handle ID: 0x754 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_system32_windowspowershell_v1.0_modules_printmanagement_5ab1cbf6969b793e.cdf-ms Handle ID: 0x754 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_system32_windowspowershell_v1.0_modules_pki_36c96ea0b9feec70.cdf-ms Handle ID: 0x754 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_system32_windowspowershell_v1.0_modules_osconfiguration_edbc23387e7b5ab0.cdf-ms Handle ID: 0x754 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_system32_windowspowershell_v1.0_modules_netconnection_bcd4e6858fe3adb5.cdf-ms Handle ID: 0x754 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_system32_windowspowershell_v1.0_modules_netadapter_92e0b0a73a7e81a0.cdf-ms Handle ID: 0x754 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_system32_windowspowershell_v1.0_modules_msdtc_6a8283fc51a8e0dd.cdf-ms Handle ID: 0x754 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_system32_windowspowershell_v1.0_modules_microsoft.refsdedup.commands_985f6be6167c457c.cdf-ms Handle ID: 0x754 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_system32_windowspowershell_v1.0_modules_laps_6a82601dd13e728a.cdf-ms Handle ID: 0x754 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_system32_windowspowershell_v1.0_modules_kds_36c95feeb9ff0384.cdf-ms Handle ID: 0x754 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_system32_windowspowershell_v1.0_modules_iscsi_6a82841e51a4df9f.cdf-ms Handle ID: 0x754 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_system32_windowspowershell_v1.0_modules_dism_6a826ed5d13e5ce3.cdf-ms Handle ID: 0x754 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_system32_windowspowershell_v1.0_modules_configci_b363508fc8c99bc6.cdf-ms Handle ID: 0x754 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_system32_windowspowershell_v1.0_modules_branchcache_a320bc68371dfd82.cdf-ms Handle ID: 0x754 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_system32_windowspowershell_v1.0_modules_bitstransfer_935cce3b0456eb87.cdf-ms Handle ID: 0x754 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_system32_windowspowershell_v1.0_modules_appx_6a827ca1d13e479b.cdf-ms Handle ID: 0x754 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_system32_windowspowershell_v1.0_modules_appx_en-us_e3b88383b9f5c5d3.cdf-ms Handle ID: 0x754 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_system32_windowspowershell_v1.0_modules_appx_en_f51d5f92a61387da.cdf-ms Handle ID: 0x754 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_system32_windowspowershell_v1.0_modules_appvclient_f101ca87a5fad6fc.cdf-ms Handle ID: 0x754 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_system32_winbioplugins_071a28c5b510fb6a.cdf-ms Handle ID: 0x754 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_system32_winbioplugins_en-us_4600b46a9eff5ffa.cdf-ms Handle ID: 0x754 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_system32_winbiodatabase_8ca29eba075c22c3.cdf-ms Handle ID: 0x9b8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_system32_webthreatdefsvc_dcd711c8c35d20e7.cdf-ms Handle ID: 0x754 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_system32_wdi_06656d5fd047ab7c.cdf-ms Handle ID: 0x754 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_system32_wdi_logfiles_6e0cba0973ee623b.cdf-ms Handle ID: 0x754 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_system32_wbem_06656d9fdf2f8577.cdf-ms Handle ID: 0x754 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_system32_wbem_xml_026f0f207227ebbc.cdf-ms Handle ID: 0x754 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_system32_wbem_en-us_4555b1beb1c13883.cdf-ms Handle ID: 0x754 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_system32_vi-vn_62eabac454679266.cdf-ms Handle ID: 0x754 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_system32_uz-latn-uz_87a351ab8f888ecb.cdf-ms Handle ID: 0x9b8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_system32_ur-pk_61043c345741512b.cdf-ms Handle ID: 0x754 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_system32_uk-ua_61042a3457416b73.cdf-ms Handle ID: 0x754 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_system32_ug-cn_6104437257414518.cdf-ms Handle ID: 0x754 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_system32_tt-ru_5f1dd74e5a1ae8bc.cdf-ms Handle ID: 0x754 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_system32_tr-tr_5f1dd1e45a1af0a7.cdf-ms Handle ID: 0x754 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_system32_th-th_5f1dc0505a1b09f7.cdf-ms Handle ID: 0x754 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_system32_te-in_5f1dcc205a1af7e3.cdf-ms Handle ID: 0x754 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_system32_tasks_5f1dd67a5a1ae70e.cdf-ms Handle ID: 0x754 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_system32_tasks_microsoft_b7abd682baafefc2.cdf-ms Handle ID: 0x754 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_system32_tasks_microsoft_windows_a67c0a7b7fef87b3.cdf-ms Handle ID: 0x754 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_system32_tasks_microsoft_windows_wcm_0421771703a48028.cdf-ms Handle ID: 0x754 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_system32_tasks_microsoft_windows_taskscheduler_2a138755a33c530b.cdf-ms Handle ID: 0x754 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_system32_tasks_microsoft_windows_synccenter_6c995d37b2976a17.cdf-ms Handle ID: 0x754 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_system32_tasks_microsoft_windows_pla_0421687103a4975c.cdf-ms Handle ID: 0x754 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_system32_tasks_microsoft_windows_pla_system_a0962b23ba4890f1.cdf-ms Handle ID: 0x754 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_system32_tasks_microsoft_windows_devicelicensingservice_7c30a8650a2ecc4e.cdf-ms Handle ID: 0x754 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_system32_ta-in_5f1dccb05a1af69f.cdf-ms Handle ID: 0x754 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_system32_sv-se_5d37410c5cf4ca56.cdf-ms Handle ID: 0x754 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_system32_sru_066563e7d047bae2.cdf-ms Handle ID: 0x754 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_system32_sr-latn-rs_36d1e04b1e65a349.cdf-ms Handle ID: 0x8c0 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_system32_sr-cyrl-rs_64b5286ed951a79e.cdf-ms Handle ID: 0x8c0 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_system32_sr-cyrl-ba_64b50c96d951cf7c.cdf-ms Handle ID: 0x8c0 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_system32_sq-al_5d374f0a5cf4b4c0.cdf-ms Handle ID: 0x754 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_system32_spp_tokens_skus_serverrdsh_59647a09f002b541.cdf-ms Handle ID: 0x754 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_system32_spp_tokens_skus_professionalworkstation_7ab478a3d1f596f9.cdf-ms Handle ID: 0x754 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_system32_spp_tokens_skus_professionalsinglelanguage_d9d84093a75f0740.cdf-ms Handle ID: 0x754 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_system32_spp_tokens_skus_professionaleducation_26986f1f25caf246.cdf-ms Handle ID: 0x754 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_system32_spp_tokens_skus_professionalcountryspecific_6cbf9678f9f9bb86.cdf-ms Handle ID: 0x754 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_system32_spp_tokens_skus_professional_a933d9880344b1b8.cdf-ms Handle ID: 0x754 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_system32_spp_tokens_skus_iotenterprisek_078f6f1993892101.cdf-ms Handle ID: 0x754 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_system32_spp_tokens_skus_iotenterprise_22e013631613af56.cdf-ms Handle ID: 0x754 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_system32_spp_tokens_skus_enterprise_bc64f038d2d7a6d4.cdf-ms Handle ID: 0x754 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_system32_spp_tokens_skus_education_eb248cb951678951.cdf-ms Handle ID: 0x754 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_system32_spp_tokens_skus_csvlk-pack_7cc2fe5a710dd58a.cdf-ms Handle ID: 0x754 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_system32_spp_tokens_skus_cloudedition_ec62541d54fbcb26.cdf-ms Handle ID: 0x754 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_system32_spp_tokens_ppdlic_0f09ba294211a24b.cdf-ms Handle ID: 0x754 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_system32_spp_tokens_pkeyconfig_d8fc0830c525895a.cdf-ms Handle ID: 0x8c0 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_system32_spp_store_2.0_774a618ff1521716.cdf-ms Handle ID: 0x754 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_system32_spp_plugin-manifests-signed_d1e9d31c180bebd2.cdf-ms Handle ID: 0x754 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_system32_spool_5d374f725cf4b34b.cdf-ms Handle ID: 0x754 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_system32_spool_v4dirs_e03f1a12d100b4f9.cdf-ms Handle ID: 0x83c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_system32_spool_tools_e03b2d8f300154a4.cdf-ms Handle ID: 0x83c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_system32_spool_servers_02b04ba79d79f697.cdf-ms Handle ID: 0x8c0 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_system32_spool_prtprocs_x64_bfba530a0f4e6934.cdf-ms Handle ID: 0x83c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_system32_spool_printers_420476df024372d2.cdf-ms Handle ID: 0x83c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_system32_spool_drivers_f1780fdbb7b569a2.cdf-ms Handle ID: 0x83c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_system32_speech_onecore_voiceactivation_57f72a0344e2d398.cdf-ms Handle ID: 0x8c0 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_system32_speech_onecore_engines_tts_1c71ba2a25e2bf02.cdf-ms Handle ID: 0x83c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_system32_speech_onecore_engines_sr_44c0fa140b306d00.cdf-ms Handle ID: 0x83c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_system32_speech_onecore_common_60bf750299e8ab15.cdf-ms Handle ID: 0x83c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_system32_speech_speechux_bf4b53e8d47da913.cdf-ms Handle ID: 0x83c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_system32_speech_common_8c297630658eaa3d.cdf-ms Handle ID: 0x83c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_system32_sl-si_5d374a0c5cf4bbc8.cdf-ms Handle ID: 0x83c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_system32_sk-sk_5d374dfc5cf4b5c5.cdf-ms Handle ID: 0x83c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_system32_shellexperiences_9b5d98059e822373.cdf-ms Handle ID: 0x83c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_system32_setup_5d3758a05cf4a445.cdf-ms Handle ID: 0x83c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_system32_securityhealth_1addcf8beb5ca748.cdf-ms Handle ID: 0x83c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_system32_securebootupdates_26bd7695a6545733.cdf-ms Handle ID: 0x83c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_system32_ruxim_5b50d91c5fce6517.cdf-ms Handle ID: 0x83c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_system32_ru-ru_5b50e7f65fce4fdb.cdf-ms Handle ID: 0x83c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_system32_ro-ro_5b50dd6a5fce5f0b.cdf-ms Handle ID: 0x83c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_system32_recovery_f87e94e0816fb86b.cdf-ms Handle ID: 0x83c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_system32_rastoast_f92eb3787fa05917.cdf-ms Handle ID: 0x83c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_system32_ras_06656461d047b86c.cdf-ms Handle ID: 0x83c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_system32_ras_sstpproxy_454ca701ebc80170.cdf-ms Handle ID: 0x83c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_system32_quz-pe_2c3a5d4f08542618.cdf-ms Handle ID: 0x83c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_system32_qps-plocm_6b5ca6a155c9c794.cdf-ms Handle ID: 0x83c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_system32_qps-ploc_f52bb74c87132e9b.cdf-ms Handle ID: 0x83c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_system32_pt-pt_5783f7006581b92f.cdf-ms Handle ID: 0x83c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_system32_pt-br_5783f3346581bed3.cdf-ms Handle ID: 0x83c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_system32_pl-pl_5783e8f06581cd6f.cdf-ms Handle ID: 0x83c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_system32_pa-in_5783ee486581c43b.cdf-ms Handle ID: 0x83c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_system32_or-in_559d744a685b7d03.cdf-ms Handle ID: 0x83c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_system32_oobe_06655c95df2fa06f.cdf-ms Handle ID: 0x83c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_system32_nn-no_53b6ff266b352c52.cdf-ms Handle ID: 0x8c0 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_system32_nl-nl_53b6f9bc6b35343b.cdf-ms Handle ID: 0x754 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_system32_networklist_029a48465a9cac56.cdf-ms Handle ID: 0x754 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_system32_networklist_icons_2b49083c03963dec.cdf-ms Handle ID: 0x754 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_system32_networklist_icons_stockicons_c7f9dde8d52dc62c.cdf-ms Handle ID: 0x754 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_system32_ne-np_53b702506b3526a0.cdf-ms Handle ID: 0x754 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_system32_nb-no_53b700d66b352886.cdf-ms Handle ID: 0x754 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_system32_mt-mt_51d090326e0ed361.cdf-ms Handle ID: 0x754 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_system32_msdtc_51d0703e6e0f02b1.cdf-ms Handle ID: 0x754 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_system32_ms-my_51d099d46e0ec4d3.cdf-ms Handle ID: 0x754 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_system32_mr-in_51d085166e0ee3d1.cdf-ms Handle ID: 0x754 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_system32_ml-in_51d085ee6e0ee1eb.cdf-ms Handle ID: 0x754 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_system32_mk-mk_51d080606e0eea29.cdf-ms Handle ID: 0x754 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_system32_migwiz_2650d8d30fee1fe9.cdf-ms Handle ID: 0x754 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_system32_migwiz_replacementmanifests_174c7b92bb7d581f.cdf-ms Handle ID: 0x754 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_system32_migwiz_replacementmanifests_windowssearchengine_145004789b880a4a.cdf-ms Handle ID: 0x754 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_system32_migwiz_replacementmanifests_sppmig_61344cc740310c55.cdf-ms Handle ID: 0x754 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_system32_migwiz_replacementmanifests_microsoft-windows-shmig_9ef85dcb89d16c58.cdf-ms Handle ID: 0x754 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_system32_migwiz_replacementmanifests_microsoft-windows-rasserver-migplugin_2a8b8a2e22dfd44a.cdf-ms Handle ID: 0x754 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_system32_migwiz_replacementmanifests_microsoft-windows-rasapi-mig_89227d840be1b2ac.cdf-ms Handle ID: 0x754 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_system32_migwiz_replacementmanifests_microsoft-windows-ndis_b44547c729f73574.cdf-ms Handle ID: 0x754 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_system32_migwiz_replacementmanifests_microsoft-windows-directoryservices-adam-client_acf5a5eb145af9c7.cdf-ms Handle ID: 0x754 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_system32_migwiz_replacementmanifests_microsoft-activedirectory-webservices_fbfc8031b6420fb6.cdf-ms Handle ID: 0x754 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_system32_migwiz_dlmanifests_f1386c432966667b.cdf-ms Handle ID: 0x754 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_system32_migwiz_dlmanifests_microsoft-windows-wmi-core_0fa6ec0ad029fddb.cdf-ms Handle ID: 0x754 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_system32_migwiz_dlmanifests_microsoft-windows-textservicesframework-migration-dl_549205906affe6bf.cdf-ms Handle ID: 0x754 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_system32_migration_927a21df1acd7c18.cdf-ms Handle ID: 0x754 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_system32_microsoft-edge-webview_9a74361829336516.cdf-ms Handle ID: 0x754 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_system32_microsoft-edge-webview_widevinecdm_7432109e7193ca81.cdf-ms Handle ID: 0x83c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_system32_microsoft-edge-webview_widevinecdm_platform_specific_win_x64_7cfb2b1a4b83cfd9.cdf-ms Handle ID: 0x754 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_system32_microsoft-edge-webview_trust_protection_lists_9f93dec972ed9eae.cdf-ms Handle ID: 0x754 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_system32_microsoft-edge-webview_trust_protection_lists_sigma_e27586c4fe08c0c7.cdf-ms Handle ID: 0x754 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_system32_microsoft-edge-webview_trust_protection_lists_mu_87e17009d4444f50.cdf-ms Handle ID: 0x754 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_system32_microsoft-edge-webview_pdfpreview_66ccf0bf84eaacb0.cdf-ms Handle ID: 0x754 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_system32_microsoft-edge-webview_meipreload_55b222721d69c658.cdf-ms Handle ID: 0x754 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_system32_microsoft-edge-webview_locales_d9e079e5b7beaf93.cdf-ms Handle ID: 0x754 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_system32_microsoft-edge-webview_extensions_31b59ddd50db691c.cdf-ms Handle ID: 0x754 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_system32_microsoft-edge-webview_edge_feedback_bdfec143542256ff.cdf-ms Handle ID: 0x754 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_system32_microsoft-edge-webview_ebwebview_x86_e190857665b93aa8.cdf-ms Handle ID: 0x754 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_system32_microsoft-edge-webview_ebwebview_x64_e190857265b93ab8.cdf-ms Handle ID: 0x754 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_system32_microsoft-edge-webview_adselectionattestationspreloaded_2118bac8769b26f2.cdf-ms Handle ID: 0x754 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_system32_mi-nz_51d09d226e0ebed1.cdf-ms Handle ID: 0x754 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_system32_lv-lv_4fea1c1c70e881b7.cdf-ms Handle ID: 0x754 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_system32_lt-lt_4fea189870e886c7.cdf-ms Handle ID: 0x754 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_system32_logfiles_unionfs_0bc21fe620de5f63.cdf-ms Handle ID: 0x754 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_system32_logfiles_scm_5b4992849d2e7236.cdf-ms Handle ID: 0x754 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_system32_logfiles_sam_5b4992809d2e7248.cdf-ms Handle ID: 0x754 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_system32_logfiles_firewall_488be49cc4415d55.cdf-ms Handle ID: 0x754 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_system32_logfiles_cloudfiles_4f1ca5d4f4bf5aad.cdf-ms Handle ID: 0x754 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_system32_lo-la_4fe9f53a70e8bb4d.cdf-ms Handle ID: 0x754 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_system32_licenses_neutral_volume_professional_7a83c2f800cfb9d0.cdf-ms Handle ID: 0x754 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_system32_licenses_neutral_oem_professional_3cf2af13e10f52ed.cdf-ms Handle ID: 0x754 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_system32_licenses_neutral_oem_iotenterprisek_3f1d651a3540b36a.cdf-ms Handle ID: 0x754 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_system32_licenses_neutral_oem_iotenterprise_acc1828247de2f0d.cdf-ms Handle ID: 0x754 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_system32_licenses_neutral_default_professional_88d58373f32b5992.cdf-ms Handle ID: 0x754 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_system32_licenses_neutral_default_iotenterprisek_6f4b91fdb97ea217.cdf-ms Handle ID: 0x754 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_system32_lb-lu_4fea1d0670e87e3c.cdf-ms Handle ID: 0x754 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_system32_kok-in_21abb62f1787fa37.cdf-ms Handle ID: 0x74c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_system32_ko-kr_4e039de673c23e4a.cdf-ms Handle ID: 0x74c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_system32_kn-in_4e03967273c2495b.cdf-ms Handle ID: 0x74c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_system32_km-kh_4e038b3273c25a22.cdf-ms Handle ID: 0x74c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_system32_kk-kz_4e03ada673c2263e.cdf-ms Handle ID: 0x74c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_system32_keywords_eb5d4b4494a589fe.cdf-ms Handle ID: 0x74c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_system32_ka-ge_4e03873073c25edd.cdf-ms Handle ID: 0x74c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_system32_ja-jp_4c1d2478769bf2f4.cdf-ms Handle ID: 0x74c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_system32_it-it_4a36b1ca7975a0f9.cdf-ms Handle ID: 0x74c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_system32_is-is_4a36b0087975a381.cdf-ms Handle ID: 0x74c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_system32_inputmethod_shared_6eb54fb4ad19ef1c.cdf-ms Handle ID: 0x74c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_system32_inputmethod_cht_f1e99f19c8c3214a.cdf-ms Handle ID: 0x74c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_system32_inputmethod_chs_f1e99f17c8c32153.cdf-ms Handle ID: 0x74c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_system32_ime_shared_5a5b3a5824d8fee4.cdf-ms Handle ID: 0x74c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_system32_ime_shared_res_791e6438104a0cf8.cdf-ms Handle ID: 0x74c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_system32_ime_imetc_e3d3eac2a148ee29.cdf-ms Handle ID: 0x74c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_system32_ime_imetc_applets_6d36ac75fb0330ae.cdf-ms Handle ID: 0x74c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_system32_ime_imekr_e3d4073ca148c369.cdf-ms Handle ID: 0x74c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_system32_ime_imekr_dicts_45f57d216603e3ba.cdf-ms Handle ID: 0x74c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_system32_ime_imekr_applets_72fc2bdaedec65ee.cdf-ms Handle ID: 0x74c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_system32_ime_imejp_e3d40370a148c91a.cdf-ms Handle ID: 0x74c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_system32_ime_imejp_applets_94594e11bb62a31f.cdf-ms Handle ID: 0x74c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_system32_id-id_4a3695aa7975c979.cdf-ms Handle ID: 0x74c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_system32_icsxml_1f8f393b196e65ae.cdf-ms Handle ID: 0x74c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_system32_hy-am_48502c327c4f69dc.cdf-ms Handle ID: 0x74c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_system32_hu-hu_48503bf27c4f51d7.cdf-ms Handle ID: 0x74c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:37 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_system32_hr-hr_485036ac7c4f596f.cdf-ms Handle ID: 0x74c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_system32_hi-in_485030587c4f61fb.cdf-ms Handle ID: 0x74c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_system32_healthattestationclient_75820672c974454d.cdf-ms Handle ID: 0x74c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_system32_he-il_48502d1c7c4f6669.cdf-ms Handle ID: 0x74c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_system32_gu-in_4669b70e7f29192e.cdf-ms Handle ID: 0x74c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_system32_grouppolicyusers_dc4bf95b336ab265.cdf-ms Handle ID: 0x74c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_system32_grouppolicy_8e35dabe44804e33.cdf-ms Handle ID: 0x74c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_system32_gl-es_4669c1d07f290814.cdf-ms Handle ID: 0x74c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_system32_gd-gb_4669a2aa7f2935f7.cdf-ms Handle ID: 0x74c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_system32_ga-ie_4669a8c87f292c7b.cdf-ms Handle ID: 0x74c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_system32_fr-fr_448347788202c03b.cdf-ms Handle ID: 0x74c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_system32_fr-ca_448327328202f0a1.cdf-ms Handle ID: 0x74c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_system32_fil-ph_1903a37923e1edc2.cdf-ms Handle ID: 0x74c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_system32_fi-fi_448337a68202d703.cdf-ms Handle ID: 0x74c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_system32_fa-ir_448349dc8202badd.cdf-ms Handle ID: 0x74c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_system32_eu-es_429cd15884dc71bb.cdf-ms Handle ID: 0x74c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_system32_et-ee_429cb6e884dc9948.cdf-ms Handle ID: 0x74c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_system32_es-mx_429cdb1e84dc62e4.cdf-ms Handle ID: 0x74c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_system32_es-es_429cd1a084dc7119.cdf-ms Handle ID: 0x74c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_system32_en-us_429cd25484dc6f94.cdf-ms Handle ID: 0x74c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_system32_en-us_licenses_205e682c4ad0fe50.cdf-ms Handle ID: 0x74c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_system32_en-us_licenses_volume_professional_1c1b6166bdc61f37.cdf-ms Handle ID: 0x74c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_system32_en-us_licenses_oem_professional_e0db4d0dc7ac2dac.cdf-ms Handle ID: 0x74c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_system32_en-us_licenses_oem_iotenterprisek_57be743817a2ed73.cdf-ms Handle ID: 0x74c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_system32_en-us_licenses_oem_iotenterprise_bd38f9407f6b24a6.cdf-ms Handle ID: 0x74c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_system32_en-us_licenses_default_professional_5918bf2ee6a07e89.cdf-ms Handle ID: 0x74c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_system32_en-us_licenses_default_iotenterprisek_7474fb0c121edac0.cdf-ms Handle ID: 0x74c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_system32_en-gb_429cb20e84dc9fef.cdf-ms Handle ID: 0x74c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_system32_en_9da4492827ac64e5.cdf-ms Handle ID: 0x74c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_system32_el-gr_429cd0b684dc71bd.cdf-ms Handle ID: 0x74c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_system32_driverstore_a531a9c6b3dfcf87.cdf-ms Handle ID: 0x74c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_system32_driverstore_en-us_f6b4aaeeda14a371.cdf-ms Handle ID: 0x74c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_system32_driverstate_a5318eeab3dff807.cdf-ms Handle ID: 0x74c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_system32_driverstate_devices_144618422831c928.cdf-ms Handle ID: 0x74c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_system32_drivers_dc1b782427b5ee1b.cdf-ms Handle ID: 0x74c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_system32_drivers_umdf_a531b5dc588477d3.cdf-ms Handle ID: 0x74c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_system32_drivers_mde_a531a7f2b3dfd0d3.cdf-ms Handle ID: 0x74c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_system32_drivers_en-us_4bb913fc5eb96bcf.cdf-ms Handle ID: 0x74c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_system32_drivers_driverdata_4e302c7c62b76407.cdf-ms Handle ID: 0x74c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_system32_dism_066548addf2fbd4b.cdf-ms Handle ID: 0x74c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_system32_dism_en-us_064f3ab06d0848d3.cdf-ms Handle ID: 0x74c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_system32_de-de_40b6416a87b647ef.cdf-ms Handle ID: 0x74c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_system32_ddfs_06654947df2fbc31.cdf-ms Handle ID: 0x74c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_system32_da-dk_40b64d5e87b63595.cdf-ms Handle ID: 0x74c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_system32_cy-gb_3ecfc14e8a900a38.cdf-ms Handle ID: 0x74c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_system32_cs-cz_3ecfefb68a8fc3f6.cdf-ms Handle ID: 0x74c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_system32_config_1277fa612e559336.cdf-ms Handle ID: 0x74c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_system32_config_systemprofile_9dec82772012c8ca.cdf-ms Handle ID: 0x74c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_system32_config_systemprofile_appdata_92209b51227f4d2f.cdf-ms Handle ID: 0x74c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_system32_config_systemprofile_appdata_roaming_3488f27ae602299c.cdf-ms Handle ID: 0x74c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_system32_config_systemprofile_appdata_locallow_ecfb9e22d0b5fdec.cdf-ms Handle ID: 0x74c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_system32_config_systemprofile_appdata_local_bceee85fd37df118.cdf-ms Handle ID: 0x74c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_system32_codeintegrity_e9af9308cfc26dc2.cdf-ms Handle ID: 0x74c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_system32_codeintegrity_update_previous_ad580ee945408ddc.cdf-ms Handle ID: 0x74c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_system32_codeintegrity_cipolicies_staged_276d48e6ef8844ae.cdf-ms Handle ID: 0x74c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_system32_codeintegrity_cipolicies_internal_c92a000dc3e74fc1.cdf-ms Handle ID: 0x74c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_system32_codeintegrity_cipolicies_active_29d3e16aea6e0340.cdf-ms Handle ID: 0x74c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_system32_chr-cher-us_6d8240fe66f8158d.cdf-ms Handle ID: 0x74c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_system32_catroot_dcafaffa24ca18cc.cdf-ms Handle ID: 0x74c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_system32_catroot_f750e6c3-38ee-11d1-85e5-00c04fc295ee__0f6ee2e4c9b287a4.cdf-ms Handle ID: 0x74c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_system32_ca-es-valencia_d9502d6b71863d29.cdf-ms Handle ID: 0x74c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_system32_ca-es_3ecfe4f48a8fd235.cdf-ms Handle ID: 0x74c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_system32_bs-latn-ba_40af39211ce53ee1.cdf-ms Handle ID: 0x74c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_system32_boot_06654401df2fc50e.cdf-ms Handle ID: 0x74c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_system32_bn-in_3ce962088d6997fa.cdf-ms Handle ID: 0x74c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_system32_bg-bg_3ce955ba8d69a9ab.cdf-ms Handle ID: 0x74c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_system32_be-by_3ce9782e8d6975c7.cdf-ms Handle ID: 0x74c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_system32_az-latn-az_d54681d79b13c6b3.cdf-ms Handle ID: 0x74c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_system32_as-in_3b02e9ba90434cf6.cdf-ms Handle ID: 0x74c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_system32_ar-sa_3b02d130904371b4.cdf-ms Handle ID: 0x74c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_system32_appv_066541f9df2fc831.cdf-ms Handle ID: 0x74c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_system32_appraiser_59bebec9f06db09b.cdf-ms Handle ID: 0x8c0 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_system32_applocker_745949fdc87fdde1.cdf-ms Handle ID: 0x74c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_system32_am-et_3b02f5f6904339f6.cdf-ms Handle ID: 0x74c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_system32_af-za_3b02d2e090436def.cdf-ms Handle ID: 0x74c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_system32_accounthealthassets_389cb04ef4abdcc8.cdf-ms Handle ID: 0x74c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_system_4c3aa2308f9f8f41.cdf-ms Handle ID: 0x74c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_system_speech_00e1f005eaf69ef5.cdf-ms Handle ID: 0x74c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_speech_onecore_86042ecd14dccb9c.cdf-ms Handle ID: 0x74c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_speech_onecore_engines_85d79caefa9ac893.cdf-ms Handle ID: 0x74c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_speech_onecore_engines_tts_8edca57574a98a4e.cdf-ms Handle ID: 0x74c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_speech_onecore_engines_tts_en-us_f904ad554a6fa916.cdf-ms Handle ID: 0x74c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_shellexperiences_2912c63bd045ac45.cdf-ms Handle ID: 0x74c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_shellcomponents_dea969d8d78d1fee.cdf-ms Handle ID: 0x74c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_servicing_fc2045b9046cc796.cdf-ms Handle ID: 0x74c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_servicing_fodmetadata_9bbdac5cfd0682ae.cdf-ms Handle ID: 0x74c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_servicing_fodmetadata_metadata_d0520311ba255e8f.cdf-ms Handle ID: 0x74c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_servicing_en-us_62939e786cb82928.cdf-ms Handle ID: 0x8c0 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_servicing_editions_596ea20ddafb9f7d.cdf-ms Handle ID: 0x74c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_servicestate_5273c861cc221018.cdf-ms Handle ID: 0x74c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_serviceprofiles_localservice_appdata_local_usageandqualityinsights_764440a7d7639fc3.cdf-ms Handle ID: 0x74c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_serviceprofiles_localservice_appdata_local_usageandqualityinsights_feature_configs_12693af1d1ca58b9.cdf-ms Handle ID: 0x754 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_security_fe3ad40cd6e08c7c.cdf-ms Handle ID: 0x88c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_security_cap_64b6afb36dbde5d6.cdf-ms Handle ID: 0x88c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_security_audit_073f574e8f328f85.cdf-ms Handle ID: 0x88c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_schemas_9f2c881475a483d6.cdf-ms Handle ID: 0x88c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_schemas_provisioning_4f8636d1a1a523e7.cdf-ms Handle ID: 0x88c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_schemas_eaphost_52e2de002c0b1796.cdf-ms Handle ID: 0x88c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_schemas_codeintegrity_28b32c0f4161f4ca.cdf-ms Handle ID: 0x88c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_schemas_codeintegrity_examplepolicies_83fa074d09c5bf54.cdf-ms Handle ID: 0x88c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_schcache_f995a5d4decb8cc0.cdf-ms Handle ID: 0x88c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_resources_fbee56ab048ab239.cdf-ms Handle ID: 0x88c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_resources_themes_4d0d4910e83c2273.cdf-ms Handle ID: 0x88c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_resources_themes_aero_3fd78bf4cb5fa2c4.cdf-ms Handle ID: 0x88c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_resources_themes_aero_vscache_f7bbc75044896c89.cdf-ms Handle ID: 0x88c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_provisioning_cc9458acec1840ff.cdf-ms Handle ID: 0x88c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_provisioning_packages_e07c8f8a91f541c4.cdf-ms Handle ID: 0x74c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_provisioning_cosa_b2feb78251a8a259.cdf-ms Handle ID: 0x74c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_provisioning_cosa_oem_c5f03ab2bad804ca.cdf-ms Handle ID: 0x74c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_provisioning_cosa_mo_c5f03b0eb90452f5.cdf-ms Handle ID: 0x74c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_provisioning_cosa_microsoft_77338a94bd8669dd.cdf-ms Handle ID: 0x74c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_provisioning_autopilot_705495c13beba2f8.cdf-ms Handle ID: 0x74c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_provisioning_autopilot_diagnosticanalysisframework_b56e839d684005e5.cdf-ms Handle ID: 0x74c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_provisioning_autopilot_diagnosticanalysisframework_scenarios_8045ea4a29f45db8.cdf-ms Handle ID: 0x74c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_provisioning_autopilot_diagnosticanalysisframework_scenarios_commercialoobe_288297f374130913.cdf-ms Handle ID: 0x74c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_prefetch_1688e4e8b2f89473.cdf-ms Handle ID: 0x74c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_policydefinitions_89130cdfc4d9c27c.cdf-ms Handle ID: 0x74c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_policydefinitions_en-us_3b1c5b998da0d4ae.cdf-ms Handle ID: 0x74c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_pla_templates_139a41e9c234e4ce.cdf-ms Handle ID: 0x74c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_pla_system_571618c4f89c6368.cdf-ms Handle ID: 0x74c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_pla_rules_0bde462ce96f215e.cdf-ms Handle ID: 0x74c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_pla_reports_a2604845b2b380ca.cdf-ms Handle ID: 0x74c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_performance_02bd33cc045df684.cdf-ms Handle ID: 0x74c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_performance_winsat_ac47b36afb2fa68e.cdf-ms Handle ID: 0x74c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_performance_winsat_datastore_34fe222e5de27d61.cdf-ms Handle ID: 0x74c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_microsoft.net_3296b36dbe4c7fa3.cdf-ms Handle ID: 0x74c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_microsoft_windows_models_c0103e404d842dab.cdf-ms Handle ID: 0x74c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_media_401039ffa1d92906.cdf-ms Handle ID: 0x74c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_logs_measuredboot_ab1fadc53c86b337.cdf-ms Handle ID: 0x74c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_livekernelreports_13126bbee8c1252a.cdf-ms Handle ID: 0x74c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_languageoverlaycache_97a399b6551f8564.cdf-ms Handle ID: 0x74c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_l2schemas_d7bb5637381de58c.cdf-ms Handle ID: 0x74c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_installer_0d1280e2e633dc00.cdf-ms Handle ID: 0x74c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_inf_3f581daba4c8c835.cdf-ms Handle ID: 0x74c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_inf_wsearchidxpi_a2c41dc1731a4204.cdf-ms Handle ID: 0x74c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_inf_wsearchidxpi_0409_2e6e3e8caf9fcb6d.cdf-ms Handle ID: 0x74c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_inf_wsearchidxpi_0000_2e6e3f1caf9fca20.cdf-ms Handle ID: 0x74c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_inf_ugthrsvc_9c5b081f28f83f11.cdf-ms Handle ID: 0x74c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_inf_ugthrsvc_0409_8451c270df70bfac.cdf-ms Handle ID: 0x74c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_inf_ugthrsvc_0000_8451c300df70be5f.cdf-ms Handle ID: 0x74c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_inf_ugatherer_9f1f9c5b6cd50d98.cdf-ms Handle ID: 0x74c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_inf_ugatherer_0409_046b6321f9ca254f.cdf-ms Handle ID: 0x74c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_inf_ugatherer_0000_046b5203f9ca3f14.cdf-ms Handle ID: 0x74c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_inf_lsm_b45be09c559d6e1d.cdf-ms Handle ID: 0x74c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_inf_lsm_0409_b44cb59d03cf68aa.cdf-ms Handle ID: 0x74c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_inf_lsm_0000_b44cadf303cf745f.cdf-ms Handle ID: 0x74c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_inboxapps_0f6cfface115ba12.cdf-ms Handle ID: 0x74c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_immersivecontrolpanel_1e6ccf0e6a91b570.cdf-ms Handle ID: 0x74c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_immersivecontrolpanel_systemsettings_d76332102e6a9a22.cdf-ms Handle ID: 0x74c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_immersivecontrolpanel_systemsettings_view_34ee44a07ef70449.cdf-ms Handle ID: 0x74c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_immersivecontrolpanel_systemsettings_assets_6ba5b2461d9725af.cdf-ms Handle ID: 0x74c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_immersivecontrolpanel_settings_08eec740d2195455.cdf-ms Handle ID: 0x74c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_immersivecontrolpanel_pris_a05890fcf353f1d8.cdf-ms Handle ID: 0x74c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_immersivecontrolpanel_images_2e6232377292b2dc.cdf-ms Handle ID: 0x74c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_immersivecontrolpanel_en-us_83c2a5ee73a54528.cdf-ms Handle ID: 0x74c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_immersivecontrolpanel_constraintindex_en-us_94d36224ae04c955.cdf-ms Handle ID: 0x74c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_ime_3f581be9a4c8cabd.cdf-ms Handle ID: 0x74c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_ime_imetc_0d348c40e45e62ef.cdf-ms Handle ID: 0x74c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_ime_imetc_help_7cd8fd160d71b81c.cdf-ms Handle ID: 0x74c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_ime_imetc_dicts_b6bb60758b345dca.cdf-ms Handle ID: 0x74c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_ime_imekr_0d348c2ee45e634f.cdf-ms Handle ID: 0x74c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_ime_imekr_dicts_b6a95c078b94756a.cdf-ms Handle ID: 0x74c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_identitycrl_e7d9c9e97cfb8b01.cdf-ms Handle ID: 0x74c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_help_en-us_a4365ceb0275deaf.cdf-ms Handle ID: 0x74c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_globalization_0fc22903a221b67f.cdf-ms Handle ID: 0x74c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_globalization_time_zone_08f498d155d3913e.cdf-ms Handle ID: 0x74c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_globalization_icu_0b932b2a9cc9f858.cdf-ms Handle ID: 0x74c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_globalization_els_spelldictionaries_f8bab08f83431341.cdf-ms Handle ID: 0x74c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_fonts_40104ba9a1d20dac.cdf-ms Handle ID: 0x8c8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_diagtrack_0600d0deecd2b5a2.cdf-ms Handle ID: 0x74c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_diagtrack_settings_56f8a3f40ce5a801.cdf-ms Handle ID: 0x74c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_diagtrack_scenarios_ce5f6e43b7ab3f41.cdf-ms Handle ID: 0x74c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_diagnostics_e6d66275c6e4d14a.cdf-ms Handle ID: 0x74c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_diagnostics_system_d78913b7f0741b59.cdf-ms Handle ID: 0x74c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_diagnostics_system_video_9d515c9dc78f711e.cdf-ms Handle ID: 0x74c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_diagnostics_system_pcw_2115168e47eaddb7.cdf-ms Handle ID: 0x74c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_diagnostics_system_audio_9d2751b7c84ca0f1.cdf-ms Handle ID: 0x74c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_diagnostics_index_6f9ad1a80c4f7ad6.cdf-ms Handle ID: 0x74c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_cursors_bff8b8b245707919.cdf-ms Handle ID: 0x74c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_browsercore_45c84591712aa3f1.cdf-ms Handle ID: 0x8c8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_branding_1728f5d8b15e5263.cdf-ms Handle ID: 0x74c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_branding_shellbrd_be1f632087fb0947.cdf-ms Handle ID: 0x74c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_boot_40104b85a18bfcb2.cdf-ms Handle ID: 0x74c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_boot_pcat_0f8924c0debe64e4.cdf-ms Handle ID: 0x74c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_boot_pcat_sv-se_d84b8da62ddbdc6c.cdf-ms Handle ID: 0x74c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_boot_pcat_qps-ploc_109d95b40d3e11cb.cdf-ms Handle ID: 0x8c8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_boot_pcat_nl-nl_d8ffaf642c46898f.cdf-ms Handle ID: 0x74c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_boot_pcat_ja-jp_d98fca962b0246de.cdf-ms Handle ID: 0x74c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_boot_pcat_fr-ca_da1fe2fa29be05b9.cdf-ms Handle ID: 0x74c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_boot_misc_pcat_6b00b12988eafd38.cdf-ms Handle ID: 0x74c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_boot_fonts_ex_e31996175596d82a.cdf-ms Handle ID: 0x74c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_boot_fonts_fee710f4f7b180e0.cdf-ms Handle ID: 0x74c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_boot_efi_ex_797e466ba2705b86.cdf-ms Handle ID: 0x74c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_boot_efi_ex_zh-tw_0d0c37bd28bee6cc.cdf-ms Handle ID: 0x74c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_boot_efi_ex_zh-cn_0d0c379b28bee75c.cdf-ms Handle ID: 0x74c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_boot_efi_ex_uk-ua_0d0c3d7128b9dce7.cdf-ms Handle ID: 0x74c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_boot_efi_ex_tr-tr_0d0c4ab928b8c8d3.cdf-ms Handle ID: 0x74c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_boot_efi_ex_sv-se_0d0c524f28b7bd2c.cdf-ms Handle ID: 0x74c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_boot_efi_ex_sr-latn-rs_495dabcc2134885b.cdf-ms Handle ID: 0x74c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_boot_efi_ex_sl-si_0d0c3f5328b7d9aa.cdf-ms Handle ID: 0x74c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_boot_efi_ex_sk-sk_0d0c3d6d28b7dc85.cdf-ms Handle ID: 0x74c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_boot_efi_ex_ru-ru_0d0c506728b6bfdf.cdf-ms Handle ID: 0x74c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_boot_efi_ex_ro-ro_0d0c450328b6d0ef.cdf-ms Handle ID: 0x738 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_boot_efi_ex_pt-pt_0d0c4e7d28b4c24b.cdf-ms Handle ID: 0x738 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_boot_efi_ex_pt-br_0d0c4e6128b4c2c7.cdf-ms Handle ID: 0x738 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_boot_efi_ex_pl-pl_0d0c3f4d28b4d90b.cdf-ms Handle ID: 0x738 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_boot_efi_ex_nl-nl_0d0c3f4928b2d89f.cdf-ms Handle ID: 0x738 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_boot_efi_ex_nb-no_0d0c2c4d28b2f51c.cdf-ms Handle ID: 0x738 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_boot_efi_ex_lv-lv_0d0c524128b0bbc3.cdf-ms Handle ID: 0x738 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_boot_efi_ex_lt-lt_0d0c4e7528b0c173.cdf-ms Handle ID: 0x738 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_boot_efi_ex_ko-kr_0d0c44f528afcf78.cdf-ms Handle ID: 0x738 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_boot_efi_ex_ja-jp_0d0c2a5f28aef71e.cdf-ms Handle ID: 0x738 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_boot_efi_ex_it-it_0d0c4e6f28adc0d1.cdf-ms Handle ID: 0x738 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_boot_efi_ex_hu-hu_0d0c505328acbdc3.cdf-ms Handle ID: 0x738 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_boot_efi_ex_hr-hr_0d0c4aa128acc64b.cdf-ms Handle ID: 0x738 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_boot_efi_ex_fr-fr_0d0c4a9d28aac5df.cdf-ms Handle ID: 0x738 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_boot_efi_ex_fr-ca_0d0c4a9728aac5e9.cdf-ms Handle ID: 0x8c8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_boot_efi_ex_fi-fi_0d0c398728aadf77.cdf-ms Handle ID: 0x738 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_boot_efi_ex_et-ee_0d0c4e6728a9bfea.cdf-ms Handle ID: 0x738 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_boot_efi_ex_es-mx_0d0c4c9128a9c28e.cdf-ms Handle ID: 0x738 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_boot_efi_ex_es-es_0d0c4c8128a9c2d1.cdf-ms Handle ID: 0x738 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_boot_efi_ex_en-us_0d0c432328a9d07e.cdf-ms Handle ID: 0x738 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_boot_efi_ex_en-gb_0d0c430728a9d0eb.cdf-ms Handle ID: 0x738 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_boot_efi_ex_el-gr_0d0c3f3b28a9d6ad.cdf-ms Handle ID: 0x738 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_boot_efi_ex_de-de_0d0c31eb28a8ea6b.cdf-ms Handle ID: 0x738 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_boot_efi_ex_da-dk_0d0c2a5328a8f5d5.cdf-ms Handle ID: 0x738 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_boot_efi_ex_cs-cz_0d0c4c7d28a7c26c.cdf-ms Handle ID: 0x738 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_boot_efi_ex_bg-bg_0d0c35b328a6e44f.cdf-ms Handle ID: 0x47c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_boot_efi_0f890f82be247f42.cdf-ms Handle ID: 0x47c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_boot_efi_zh-tw_ed00671ec5ef6d14.cdf-ms Handle ID: 0x47c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_boot_efi_zh-cn_ed005608c5ef86a4.cdf-ms Handle ID: 0x47c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_boot_efi_uk-ua_e37fe6ecd4302db1.cdf-ms Handle ID: 0x47c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_boot_efi_tr-tr_e1998e9cd709b2e5.cdf-ms Handle ID: 0x47c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_boot_efi_sv-se_dfb2fdc4d9e38c94.cdf-ms Handle ID: 0x47c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_boot_efi_sr-latn-rs_175a7056497f1cbd.cdf-ms Handle ID: 0x47c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_boot_efi_sl-si_dfb306c4d9e37e06.cdf-ms Handle ID: 0x8c8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_boot_efi_sk-sk_dfb30ab4d9e37803.cdf-ms Handle ID: 0x47c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_boot_efi_ru-ru_ddcca4aedcbd1219.cdf-ms Handle ID: 0x47c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_boot_efi_ro-ro_ddcc9a22dcbd2149.cdf-ms Handle ID: 0x47c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_boot_efi_pt-pt_d9ffb3b8e2707b6d.cdf-ms Handle ID: 0x47c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_boot_efi_pt-br_d9ffafece2708111.cdf-ms Handle ID: 0x47c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_boot_efi_pl-pl_d9ffa5a8e2708fad.cdf-ms Handle ID: 0x47c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_boot_efi_nl-nl_d632b674e823f679.cdf-ms Handle ID: 0x47c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_boot_efi_nb-no_d632bd8ee823eac4.cdf-ms Handle ID: 0x47c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_boot_efi_lv-lv_d265d8d4edd743f5.cdf-ms Handle ID: 0x47c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_boot_efi_lt-lt_d265d550edd74905.cdf-ms Handle ID: 0x47c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_boot_efi_ko-kr_d07f5a9ef0b10088.cdf-ms Handle ID: 0x47c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_boot_efi_ja-jp_ce98e130f38ab532.cdf-ms Handle ID: 0x47c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_boot_efi_it-it_ccb26e82f6646337.cdf-ms Handle ID: 0x47c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_boot_efi_hu-hu_cacbf8aaf93e1415.cdf-ms Handle ID: 0x47c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_boot_efi_hr-hr_cacbf364f93e1bad.cdf-ms Handle ID: 0x47c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_boot_efi_fr-fr_c6ff0430fef18279.cdf-ms Handle ID: 0x47c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_boot_efi_fr-ca_c6fee3eafef1b2df.cdf-ms Handle ID: 0x47c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_boot_efi_fi-fi_c6fef45efef19941.cdf-ms Handle ID: 0x47c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_boot_efi_et-ee_c51873a101cb5b86.cdf-ms Handle ID: 0x47c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_boot_efi_es-mx_c51897d701cb2522.cdf-ms Handle ID: 0x47c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_boot_efi_es-es_c5188e5901cb3357.cdf-ms Handle ID: 0x47c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_boot_efi_en-us_c5188f0d01cb31d2.cdf-ms Handle ID: 0x47c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_boot_efi_en-gb_c5186ec701cb622d.cdf-ms Handle ID: 0x47c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_boot_efi_el-gr_c5188d6f01cb33fb.cdf-ms Handle ID: 0x47c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_boot_efi_de-de_c331fe2304a50a2d.cdf-ms Handle ID: 0x47c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_boot_efi_da-dk_c3320a1704a4f7d3.cdf-ms Handle ID: 0x47c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_boot_efi_cs-cz_c14bac6f077e8634.cdf-ms Handle ID: 0x47c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_boot_efi_bg-bg_bf6512730a586be9.cdf-ms Handle ID: 0x47c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_boot_dvd_ex_efi_en-us_91aa4a0627c21b4a.cdf-ms Handle ID: 0x47c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_boot_dvd_efi_de3c4ceb52549e1c.cdf-ms Handle ID: 0x47c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_boot_dvd_efi_en-us_8245c3aed97c0844.cdf-ms Handle ID: 0x47c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_bcastdvr_fab1ebc0dbf2dacb.cdf-ms Handle ID: 0x47c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_appreadiness_b6ba89081e320d85.cdf-ms Handle ID: 0x47c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_apppatch_1143992cbbbebcab.cdf-ms Handle ID: 0x47c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_apppatch_mergesdbfilessource_1e9ed04663efeac2.cdf-ms Handle ID: 0x47c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_apppatch_customsdb_3bf1ff155493adb9.cdf-ms Handle ID: 0x47c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_apppatch_custom_2adff76bea4847ec.cdf-ms Handle ID: 0x47c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_apppatch_custom_custom64_12107ab6726c35e5.cdf-ms Handle ID: 0x47c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_apppatch_acplugindlls_a308cb62414812f7.cdf-ms Handle ID: 0x47c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_apppatch_acplugindlls_plugin_5a0b9ed3a5d51da6.cdf-ms Handle ID: 0x47c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_appcompat_programs_99c7f419bd54f4ca.cdf-ms Handle ID: 0x47c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_appcompat_backup_981b93d4f1ee6c63.cdf-ms Handle ID: 0x47c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_appcompat_appraiser_33781004733ffeee.cdf-ms Handle ID: 0x47c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_appcompat_appraiser_telemetry_94274e99519f58a9.cdf-ms Handle ID: 0x47c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\users.cdf-ms Handle ID: 0x47c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\users_public_8c076a3be22985a1.cdf-ms Handle ID: 0x47c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\users_public_videos_20f7329ef941f593.cdf-ms Handle ID: 0x47c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\users_public_pictures_f5e7b0c0fda4db8c.cdf-ms Handle ID: 0x47c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\users_public_music_8c1f3dc399e79184.cdf-ms Handle ID: 0x47c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\users_public_libraries_de6591322faedac0.cdf-ms Handle ID: 0x47c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\users_public_downloads_631cc37cff593fe6.cdf-ms Handle ID: 0x8c8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\users_public_documents_70461e22eba239ef.cdf-ms Handle ID: 0x47c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\users_public_desktop_2377dac7383055bd.cdf-ms Handle ID: 0x47c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\users_default_73615b64075aa65f.cdf-ms Handle ID: 0x47c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\users_default_videos_4078dfd58aff2cd5.cdf-ms Handle ID: 0x47c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\users_default_saved_games_57aaea1c026aa551.cdf-ms Handle ID: 0x47c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\users_default_pictures_209185c2b71537e4.cdf-ms Handle ID: 0x47c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\users_default_music_4066f7392302d756.cdf-ms Handle ID: 0x47c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\users_default_links_4064ed15230be7d0.cdf-ms Handle ID: 0x47c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\users_default_favorites_d09a481c8ccc2a28.cdf-ms Handle ID: 0x47c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\users_default_downloads_d0a063ac92c2c070.cdf-ms Handle ID: 0x47c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\users_default_documents_a9a4e48ccdf32dcf.cdf-ms Handle ID: 0x47c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\users_default_desktop_39aa59e1159d1203.cdf-ms Handle ID: 0x47c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\users_default_appdata_33f0d5f51e505ec2.cdf-ms Handle ID: 0x47c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\users_default_appdata_roaming_482f0bdd00d1643d.cdf-ms Handle ID: 0x47c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\users_default_appdata_roaming_microsoft_b898cfd29d5951f1.cdf-ms Handle ID: 0x47c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\users_default_appdata_roaming_microsoft_windows_4793cab2f72cc262.cdf-ms Handle ID: 0x47c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\users_default_appdata_roaming_microsoft_windows_templates_9327e87141b4e78f.cdf-ms Handle ID: 0x47c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\users_default_appdata_roaming_microsoft_windows_start_menu_5eb528778fd8d821.cdf-ms Handle ID: 0x47c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\users_default_appdata_roaming_microsoft_windows_start_menu_programs_8181428e5873cb4e.cdf-ms Handle ID: 0x47c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\users_default_appdata_roaming_microsoft_windows_start_menu_programs_windows_powershell_7f52299b0d22ec18.cdf-ms Handle ID: 0x47c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\users_default_appdata_roaming_microsoft_windows_start_menu_programs_system_tools_b726d34a5a5ca66e.cdf-ms Handle ID: 0x47c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\users_default_appdata_roaming_microsoft_windows_start_menu_programs_accessibility_1fe25fac404028a8.cdf-ms Handle ID: 0x47c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\users_default_appdata_roaming_microsoft_windows_sendto_cc2b2363b7303311.cdf-ms Handle ID: 0x47c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\users_default_appdata_roaming_microsoft_windows_recent_ca449f9bba09f987.cdf-ms Handle ID: 0x47c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\users_default_appdata_roaming_microsoft_windows_printer_shortcuts_3443a629b8cbd4bd.cdf-ms Handle ID: 0x47c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\users_default_appdata_roaming_microsoft_windows_network_shortcuts_cbcbd4ac7028a985.cdf-ms Handle ID: 0x47c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\users_default_appdata_roaming_microsoft_spelling_3eeba614f13d9e63.cdf-ms Handle ID: 0x47c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\users_default_appdata_roaming_microsoft_internet_explorer_quick_launch_c0ec1d6b06e5808b.cdf-ms Handle ID: 0x47c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\users_default_appdata_local_bc5dd6ae41aaaeeb.cdf-ms Handle ID: 0x47c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\users_default_appdata_local_microsoft_3433db0fbe07ab7f.cdf-ms Handle ID: 0x738 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\users_default_appdata_local_microsoft_windowsapps_522fbbfd57c17136.cdf-ms Handle ID: 0x47c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\users_default_appdata_local_microsoft_windows_9e28651fd972d480.cdf-ms Handle ID: 0x47c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\users_default_appdata_local_microsoft_windows_winx_group3_ed682c1f8b3659ae.cdf-ms Handle ID: 0x47c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\users_default_appdata_local_microsoft_windows_winx_group2_ed682a398b365c87.cdf-ms Handle ID: 0x47c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\users_default_appdata_local_microsoft_windows_winx_group1_ed6828538b365f60.cdf-ms Handle ID: 0x47c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\users_default_appdata_local_microsoft_windows_inetcookies_706c818672b5499f.cdf-ms Handle ID: 0x47c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\users_default_appdata_local_microsoft_windows_inetcache_93b6f38324ca2118.cdf-ms Handle ID: 0x47c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\users_default_appdata_local_microsoft_windows_history_f4337fe0129e212c.cdf-ms Handle ID: 0x47c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\users_default_appdata_local_microsoft_windows_gameexplorer_5a14824a005868dd.cdf-ms Handle ID: 0x8c8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\programdata.cdf-ms Handle ID: 0x47c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\programdata_usoshared_logs_user_cc47ba2ac1c4ac78.cdf-ms Handle ID: 0x47c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\programdata_usoshared_logs_system_1d654048a9eadf5a.cdf-ms Handle ID: 0x47c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\programdata_usoprivate_f18983166baec8e8.cdf-ms Handle ID: 0x47c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\programdata_usoprivate_providers_e2347ee3010abcf2.cdf-ms Handle ID: 0xa7c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\programdata_usoprivate_providers_windows_3cfc059f39a47749.cdf-ms Handle ID: 0x47c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\programdata_usoprivate_providers_registered_67e734fdaac0d16a.cdf-ms Handle ID: 0x738 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\programdata_usoprivate_expeditedappregistrations_25163d00c1478c2d.cdf-ms Handle ID: 0x738 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\programdata_usoprivate_expeditedappregistrations_ms_autosuperres_aa0df03411ae5cd6.cdf-ms Handle ID: 0xa7c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\programdata_softwaredistribution_ae0bdc9bb1bbdfab.cdf-ms Handle ID: 0xa7c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\programdata_microsoft_fe5c6d762edd2110.cdf-ms Handle ID: 0xa7c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\programdata_microsoft_windows_security_health_ef9cc294168a8b97.cdf-ms Handle ID: 0xa7c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\programdata_microsoft_windows_security_health_logs_d0133fe6679072ac.cdf-ms Handle ID: 0xa7c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\programdata_microsoft_windows_security_health_health_advisor_caf4bd491726b327.cdf-ms Handle ID: 0xa7c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\programdata_microsoft_windows_defender_advanced_threat_protection_827f103853495477.cdf-ms Handle ID: 0xa7c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\programdata_microsoft_windows_defender_advanced_threat_protection_trace_948df0f7e3c42652.cdf-ms Handle ID: 0xa7c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\programdata_microsoft_windows_defender_advanced_threat_protection_temp_7268e2d9fd6b25f5.cdf-ms Handle ID: 0xa7c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\programdata_microsoft_windows_defender_advanced_threat_protection_temp_psscriptoutputs_3a0e1d2536445291.cdf-ms Handle ID: 0xa7c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\programdata_microsoft_windows_defender_advanced_threat_protection_temp_platform_f6b9ea6020382132.cdf-ms Handle ID: 0xa7c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\programdata_microsoft_windows_defender_advanced_threat_protection_task_7268eef1fd6b1346.cdf-ms Handle ID: 0xa7c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\programdata_microsoft_windows_defender_advanced_threat_protection_sensendr_0eb144e981753817.cdf-ms Handle ID: 0xa7c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\programdata_microsoft_windows_defender_advanced_threat_protection_sensecm_ce2cab16129f9f73.cdf-ms Handle ID: 0xa7c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\programdata_microsoft_windows_defender_advanced_threat_protection_platform_f5d3430ba6f64724.cdf-ms Handle ID: 0xa7c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\programdata_microsoft_windows_defender_advanced_threat_protection_downloads_9aff56413f03e0ba.cdf-ms Handle ID: 0xa7c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\programdata_microsoft_windows_defender_advanced_threat_protection_dlp_2fb411e3d382007d.cdf-ms Handle ID: 0xa7c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\programdata_microsoft_windows_defender_advanced_threat_protection_dlp_classification_f098ce8624ed5a47.cdf-ms Handle ID: 0xa7c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\programdata_microsoft_windows_defender_advanced_threat_protection_dlp_archive_25bf24a5cc409c33.cdf-ms Handle ID: 0xa7c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\programdata_microsoft_windows_defender_advanced_threat_protection_datascan_1c82a5956b2ac3da.cdf-ms Handle ID: 0xa7c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\programdata_microsoft_windows_defender_advanced_threat_protection_datascan_database_0f83c3bd71ae51af.cdf-ms Handle ID: 0xa7c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\programdata_microsoft_windows_defender_advanced_threat_protection_datascan_classification_15c06d4219477406.cdf-ms Handle ID: 0xa7c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\programdata_microsoft_windows_defender_advanced_threat_protection_datacollection_a0b92996ab2dc299.cdf-ms Handle ID: 0xa7c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\programdata_microsoft_windows_defender_advanced_threat_protection_cyber_946bea51e45d4954.cdf-ms Handle ID: 0xa7c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\programdata_microsoft_windows_defender_advanced_threat_protection_cache_946bebb1e45d47cb.cdf-ms Handle ID: 0xa7c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\programdata_microsoft_windows_cae2264614449191.cdf-ms Handle ID: 0xa7c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\programdata_microsoft_windows_wsxpacks_854da73e89b9028d.cdf-ms Handle ID: 0xa7c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\programdata_microsoft_windows_wsaifabric_02fe02403ffc3986.cdf-ms Handle ID: 0xa7c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\programdata_microsoft_windows_wsaifabric_temp_4ca36d3ca51d3178.cdf-ms Handle ID: 0xa7c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\programdata_microsoft_windows_wsaifabric_temp_offlinecompiler_79e6590413e60bc6.cdf-ms Handle ID: 0xa7c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\programdata_microsoft_windows_wfp_1409fc168e700932.cdf-ms Handle ID: 0xa7c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\programdata_microsoft_windows_wer_temp_783673b09e921b6b.cdf-ms Handle ID: 0xa7c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\programdata_microsoft_windows_wer_reportqueue_9ca35f30fc68b178.cdf-ms Handle ID: 0xa7c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\programdata_microsoft_windows_wer_reportarchive_5449504010b82c41.cdf-ms Handle ID: 0xa7c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\programdata_microsoft_windows_uus_140a01c48e7000c8.cdf-ms Handle ID: 0xa7c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\programdata_microsoft_windows_uus_state_20a788ec2e586117.cdf-ms Handle ID: 0xa7c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\programdata_microsoft_windows_uus_packages_e501d599e62ea21d.cdf-ms Handle ID: 0xa7c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\programdata_microsoft_windows_templates_15e72976404301fc.cdf-ms Handle ID: 0xa7c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\programdata_microsoft_windows_start_menu_fde55420546edfe6.cdf-ms Handle ID: 0xa7c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\programdata_microsoft_windows_start_menu_programs_d672ba09d81e87ff.cdf-ms Handle ID: 0xa7c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\programdata_microsoft_windows_start_menu_programs_windows_powershell_cec036d9e9a5f943.cdf-ms Handle ID: 0xa7c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\programdata_microsoft_windows_start_menu_programs_system_tools_fde5decba5bb578b.cdf-ms Handle ID: 0x8c8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\programdata_microsoft_windows_start_menu_programs_startup_b13751030220a596.cdf-ms Handle ID: 0xa7c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\programdata_microsoft_windows_start_menu_programs_administrative_tools_50eba26877c48094.cdf-ms Handle ID: 0xa7c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\programdata_microsoft_windows_start_menu_programs_accessories_bb30590aa3d31891.cdf-ms Handle ID: 0xa7c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\programdata_microsoft_windows_start_menu_programs_accessories_system_tools_764c676d616d9643.cdf-ms Handle ID: 0xa7c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\programdata_microsoft_windows_retaildemo_235295a6167f1c31.cdf-ms Handle ID: 0xa7c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\programdata_microsoft_windows_retaildemo_offlinecontent_287c1f66975af721.cdf-ms Handle ID: 0xa7c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\programdata_microsoft_windows_retaildemo_offlinecontent_packages_bfcdebcc9ac9ef74.cdf-ms Handle ID: 0xa7c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\programdata_microsoft_windows_retaildemo_offlinecontent_microsoft_53a3137a3de96b65.cdf-ms Handle ID: 0xa7c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\programdata_microsoft_windows_retaildemo_offlinecontent_microsoft_content_e8db5309f86131b4.cdf-ms Handle ID: 0xa7c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\programdata_microsoft_windows_retaildemo_offlinecontent_microsoft_content_neutral_fb28470e79dbd425.cdf-ms Handle ID: 0xa7c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\programdata_microsoft_windows_power_efficiency_diagnostics_acddb9fca5769337.cdf-ms Handle ID: 0xa7c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\programdata_microsoft_windows_parental_controls_bea881b14dc7da94.cdf-ms Handle ID: 0xa7c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\programdata_microsoft_windows_parental_controls_settings_8a26e500c57de871.cdf-ms Handle ID: 0xa7c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\programdata_microsoft_windows_packagedeventproviders_c79719361ec06661.cdf-ms Handle ID: 0xa7c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\programdata_microsoft_windows_onesettings_d58936a49a7f4b26.cdf-ms Handle ID: 0xa7c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\programdata_microsoft_windows_lfsvc_3b7574f5e3935395.cdf-ms Handle ID: 0xa7c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\programdata_microsoft_windows_gameexplorer_eb83b477ca9834cc.cdf-ms Handle ID: 0xa7c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\programdata_microsoft_windows_devicemetadatastore_2e1ff34936d2e8e5.cdf-ms Handle ID: 0xa7c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\programdata_microsoft_windows_devicemetadatastore_en-us_cc94fe8746890b55.cdf-ms Handle ID: 0xa7c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\programdata_microsoft_windows_clipsvc_debc96072b71b0d5.cdf-ms Handle ID: 0xa7c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\programdata_microsoft_windows_clipsvc_install_149a5029c4c64782.cdf-ms Handle ID: 0xa7c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\programdata_microsoft_windows_clipsvc_import_865699c21a2ad5a2.cdf-ms Handle ID: 0xa7c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\programdata_microsoft_windows_clipsvc_genuineticket_d7322dcf4073011e.cdf-ms Handle ID: 0xa7c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\programdata_microsoft_windows_clipsvc_archive_f622c70ff2ada08b.cdf-ms Handle ID: 0xa7c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\programdata_microsoft_windows_apprepository_3e49394d38e6ac94.cdf-ms Handle ID: 0xa7c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\programdata_microsoft_windows_apprepository_packages_711aa2dd7039ca9d.cdf-ms Handle ID: 0xa7c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\programdata_microsoft_windows_apprepository_families_5e2e105f8c5e974e.cdf-ms Handle ID: 0xa7c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\programdata_microsoft_wdf_07d3cd94a97a75eb.cdf-ms Handle ID: 0xa7c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\programdata_microsoft_vault_72f09c1eedd2d856.cdf-ms Handle ID: 0xa7c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\programdata_microsoft_user_account_pictures_eceaafe818cb6141.cdf-ms Handle ID: 0xa7c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\programdata_microsoft_storage_health_9e678c58bd8432a1.cdf-ms Handle ID: 0xa7c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\programdata_microsoft_speech_onecore_587c58cfbeda0062.cdf-ms Handle ID: 0xa7c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\programdata_microsoft_smsrouter_de9db7c47456f048.cdf-ms Handle ID: 0xa7c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\programdata_microsoft_provisioning_929be8282aecbf17.cdf-ms Handle ID: 0xa7c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\programdata_microsoft_provisioning_assetcache_8fbe865af4949dd7.cdf-ms Handle ID: 0xa7c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\programdata_microsoft_provisioning_assetcache_cellularux_843105bb528cd98c.cdf-ms Handle ID: 0xa7c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\programdata_microsoft_network_downloader_7fafaef6d33e4371.cdf-ms Handle ID: 0xa7c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\programdata_microsoft_network_connections_2e5c3accd04dd407.cdf-ms Handle ID: 0x74c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\programdata_microsoft_midi_3550fb280320ccdb.cdf-ms Handle ID: 0xa7c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\programdata_microsoft_mapdata_ce9aee460ee372ae.cdf-ms Handle ID: 0xa7c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\programdata_microsoft_diagnosis_siufloc_1bf9debdc7c4c9b2.cdf-ms Handle ID: 0xa7c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\programdata_microsoft_device_stage_task_e35be42d-f742-4d96-a50a-1775fb1a7a42__96ac8d0751fb5c2c.cdf-ms Handle ID: 0xa7c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\programdata_microsoft_device_stage_device_113527a4-45d4-4b6f-b567-97838f1b04b0__5d055d2c3e7e3719.cdf-ms Handle ID: 0x8c8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\programdata_microsoft_crypto_pcpksp_windowsaik_cb9775b914a8e5a2.cdf-ms Handle ID: 0xa7c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\programdata_microsoft_appv_setup_c6b9e738c86ef84a.cdf-ms Handle ID: 0xa7c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\program_files_x86__676bbe2c7241b694.cdf-ms Handle ID: 0xa7c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\program_files_x86_windows_media_player_e9607c93dd43c2ea.cdf-ms Handle ID: 0xa7c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\program_files_x86_windows_media_player_skins_aeefd749ff68a842.cdf-ms Handle ID: 0xa7c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\program_files_x86_windows_media_player_network_sharing_f29a3dd721834a7e.cdf-ms Handle ID: 0xa7c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\program_files_x86_windows_media_player_media_renderer_750773e49fdbfa5b.cdf-ms Handle ID: 0xa7c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\program_files_x86_windows_mail_fc7b184dbf576a4a.cdf-ms Handle ID: 0xa7c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\program_files_x86_internet_explorer_cafab575245eacb0.cdf-ms Handle ID: 0xa7c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\program_files_x86_common_files_dfa3680ec228c528.cdf-ms Handle ID: 0xa7c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\program_files_x86_common_files_system_681b9383b994c86d.cdf-ms Handle ID: 0xa7c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\program_files_x86_common_files_system_ole_db_17fcdbc86fee8f8b.cdf-ms Handle ID: 0x8c8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\program_files_x86_common_files_microsoft_shared_635c287ec97ec0a5.cdf-ms Handle ID: 0xa7c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\program_files_x86_common_files_microsoft_shared_vgx_9d0cc8bc56d58860.cdf-ms Handle ID: 0xa7c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\program_files_x86_common_files_microsoft_shared_msinfo_4536eb45a5f97101.cdf-ms Handle ID: 0xa7c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\program_files_x86_common_files_microsoft_shared_ink_9d0caff456d5ade1.cdf-ms Handle ID: 0xa7c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\program_files_ffd0cbfc813cc4f1.cdf-ms Handle ID: 0xa7c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\program_files_windowsapps_8909e9aceeb80d44.cdf-ms Handle ID: 0xa7c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\program_files_windowsapps_projected_be5e80b5ff2c78ce.cdf-ms Handle ID: 0xa7c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\program_files_windowsapps_mutablebackup_726f6fa1fbd23cbc.cdf-ms Handle ID: 0xa7c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\program_files_windowsapps_mutable_4773d03dc650afca.cdf-ms Handle ID: 0xa7c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\program_files_windowsapps_merged_1983779d8b2930f2.cdf-ms Handle ID: 0xa7c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\program_files_windowsapps_deleted_382e0caddd5f5e75.cdf-ms Handle ID: 0xa7c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\program_files_windows_media_player_da4e5f6eb3198de9.cdf-ms Handle ID: 0xa7c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\program_files_windows_media_player_skins_94ff8de43fd42ce5.cdf-ms Handle ID: 0xa7c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\program_files_windows_media_player_network_sharing_aed05552f451fd7d.cdf-ms Handle ID: 0xa7c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\program_files_windows_media_player_media_renderer_5001a1a5de706f6e.cdf-ms Handle ID: 0xa7c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\program_files_windows_mail_e07902f329fe05e9.cdf-ms Handle ID: 0xa7c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\program_files_windows_defender_advanced_threat_protection_096829c909d5eb56.cdf-ms Handle ID: 0xa7c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\program_files_windows_defender_advanced_threat_protection_en-us_a6e2e55771ed49c8.cdf-ms Handle ID: 0xa7c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\program_files_windows_defender_advanced_threat_protection_classification_47699381a5289670.cdf-ms Handle ID: 0xa7c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\program_files_windows_defender_advanced_threat_protection_classification_dprt_c740f6c4cbf7f48c.cdf-ms Handle ID: 0xa7c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\program_files_windows_defender_advanced_threat_protection_classification_dprt_x64_01476f4a2690b49a.cdf-ms Handle ID: 0xa7c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\program_files_windows_defender_advanced_threat_protection_classification_configuration_e1d4288a0384bffc.cdf-ms Handle ID: 0xa7c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\program_files_modifiablewindowsapps_230f2b3b95f10a16.cdf-ms Handle ID: 0xa7c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\program_files_internet_explorer_a421d1bfaf856e2b.cdf-ms Handle ID: 0xa7c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\program_files_common_files_d7a65bb2f0e854e7.cdf-ms Handle ID: 0xa7c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\program_files_common_files_system_b13078daf1286f60.cdf-ms Handle ID: 0xa7c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\program_files_common_files_system_ole_db_48d1b11cd4e5cabe.cdf-ms Handle ID: 0xa7c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\program_files_common_files_microsoft_shared_818c5a0e45020fba.cdf-ms Handle ID: 0xa7c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\program_files_common_files_microsoft_shared_vgx_3c86fd9f0b3afd9b.cdf-ms Handle ID: 0xa7c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\program_files_common_files_microsoft_shared_msinfo_817ad0c7c1c8e490.cdf-ms Handle ID: 0xa7c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\program_files_common_files_microsoft_shared_msinfo_en-us_98319174bb92bc08.cdf-ms Handle ID: 0xa7c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\program_files_common_files_microsoft_shared_ink_3c86e3db0b3b254c.cdf-ms Handle ID: 0xa7c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\perflogs.cdf-ms Handle ID: 0xa7c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\perflogs_admin_51abcd79eca668bf.cdf-ms Handle ID: 0xa7c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$recycle.bin.cdf-ms Handle ID: 0xa7c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Program Files\Common Files\microsoft shared\ink\InkDiv.dll Handle ID: 0xa7c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Program Files\Common Files\microsoft shared\ink\InkObj.dll Handle ID: 0xa7c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Program Files\Common Files\microsoft shared\ink\Microsoft.Ink.dll Handle ID: 0xa7c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Program Files\Common Files\microsoft shared\ink\mshwstaging.dll Handle ID: 0x88c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe Handle ID: 0xa7c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Program Files\Common Files\microsoft shared\ink\TipRes.dll Handle ID: 0xa7c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Program Files\Common Files\microsoft shared\ink\tipskins.dll Handle ID: 0xa7c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Program Files\Common Files\microsoft shared\ink\tiptsf.dll Handle ID: 0xa7c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe Handle ID: 0xa7c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Program Files\Common Files\microsoft shared\MSInfo\en-US\msinfo32.exe.mui Handle ID: 0xa7c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Program Files\Common Files\microsoft shared\VGX\VGX.dll Handle ID: 0xa7c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Program Files\Common Files\System\wab32.dll Handle ID: 0x754 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Program Files\Common Files\System\Ole DB\sqloledb.dll Handle ID: 0x88c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Program Files\Internet Explorer\iediagcmd.exe Handle ID: 0x88c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Program Files\Internet Explorer\IEShims.dll Handle ID: 0x88c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Program Files\Windows Defender Advanced Threat Protection\aadrt.dll Handle ID: 0x88c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)(AU;IDSAFA;0x1000000;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Program Files\Windows Defender Advanced Threat Protection\MipDlp.dll Handle ID: 0x88c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)(AU;IDSAFA;0x1000000;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.dll Handle ID: 0x88c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)(AU;IDSAFA;0x1000000;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe Handle ID: 0x88c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)(AU;IDSAFA;0x1000000;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Program Files\Windows Defender Advanced Threat Protection\RunPsScript.dll Handle ID: 0x754 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)(AU;IDSAFA;0x1000000;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:38 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Program Files\Windows Defender Advanced Threat Protection\SenseAP.exe Handle ID: 0x88c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)(AU;IDSAFA;0x1000000;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Program Files\Windows Defender Advanced Threat Protection\SenseAp.ThirdPartyNotice.txt Handle ID: 0x88c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)(AU;IDSAFA;0x1000000;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Program Files\Windows Defender Advanced Threat Protection\SenseAPToast.exe Handle ID: 0x88c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)(AU;IDSAFA;0x1000000;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Program Files\Windows Defender Advanced Threat Protection\SenseCM.exe Handle ID: 0x88c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)(AU;IDSAFA;0x1000000;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Program Files\Windows Defender Advanced Threat Protection\SenseDlpProcessor.exe Handle ID: 0x88c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)(AU;IDSAFA;0x1000000;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Program Files\Windows Defender Advanced Threat Protection\SenseGPParser.exe Handle ID: 0x88c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)(AU;IDSAFA;0x1000000;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Program Files\Windows Defender Advanced Threat Protection\SenseIdentity.exe Handle ID: 0x88c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)(AU;IDSAFA;0x1000000;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Program Files\Windows Defender Advanced Threat Protection\SenseImdsCollector.exe Handle ID: 0x88c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)(AU;IDSAFA;0x1000000;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Program Files\Windows Defender Advanced Threat Protection\SenseIR.exe Handle ID: 0x88c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)(AU;IDSAFA;0x1000000;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Program Files\Windows Defender Advanced Threat Protection\SenseNdr.exe Handle ID: 0x88c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)(AU;IDSAFA;0x1000000;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Program Files\Windows Defender Advanced Threat Protection\SenseSampleUploader.exe Handle ID: 0x88c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)(AU;IDSAFA;0x1000000;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Program Files\Windows Defender Advanced Threat Protection\SenseTracer.exe Handle ID: 0x88c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)(AU;IDSAFA;0x1000000;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Program Files\Windows Defender Advanced Threat Protection\SenseTVM.exe Handle ID: 0x88c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)(AU;IDSAFA;0x1000000;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Program Files\Windows Defender Advanced Threat Protection\WATPCSP.dll Handle ID: 0x88c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)(AU;IDSAFA;0x1000000;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Program Files\Windows Defender Advanced Threat Protection\Classification\cmicarabicwordbreaker.dll Handle ID: 0x88c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)(AU;IDSAFA;0x1000000;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Program Files\Windows Defender Advanced Threat Protection\Classification\fastmorph.dll Handle ID: 0x88c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)(AU;IDSAFA;0x1000000;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Program Files\Windows Defender Advanced Threat Protection\Classification\korwbrkr.dll Handle ID: 0x88c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)(AU;IDSAFA;0x1000000;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Program Files\Windows Defender Advanced Threat Protection\Classification\mce.dll Handle ID: 0x88c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)(AU;IDSAFA;0x1000000;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Program Files\Windows Defender Advanced Threat Protection\Classification\MpGear.dll Handle ID: 0x88c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)(AU;IDSAFA;0x1000000;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Program Files\Windows Defender Advanced Threat Protection\Classification\mswb7.dll Handle ID: 0x88c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)(AU;IDSAFA;0x1000000;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Program Files\Windows Defender Advanced Threat Protection\Classification\mswb70011.dll Handle ID: 0x88c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)(AU;IDSAFA;0x1000000;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Program Files\Windows Defender Advanced Threat Protection\Classification\mswb70011_v2.dll Handle ID: 0x88c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)(AU;IDSAFA;0x1000000;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Program Files\Windows Defender Advanced Threat Protection\Classification\mswb7001e.dll Handle ID: 0x88c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)(AU;IDSAFA;0x1000000;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Program Files\Windows Defender Advanced Threat Protection\Classification\mswb70404.dll Handle ID: 0x88c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)(AU;IDSAFA;0x1000000;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Program Files\Windows Defender Advanced Threat Protection\Classification\mswb70804.dll Handle ID: 0x88c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)(AU;IDSAFA;0x1000000;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Program Files\Windows Defender Advanced Threat Protection\Classification\nl7data0011.dll Handle ID: 0x88c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)(AU;IDSAFA;0x1000000;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Program Files\Windows Defender Advanced Threat Protection\Classification\nl7data0011_v2.dll Handle ID: 0x88c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)(AU;IDSAFA;0x1000000;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Program Files\Windows Defender Advanced Threat Protection\Classification\nl7data001e.dll Handle ID: 0x88c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)(AU;IDSAFA;0x1000000;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Program Files\Windows Defender Advanced Threat Protection\Classification\nl7data0404.dll Handle ID: 0x88c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)(AU;IDSAFA;0x1000000;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Program Files\Windows Defender Advanced Threat Protection\Classification\nl7data0804.dll Handle ID: 0x88c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)(AU;IDSAFA;0x1000000;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Program Files\Windows Defender Advanced Threat Protection\Classification\nl7lexicons0011.dll Handle ID: 0x88c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)(AU;IDSAFA;0x1000000;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Program Files\Windows Defender Advanced Threat Protection\Classification\nl7lexicons0011_v2.dll Handle ID: 0x88c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)(AU;IDSAFA;0x1000000;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Program Files\Windows Defender Advanced Threat Protection\Classification\nl7lexicons001e.dll Handle ID: 0x88c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)(AU;IDSAFA;0x1000000;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Program Files\Windows Defender Advanced Threat Protection\Classification\nl7lexicons0404.dll Handle ID: 0x88c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)(AU;IDSAFA;0x1000000;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Program Files\Windows Defender Advanced Threat Protection\Classification\nl7lexicons0804.dll Handle ID: 0x88c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)(AU;IDSAFA;0x1000000;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Program Files\Windows Defender Advanced Threat Protection\Classification\nl7models0011.dll Handle ID: 0x88c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)(AU;IDSAFA;0x1000000;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Program Files\Windows Defender Advanced Threat Protection\Classification\nl7models0011_v2.dll Handle ID: 0x88c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)(AU;IDSAFA;0x1000000;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Program Files\Windows Defender Advanced Threat Protection\Classification\nl7models001e.dll Handle ID: 0x88c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)(AU;IDSAFA;0x1000000;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Program Files\Windows Defender Advanced Threat Protection\Classification\nl7models0404.dll Handle ID: 0x88c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)(AU;IDSAFA;0x1000000;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Program Files\Windows Defender Advanced Threat Protection\Classification\nl7models0804.dll Handle ID: 0x88c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)(AU;IDSAFA;0x1000000;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Program Files\Windows Defender Advanced Threat Protection\Classification\npe.dll Handle ID: 0x88c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)(AU;IDSAFA;0x1000000;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Program Files\Windows Defender Advanced Threat Protection\Classification\OPCTextExtractorWin.dll Handle ID: 0x88c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)(AU;IDSAFA;0x1000000;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Program Files\Windows Defender Advanced Threat Protection\Classification\SenseCE.exe Handle ID: 0x88c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)(AU;IDSAFA;0x1000000;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Program Files\Windows Defender Advanced Threat Protection\Classification\Dprt\Google.Protobuf.dll Handle ID: 0x8c8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)(AU;IDSAFA;0x1000000;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Program Files\Windows Defender Advanced Threat Protection\Classification\Dprt\ICSharpCode.SharpZipLib.dll Handle ID: 0x88c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)(AU;IDSAFA;0x1000000;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Program Files\Windows Defender Advanced Threat Protection\Classification\Dprt\Microsoft.Ceres.ContentUnderstanding.SemanticDocument.dll Handle ID: 0x88c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)(AU;IDSAFA;0x1000000;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Program Files\Windows Defender Advanced Threat Protection\Classification\Dprt\Microsoft.Ceres.DocParsing.External.ExternalClient.dll Handle ID: 0x88c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)(AU;IDSAFA;0x1000000;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Program Files\Windows Defender Advanced Threat Protection\Classification\Dprt\Microsoft.Ceres.DocParsing.External.ExternalCore.dll Handle ID: 0x88c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)(AU;IDSAFA;0x1000000;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Program Files\Windows Defender Advanced Threat Protection\Classification\Dprt\Microsoft.Ceres.DocParsing.External.FormatDetectionClient.dll Handle ID: 0x88c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)(AU;IDSAFA;0x1000000;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Program Files\Windows Defender Advanced Threat Protection\Classification\Dprt\Microsoft.Ceres.DocParsing.FormatHandlers.Common.Configuration.dll Handle ID: 0x754 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)(AU;IDSAFA;0x1000000;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Program Files\Windows Defender Advanced Threat Protection\Classification\Dprt\Microsoft.Ceres.DocParsing.FormatHandlers.Common.Interop.dll Handle ID: 0x88c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)(AU;IDSAFA;0x1000000;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Program Files\Windows Defender Advanced Threat Protection\Classification\Dprt\Microsoft.Ceres.DocParsing.FormatHandlers.Common.JpegInterop.dll Handle ID: 0x88c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)(AU;IDSAFA;0x1000000;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Program Files\Windows Defender Advanced Threat Protection\Classification\Dprt\Microsoft.Ceres.DocParsing.FormatHandlers.Common.Metro.dll Handle ID: 0x88c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)(AU;IDSAFA;0x1000000;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Program Files\Windows Defender Advanced Threat Protection\Classification\Dprt\Microsoft.Ceres.DocParsing.FormatHandlers.Common.Rms.dll Handle ID: 0x88c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)(AU;IDSAFA;0x1000000;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Program Files\Windows Defender Advanced Threat Protection\Classification\Dprt\Microsoft.Ceres.DocParsing.FormatHandlers.Designer.dll Handle ID: 0x88c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)(AU;IDSAFA;0x1000000;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Program Files\Windows Defender Advanced Threat Protection\Classification\Dprt\Microsoft.Ceres.DocParsing.FormatHandlers.Docx.dll Handle ID: 0x88c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)(AU;IDSAFA;0x1000000;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Program Files\Windows Defender Advanced Threat Protection\Classification\Dprt\Microsoft.Ceres.DocParsing.FormatHandlers.Dwg.dll Handle ID: 0x88c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)(AU;IDSAFA;0x1000000;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Program Files\Windows Defender Advanced Threat Protection\Classification\Dprt\Microsoft.Ceres.DocParsing.FormatHandlers.EncOffMetro.dll Handle ID: 0x88c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)(AU;IDSAFA;0x1000000;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Program Files\Windows Defender Advanced Threat Protection\Classification\Dprt\Microsoft.Ceres.DocParsing.FormatHandlers.ExcelGeneric.dll Handle ID: 0x88c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)(AU;IDSAFA;0x1000000;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Program Files\Windows Defender Advanced Threat Protection\Classification\Dprt\Microsoft.Ceres.DocParsing.FormatHandlers.ExcelLegacy.dll Handle ID: 0x88c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)(AU;IDSAFA;0x1000000;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Program Files\Windows Defender Advanced Threat Protection\Classification\Dprt\Microsoft.Ceres.DocParsing.FormatHandlers.Filter.dll Handle ID: 0x88c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)(AU;IDSAFA;0x1000000;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Program Files\Windows Defender Advanced Threat Protection\Classification\Dprt\Microsoft.Ceres.DocParsing.FormatHandlers.Fluid.dll Handle ID: 0x88c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)(AU;IDSAFA;0x1000000;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Program Files\Windows Defender Advanced Threat Protection\Classification\Dprt\Microsoft.Ceres.DocParsing.FormatHandlers.Gif.dll Handle ID: 0x88c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)(AU;IDSAFA;0x1000000;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Program Files\Windows Defender Advanced Threat Protection\Classification\Dprt\Microsoft.Ceres.DocParsing.FormatHandlers.GZip.dll Handle ID: 0x88c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)(AU;IDSAFA;0x1000000;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Program Files\Windows Defender Advanced Threat Protection\Classification\Dprt\Microsoft.Ceres.DocParsing.FormatHandlers.Html.dll Handle ID: 0x88c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)(AU;IDSAFA;0x1000000;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Program Files\Windows Defender Advanced Threat Protection\Classification\Dprt\Microsoft.Ceres.DocParsing.FormatHandlers.Image.dll Handle ID: 0x88c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)(AU;IDSAFA;0x1000000;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Program Files\Windows Defender Advanced Threat Protection\Classification\Dprt\Microsoft.Ceres.DocParsing.FormatHandlers.ImageWithoutMeta.dll Handle ID: 0x88c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)(AU;IDSAFA;0x1000000;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Program Files\Windows Defender Advanced Threat Protection\Classification\Dprt\Microsoft.Ceres.DocParsing.FormatHandlers.Jpeg.dll Handle ID: 0x88c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)(AU;IDSAFA;0x1000000;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Program Files\Windows Defender Advanced Threat Protection\Classification\Dprt\Microsoft.Ceres.DocParsing.FormatHandlers.Json.dll Handle ID: 0x88c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)(AU;IDSAFA;0x1000000;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Program Files\Windows Defender Advanced Threat Protection\Classification\Dprt\Microsoft.Ceres.DocParsing.FormatHandlers.Lnk.dll Handle ID: 0x88c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)(AU;IDSAFA;0x1000000;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Program Files\Windows Defender Advanced Threat Protection\Classification\Dprt\Microsoft.Ceres.DocParsing.FormatHandlers.Mime.dll Handle ID: 0x88c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)(AU;IDSAFA;0x1000000;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Program Files\Windows Defender Advanced Threat Protection\Classification\Dprt\Microsoft.Ceres.DocParsing.FormatHandlers.Msg.dll Handle ID: 0x88c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)(AU;IDSAFA;0x1000000;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Program Files\Windows Defender Advanced Threat Protection\Classification\Dprt\Microsoft.Ceres.DocParsing.FormatHandlers.Ocr.dll Handle ID: 0x88c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)(AU;IDSAFA;0x1000000;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Program Files\Windows Defender Advanced Threat Protection\Classification\Dprt\Microsoft.Ceres.DocParsing.FormatHandlers.OfficeXml.dll Handle ID: 0x88c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)(AU;IDSAFA;0x1000000;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Program Files\Windows Defender Advanced Threat Protection\Classification\Dprt\Microsoft.Ceres.DocParsing.FormatHandlers.OneNote.dll Handle ID: 0x88c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)(AU;IDSAFA;0x1000000;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Program Files\Windows Defender Advanced Threat Protection\Classification\Dprt\Microsoft.Ceres.DocParsing.FormatHandlers.Pdf.dll Handle ID: 0x88c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)(AU;IDSAFA;0x1000000;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Program Files\Windows Defender Advanced Threat Protection\Classification\Dprt\Microsoft.Ceres.DocParsing.FormatHandlers.PFile.dll Handle ID: 0x88c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)(AU;IDSAFA;0x1000000;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Program Files\Windows Defender Advanced Threat Protection\Classification\Dprt\Microsoft.Ceres.DocParsing.FormatHandlers.Plaintext.dll Handle ID: 0x88c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)(AU;IDSAFA;0x1000000;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Program Files\Windows Defender Advanced Threat Protection\Classification\Dprt\Microsoft.Ceres.DocParsing.FormatHandlers.Png.dll Handle ID: 0x88c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)(AU;IDSAFA;0x1000000;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Program Files\Windows Defender Advanced Threat Protection\Classification\Dprt\Microsoft.Ceres.DocParsing.FormatHandlers.PointPublishing.dll Handle ID: 0x88c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)(AU;IDSAFA;0x1000000;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Program Files\Windows Defender Advanced Threat Protection\Classification\Dprt\Microsoft.Ceres.DocParsing.FormatHandlers.Pptx.dll Handle ID: 0x88c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)(AU;IDSAFA;0x1000000;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Program Files\Windows Defender Advanced Threat Protection\Classification\Dprt\Microsoft.Ceres.DocParsing.FormatHandlers.RmsOfficeLegacy.dll Handle ID: 0x88c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)(AU;IDSAFA;0x1000000;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Program Files\Windows Defender Advanced Threat Protection\Classification\Dprt\Microsoft.Ceres.DocParsing.FormatHandlers.Rtf.dll Handle ID: 0x88c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)(AU;IDSAFA;0x1000000;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Program Files\Windows Defender Advanced Threat Protection\Classification\Dprt\Microsoft.Ceres.DocParsing.FormatHandlers.SevenZip.dll Handle ID: 0x88c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)(AU;IDSAFA;0x1000000;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Program Files\Windows Defender Advanced Threat Protection\Classification\Dprt\Microsoft.Ceres.DocParsing.FormatHandlers.SimpleXml.dll Handle ID: 0x88c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)(AU;IDSAFA;0x1000000;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Program Files\Windows Defender Advanced Threat Protection\Classification\Dprt\Microsoft.Ceres.DocParsing.FormatHandlers.Tar.dll Handle ID: 0x88c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)(AU;IDSAFA;0x1000000;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Program Files\Windows Defender Advanced Threat Protection\Classification\Dprt\Microsoft.Ceres.DocParsing.FormatHandlers.Vtt.dll Handle ID: 0x88c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)(AU;IDSAFA;0x1000000;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Program Files\Windows Defender Advanced Threat Protection\Classification\Dprt\Microsoft.Ceres.DocParsing.FormatHandlers.Xps.dll Handle ID: 0x88c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)(AU;IDSAFA;0x1000000;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Program Files\Windows Defender Advanced Threat Protection\Classification\Dprt\Microsoft.Ceres.DocParsing.FormatHandlers.Zip.dll Handle ID: 0x88c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)(AU;IDSAFA;0x1000000;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Program Files\Windows Defender Advanced Threat Protection\Classification\Dprt\Microsoft.Ceres.DocParsing.Runtime.Client.dll Handle ID: 0x88c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)(AU;IDSAFA;0x1000000;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Program Files\Windows Defender Advanced Threat Protection\Classification\Dprt\Microsoft.Ceres.DocParsing.Runtime.Common.dll Handle ID: 0x88c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)(AU;IDSAFA;0x1000000;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Program Files\Windows Defender Advanced Threat Protection\Classification\Dprt\Microsoft.Ceres.DocParsing.Runtime.Core.dll Handle ID: 0x88c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)(AU;IDSAFA;0x1000000;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Program Files\Windows Defender Advanced Threat Protection\Classification\Dprt\Microsoft.Ceres.DocParsing.Runtime.FormatDetector.dll Handle ID: 0x88c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)(AU;IDSAFA;0x1000000;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Program Files\Windows Defender Advanced Threat Protection\Classification\Dprt\Microsoft.Ceres.DocParsing.Runtime.FormatHandler.dll Handle ID: 0x88c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)(AU;IDSAFA;0x1000000;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Program Files\Windows Defender Advanced Threat Protection\Classification\Dprt\Microsoft.Ceres.DocParsing.Runtime.LanguageDetector.dll Handle ID: 0x88c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)(AU;IDSAFA;0x1000000;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Program Files\Windows Defender Advanced Threat Protection\Classification\Dprt\Microsoft.Ceres.DocParsing.Runtime.Plugin.dll Handle ID: 0x88c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)(AU;IDSAFA;0x1000000;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Program Files\Windows Defender Advanced Threat Protection\Classification\Dprt\MimeKitLite.dll Handle ID: 0x88c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)(AU;IDSAFA;0x1000000;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Program Files\Windows Defender Advanced Threat Protection\Classification\Dprt\NativeDocumentParsers.cat Handle ID: 0x88c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)(AU;IDSAFA;0x1000000;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Program Files\Windows Defender Advanced Threat Protection\Classification\Dprt\NativeDocumentParsers.dll Handle ID: 0x88c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)(AU;IDSAFA;0x1000000;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Program Files\Windows Defender Advanced Threat Protection\Classification\Dprt\NativeDprt.dll Handle ID: 0x88c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)(AU;IDSAFA;0x1000000;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Program Files\Windows Defender Advanced Threat Protection\Classification\Dprt\Newtonsoft.Json.dll Handle ID: 0x88c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)(AU;IDSAFA;0x1000000;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Program Files\Windows Defender Advanced Threat Protection\Classification\Dprt\pdfium.dll Handle ID: 0x88c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)(AU;IDSAFA;0x1000000;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Program Files\Windows Defender Advanced Threat Protection\Classification\Dprt\RtfPipe.dll Handle ID: 0x88c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)(AU;IDSAFA;0x1000000;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Program Files\Windows Defender Advanced Threat Protection\Classification\Dprt\SkiaSharp.dll Handle ID: 0x88c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)(AU;IDSAFA;0x1000000;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Program Files\Windows Defender Advanced Threat Protection\Classification\Dprt\System.Collections.Immutable.dll Handle ID: 0x88c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)(AU;IDSAFA;0x1000000;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Program Files\Windows Defender Advanced Threat Protection\Classification\Dprt\System.Drawing.Common.dll Handle ID: 0x88c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)(AU;IDSAFA;0x1000000;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Program Files\Windows Defender Advanced Threat Protection\Classification\Dprt\ThirdPartyNotice.txt Handle ID: 0x88c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)(AU;IDSAFA;0x1000000;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Program Files\Windows Defender Advanced Threat Protection\Classification\Dprt\UtfUnknown.dll Handle ID: 0x88c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)(AU;IDSAFA;0x1000000;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Program Files\Windows Defender Advanced Threat Protection\Classification\Dprt\x64\7z.dll Handle ID: 0x88c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)(AU;IDSAFA;0x1000000;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Program Files\Windows Defender Advanced Threat Protection\en-US\MsSense.exe.mui Handle ID: 0x88c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)(AU;IDSAFA;0x1000000;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Program Files\Windows Media Player\wmpnetwk.exe Handle ID: 0x88c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Program Files\Windows Media Player\wmpnssci.dll Handle ID: 0x88c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Program Files\Windows Media Player\Skins\Revert.wmz Handle ID: 0x88c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Program Files (x86)\Common Files\Microsoft Shared\ink\InkDiv.dll Handle ID: 0x88c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Program Files (x86)\Common Files\Microsoft Shared\ink\InkObj.dll Handle ID: 0x88c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Program Files (x86)\Common Files\Microsoft Shared\ink\Microsoft.Ink.dll Handle ID: 0x88c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Program Files (x86)\Common Files\Microsoft Shared\ink\mshwstaging.dll Handle ID: 0x88c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Program Files (x86)\Common Files\Microsoft Shared\ink\tiptsf.dll Handle ID: 0x88c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Program Files (x86)\Common Files\Microsoft Shared\MSInfo\msinfo32.exe Handle ID: 0x88c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Program Files (x86)\Common Files\Microsoft Shared\VGX\VGX.dll Handle ID: 0x88c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Program Files (x86)\Common Files\System\wab32.dll Handle ID: 0x88c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Program Files (x86)\Common Files\System\Ole DB\sqloledb.dll Handle ID: 0x88c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Program Files (x86)\Internet Explorer\IEShims.dll Handle ID: 0x88c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Program Files (x86)\Windows Media Player\wmpnssci.dll Handle ID: 0x88c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Program Files (x86)\Windows Media Player\Skins\Revert.wmz Handle ID: 0x88c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\ProgramData\Microsoft\Windows\DeviceMetadataStore\en-US\63921eef-8415-4368-9201-f0df4af5778f.devicemetadata-ms Handle ID: 0x88c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\ProgramData\Microsoft\Windows Defender Advanced Threat Protection\Task\SenseTask.exe Handle ID: 0x88c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)(AU;IDSAFA;0x10d0000;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\ProgramData\USOPrivate\ExpeditedAppRegistrations\MS_AutoSuperRes\updater_AutoSuperRes.json Handle ID: 0x88c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\explorer.exe Handle ID: 0x88c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\HelpPane.exe Handle ID: 0x754 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\regedit.exe Handle ID: 0x88c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\splwow64.exe Handle ID: 0x88c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\twain_32.dll Handle ID: 0x88c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\apppatch\AcRes.dll Handle ID: 0x88c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\apppatch\drvmain.sdb Handle ID: 0x88c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\apppatch\MergeSdbFilesSource\msiMerge.sdb Handle ID: 0x88c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\apppatch\MergeSdbFilesSource\sysMerge.sdb Handle ID: 0x88c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\bcastdvr\KnownGameList.bin Handle ID: 0x88c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\Boot\Fonts\chs_boot.ttf Handle ID: 0x88c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\Boot\Fonts\cht_boot.ttf Handle ID: 0x88c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\Boot\Fonts\jpn_boot.ttf Handle ID: 0x88c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\Boot\Fonts\kor_boot.ttf Handle ID: 0x88c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\Boot\Fonts\malgun_boot.ttf Handle ID: 0x88c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\Boot\Fonts\malgunn_boot.ttf Handle ID: 0x88c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\Boot\Fonts\meiryo_boot.ttf Handle ID: 0x88c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\Boot\Fonts\meiryon_boot.ttf Handle ID: 0x88c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\Boot\Fonts\msjh_boot.ttf Handle ID: 0x88c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\Boot\Fonts\msjhn_boot.ttf Handle ID: 0x88c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\Boot\Fonts\msyh_boot.ttf Handle ID: 0x88c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\Boot\Fonts\msyhn_boot.ttf Handle ID: 0x88c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\Boot\Fonts\segmono_boot.ttf Handle ID: 0x88c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\Boot\Fonts\segoe_slboot.ttf Handle ID: 0x88c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\Boot\Fonts\segoen_slboot.ttf Handle ID: 0x88c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\Boot\Fonts\wgl4_boot.ttf Handle ID: 0x88c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\Boot\Fonts_EX\chs_boot_EX.ttf Handle ID: 0x88c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\Boot\Fonts_EX\cht_boot_EX.ttf Handle ID: 0x88c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\Boot\Fonts_EX\jpn_boot_EX.ttf Handle ID: 0x88c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\Boot\Fonts_EX\kor_boot_EX.ttf Handle ID: 0x88c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\Boot\Fonts_EX\malgun_boot_EX.ttf Handle ID: 0x88c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\Boot\Fonts_EX\malgunn_boot_EX.ttf Handle ID: 0x88c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\Boot\Fonts_EX\meiryo_boot_EX.ttf Handle ID: 0x88c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\Boot\Fonts_EX\meiryon_boot_EX.ttf Handle ID: 0x88c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\Boot\Fonts_EX\msjh_boot_EX.ttf Handle ID: 0x88c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\Boot\Fonts_EX\msjhn_boot_EX.ttf Handle ID: 0x88c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\Boot\Fonts_EX\msyh_boot_EX.ttf Handle ID: 0x88c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\Boot\Fonts_EX\msyhn_boot_EX.ttf Handle ID: 0x88c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\Boot\Fonts_EX\segmono_boot_EX.ttf Handle ID: 0x88c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\Boot\Fonts_EX\segoe_slboot_EX.ttf Handle ID: 0x88c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\Boot\Fonts_EX\segoen_slboot_EX.ttf Handle ID: 0x88c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\Boot\Fonts_EX\wgl4_boot_EX.ttf Handle ID: 0x88c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\Boot\PCAT\fr-CA\bootmgr.exe.mui Handle ID: 0x88c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\Boot\PCAT\ja-JP\bootmgr.exe.mui Handle ID: 0x88c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\Boot\PCAT\nl-NL\bootmgr.exe.mui Handle ID: 0x88c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\Boot\PCAT\qps-ploc\bootmgr.exe.mui Handle ID: 0x88c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\Boot\PCAT\sv-SE\bootmgr.exe.mui Handle ID: 0x88c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\BrowserCore\BrowserCore.exe Handle ID: 0x88c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\diagnostics\system\Audio\AudioDiagnosticSnapIn.dll Handle ID: 0x88c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\diagnostics\system\Audio\AudioDiagnosticUtil.dll Handle ID: 0x88c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\diagnostics\system\Audio\DiagPackage.dll Handle ID: 0x88c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\diagnostics\system\Video\DiagPackage.dll Handle ID: 0x88c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\diagnostics\system\Video\VideoDiagnosticUtil.dll Handle ID: 0x88c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\DiagTrack\RunExeActionAllowedList.dat Handle ID: 0x88c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\Fonts\SegoeIcons.ttf Handle ID: 0x88c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\Fonts\segoeui.ttf Handle ID: 0x88c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\Fonts\segoeuib.ttf Handle ID: 0x88c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\Fonts\segoeuii.ttf Handle ID: 0x88c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\Fonts\segoeuil.ttf Handle ID: 0x88c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\Fonts\segoeuisl.ttf Handle ID: 0x88c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\Fonts\segoeuiz.ttf Handle ID: 0x88c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\Fonts\seguibl.ttf Handle ID: 0x88c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\Fonts\seguibli.ttf Handle ID: 0x88c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\Fonts\seguili.ttf Handle ID: 0x88c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\Fonts\seguisb.ttf Handle ID: 0x88c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\Fonts\seguisbi.ttf Handle ID: 0x88c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\Fonts\seguisli.ttf Handle ID: 0x88c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\Fonts\simsunb.ttf Handle ID: 0x88c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\Fonts\SimsunExtG.ttf Handle ID: 0x88c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\Fonts\StaticCache.dat Handle ID: 0x88c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\Fonts\times.ttf Handle ID: 0x88c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\Fonts\timesbd.ttf Handle ID: 0x88c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\Globalization\ELS\SpellDictionaries\MsSp7en-US.lex Handle ID: 0x88c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\Help\en-US\credits.txt Handle ID: 0x88c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\ImmersiveControlPanel\SystemSettings.dll Handle ID: 0x88c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\ImmersiveControlPanel\SystemSettings.exe Handle ID: 0x88c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\ImmersiveControlPanel\SystemSettingsViewModel.Desktop.dll Handle ID: 0x88c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\ImmersiveControlPanel\Telemetry.Common.dll Handle ID: 0x88c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\ImmersiveControlPanel\en-US\SystemSettings.exe.mui Handle ID: 0x88c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\ImmersiveControlPanel\Settings\AllSystemSettings_{D6E2A6C6-627C-44F2-8A5C-4959AC0C2B2D}.xml Handle ID: 0x88c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\ImmersiveControlPanel\Settings\AllSystemSettings_{FDB289F3-FCFC-4702-8015-18926E996EC1}.xml Handle ID: 0x88c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\InboxApps\Microsoft.StartExperiencesApp_8wekyb3d8bbwe.msixbundle Handle ID: 0x88c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\INF\apps.inf Handle ID: 0x88c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\PolicyDefinitions\AppxPackageManager.admx Handle ID: 0x83c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\PolicyDefinitions\SecureBoot.admx Handle ID: 0x83c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\PolicyDefinitions\Sharing.admx Handle ID: 0x83c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\PolicyDefinitions\Windows.admx Handle ID: 0x83c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\PolicyDefinitions\WindowsCopilot.admx Handle ID: 0x83c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\PolicyDefinitions\en-US\Explorer.adml Handle ID: 0x83c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\PolicyDefinitions\en-US\SecureBoot.adml Handle ID: 0x83c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\PolicyDefinitions\en-US\Sharing.adml Handle ID: 0x83c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\PolicyDefinitions\en-US\Windows.adml Handle ID: 0x83c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\PolicyDefinitions\en-US\WindowsCopilot.adml Handle ID: 0x83c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\Provisioning\Microsoft-Desktop-Provisioning-Sequence.dat Handle ID: 0x83c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\Provisioning\Microsoft-Desktop-Provisioning.dat Handle ID: 0x83c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\Provisioning\Cosa\Microsoft\Microsoft.Windows.Cosa.Desktop.Client.ppkg Handle ID: 0x83c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\Resources\Themes\aero\aero.msstyles Handle ID: 0x83c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\Resources\Themes\aero\aerolite.msstyles Handle ID: 0x83c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\ServiceProfiles\LocalService\AppData\Local\UsageAndQualityInsights\Feature_Configs\ShellHealth_V2.json Handle ID: 0x83c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\TrustedInstaller.exe Handle ID: 0x83c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\Editions\EditionMatrix.xml Handle ID: 0x83c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\en-US\TrustedInstaller.exe.mui Handle ID: 0x83c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\FodMetadata\metadata\DesktopTargetCompDB_Conditions.xml Handle ID: 0x83c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\servicing\FodMetadata\metadata\DesktopTargetCompDB_FOD_Metadata_Neutral.xml Handle ID: 0x83c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\ShellComponents\WindowsInternal.ComposableShell.DesktopHosting.dll Handle ID: 0x83c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\ShellComponents\WindowsInternal.ComposableShell.Experiences.Switcher.dll Handle ID: 0x83c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\ShellExperiences\JumpViewUI.dll Handle ID: 0x83c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\ShellExperiences\NetworkUX.dll Handle ID: 0x83c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\ShellExperiences\PeopleBarContainer.dll Handle ID: 0x83c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\ShellExperiences\PeopleBarFlyout.dll Handle ID: 0x83c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\ShellExperiences\PeopleBarJumpView.dll Handle ID: 0x83c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\ShellExperiences\PeopleCommonControls.dll Handle ID: 0x83c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\ShellExperiences\PeoplePane.dll Handle ID: 0x83c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\ShellExperiences\ShoulderTapView.dll Handle ID: 0x83c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\ShellExperiences\TileControl.dll Handle ID: 0x83c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\ShellExperiences\WindowsInternal.People.PeoplePicker.dll Handle ID: 0x83c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\ShellExperiences\WindowsInternal.People.Relevance.dll Handle ID: 0x83c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\3bc29097-7317-41d3-93b9-38a48f99d48a_mssrch.dll Handle ID: 0x83c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\6bea57fb-8dfb-4177-9ae8-42e8b3529933_RuntimeDeviceInstall.dll Handle ID: 0x83c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\aadauthhelper.dll Handle ID: 0x83c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\aadcloudap.dll Handle ID: 0x83c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\aadtb.dll Handle ID: 0x83c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\aadWamExtension.dll Handle ID: 0x83c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\AarSvc.dll Handle ID: 0x83c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\AboutSettingsHandlers.dll Handle ID: 0x83c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\accessibilitycpl.dll Handle ID: 0x83c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\AccountHealth.dll Handle ID: 0x83c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\AcGenral.dll Handle ID: 0x83c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\AcLayers.dll Handle ID: 0x83c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\aclui.dll Handle ID: 0x83c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\acmigration.dll Handle ID: 0x83c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\ACPBackgroundManagerPolicy.dll Handle ID: 0x83c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\acppage.dll Handle ID: 0x83c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\AcSpecfc.dll Handle ID: 0x83c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\ActivationManager.dll Handle ID: 0x83c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\activeds.dll Handle ID: 0x83c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\actxprxy.dll Handle ID: 0x83c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\AdmTmpl.dll Handle ID: 0x83c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\adprovider.dll Handle ID: 0x83c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\adpsvc.dll Handle ID: 0x83c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\adsldp.dll Handle ID: 0x83c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\adsnt.dll Handle ID: 0x83c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\adtschema.dll Handle ID: 0x83c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\advapi32.dll Handle ID: 0x83c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\aeinv.dll Handle ID: 0x83c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\aemarebackup.dll Handle ID: 0x83c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\aepic.dll Handle ID: 0x83c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\agentactivationruntime.dll Handle ID: 0x83c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\agentactivationruntimewindows.dll Handle ID: 0x83c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\aitstatic.exe Handle ID: 0x83c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\alg.exe Handle ID: 0x83c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\apisampling.dll Handle ID: 0x83c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\ApiSetHost.AppExecutionAlias.dll Handle ID: 0x83c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\APMon.dll Handle ID: 0x9b8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\APMonUI.dll Handle ID: 0x83c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\AppContracts.dll Handle ID: 0x83c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\AppExtension.dll Handle ID: 0x83c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\appfootprint.dll Handle ID: 0x83c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\apphelp.dll Handle ID: 0x8c8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\AppHostRegistrationVerifier.exe Handle ID: 0x83c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\appidtel.exe Handle ID: 0x83c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\appinfo.dll Handle ID: 0x83c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\appinfoext.dll Handle ID: 0x83c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\AppInstallerBackgroundUpdate.exe Handle ID: 0x9b8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\ApplicationControlCSP.dll Handle ID: 0x83c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\ApplicationFrame.dll Handle ID: 0x83c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\ApplicationFrameHost.exe Handle ID: 0x83c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\ApplicationTargetedFeatureDatabase.dll Handle ID: 0x83c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\AppListBackupLauncher.dll Handle ID: 0x9b8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\AppLockerCSP.dll Handle ID: 0x83c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\ApplySettingsTemplateCatalog.exe Handle ID: 0x83c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\ApplyTrustOffline.exe Handle ID: 0x83c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\appmgmts.dll Handle ID: 0x9b8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\appraiser.dll Handle ID: 0x83c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\AppReadiness.dll Handle ID: 0x83c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\AppResolver.dll Handle ID: 0x83c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\AppVClientPS.dll Handle ID: 0x83c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\AppVDllSurrogate.exe Handle ID: 0x83c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\AppVEntSubsystemController.dll Handle ID: 0x83c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\AppVEntSubsystems64.dll Handle ID: 0x83c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\AppVEntVirtualization.dll Handle ID: 0x83c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\AppVSentinel.dll Handle ID: 0x83c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\AppVTerminator.dll Handle ID: 0x83c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\appwiz.cpl Handle ID: 0x83c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\AppxAllUserStore.dll Handle ID: 0x83c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\AppXApplicabilityBlob.dll Handle ID: 0x83c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\AppxApplicabilityEngine.dll Handle ID: 0x83c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\AppXDeploymentClient.dll Handle ID: 0x83c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\AppXDeploymentExtensions.desktop.dll Handle ID: 0x83c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\AppXDeploymentExtensions.onecore.dll Handle ID: 0x83c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\AppXDeploymentServer.dll Handle ID: 0x83c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\AppxPackaging.dll Handle ID: 0x83c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\AppxProvisioning.xml Handle ID: 0x83c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\AppxSip.dll Handle ID: 0x83c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\AppxSysprep.dll Handle ID: 0x83c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\Apx01000.dll Handle ID: 0x83c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\archiveint.dll Handle ID: 0x83c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\AssignedAccessCsp.dll Handle ID: 0x83c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\AssignedAccessManager.dll Handle ID: 0x83c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\assignedaccessmanagersvc.dll Handle ID: 0x83c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\AssignedAccessRuntime.dll Handle ID: 0x83c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\AssignedAccessShellProxy.dll Handle ID: 0x83c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\AtBroker.exe Handle ID: 0x83c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\atmlib.dll Handle ID: 0x83c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\audiodg.exe Handle ID: 0x83c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\AudioEndpointBuilder.dll Handle ID: 0x83c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\AudioEng.dll Handle ID: 0x83c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\AudioHandlers.dll Handle ID: 0x83c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\AUDIOKSE.dll Handle ID: 0x83c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\AudioSes.dll Handle ID: 0x83c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\audiosrv.dll Handle ID: 0x83c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\AudioSrvPolicyManager.dll Handle ID: 0x83c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\auditcse.dll Handle ID: 0x83c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\AuthBroker.dll Handle ID: 0x83c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\AuthExt.dll Handle ID: 0x83c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\authfwcfg.dll Handle ID: 0x9b8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\AuthFWSnapin.dll Handle ID: 0x83c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\AuthHost.exe Handle ID: 0x83c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\AuthHostProxy.dll Handle ID: 0x83c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\authui.dll Handle ID: 0x83c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\authz.dll Handle ID: 0x83c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\autopilot.dll Handle ID: 0x83c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\avrt.dll Handle ID: 0x83c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\AxInstSv.dll Handle ID: 0x83c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\batmeter.dll Handle ID: 0x9b8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\bcastdvruserservice.dll Handle ID: 0x83c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\bcdedit.exe Handle ID: 0x83c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\BCP47Langs.dll Handle ID: 0x83c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\BCP47mrm.dll Handle ID: 0x83c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\bcrypt.dll Handle ID: 0x83c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\bcryptprimitives.dll Handle ID: 0x83c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\bdechangepin.exe Handle ID: 0x83c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\bdesvc.dll Handle ID: 0x83c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\BdeUISrv.exe Handle ID: 0x83c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\bidispl.dll Handle ID: 0x83c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\BingASDS.dll Handle ID: 0x83c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\BingMaps.dll Handle ID: 0x83c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\BioCredProv.dll Handle ID: 0x83c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\BioIso.exe Handle ID: 0x83c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\bisrv.dll Handle ID: 0x9b8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\BitLockerCsp.dll Handle ID: 0x83c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\BitLockerDeviceEncryption.exe Handle ID: 0x83c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\bitsadmin.exe Handle ID: 0x83c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\bitsperf.dll Handle ID: 0x83c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\biwinrt.dll Handle ID: 0x83c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\BluetoothApis.dll Handle ID: 0x83c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\BluetoothDesktopHandlers.dll Handle ID: 0x83c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\BluetoothOppPushClient.dll Handle ID: 0x83c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\bnmanager.dll Handle ID: 0x83c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\BootCriticalUpdatePlugin.dll Handle ID: 0x83c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\BootMenuUX.dll Handle ID: 0x9b8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\BTAGService.dll Handle ID: 0x83c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\BthAvctpSvc.dll Handle ID: 0x83c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\BthAvrcp.dll Handle ID: 0x83c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\bthpanapi.dll Handle ID: 0x83c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\BthRadioMedia.dll Handle ID: 0x83c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\bthserv.dll Handle ID: 0x83c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\BthTelemetry.dll Handle ID: 0x83c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\bthudtask.exe Handle ID: 0x83c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\Bubbles.scr Handle ID: 0x9b8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\cabapi.dll Handle ID: 0x83c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\cabview.dll Handle ID: 0x83c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\camext.dll Handle ID: 0x83c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\CapabilityAccessHandlers.dll Handle ID: 0x83c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\CapabilityAccessManager.Desktop.Storage.dll Handle ID: 0x83c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\CapabilityAccessManager.dll Handle ID: 0x83c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\CapabilityAccessManagerClient.dll Handle ID: 0x83c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\capauthz.dll Handle ID: 0x83c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\capiprovider.dll Handle ID: 0x83c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\CaptureService.dll Handle ID: 0x83c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\CastLaunch.dll Handle ID: 0x83c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\CastSrv.exe Handle ID: 0x83c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\CBDHSvc.dll Handle ID: 0x83c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\cdp.dll Handle ID: 0x83c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\cdprt.dll Handle ID: 0x83c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\cdpsvc.dll Handle ID: 0x83c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\cdpusersvc.dll Handle ID: 0x9b8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\cellulardatacapabilityhandler.dll Handle ID: 0x83c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\certca.dll Handle ID: 0x83c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\certcli.dll Handle ID: 0x83c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\CertEnroll.dll Handle ID: 0x83c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\CertEnrollCtrl.exe Handle ID: 0x83c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\CertEnrollUI.dll Handle ID: 0x83c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\CertPKICmdlet.dll Handle ID: 0x9b8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\CertPolEng.dll Handle ID: 0x83c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\certreq.exe Handle ID: 0x83c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\certutil.exe Handle ID: 0x83c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\cewmdm.dll Handle ID: 0x83c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\cfgmgr32.dll Handle ID: 0x83c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:39 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\CfgSPCellular.dll Handle ID: 0x83c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\cflapi.dll Handle ID: 0x83c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\Chakra.dll Handle ID: 0x83c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\Chakradiag.dll Handle ID: 0x83c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\charmap.exe Handle ID: 0x83c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\ChsStrokeDS.dll Handle ID: 0x83c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\ChtBopomofoDS.dll Handle ID: 0x83c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\ChtCangjieDS.dll Handle ID: 0x83c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\ChtHkStrokeDS.dll Handle ID: 0x83c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\ChtQuickDS.dll Handle ID: 0x83c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\ChxAPDS.dll Handle ID: 0x83c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\ChxDecoder.dll Handle ID: 0x9b8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\ChxHAPDS.dll Handle ID: 0x83c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\chxinputrouter.dll Handle ID: 0x83c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\chxranker.dll Handle ID: 0x83c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\cimfs.dll Handle ID: 0x83c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\clbcatq.dll Handle ID: 0x83c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\cldapi.dll Handle ID: 0x83c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\cleanmgr.exe Handle ID: 0x83c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\clfsw32.dll Handle ID: 0x9b8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\ClipboardServer.dll Handle ID: 0x83c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\ClipDLS.exe Handle ID: 0x83c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\ClipRenew.exe Handle ID: 0x83c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\ClipSVC.dll Handle ID: 0x83c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\ClipUp.exe Handle ID: 0x83c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\clipwinrt.dll Handle ID: 0x83c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\cloudAP.dll Handle ID: 0x83c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\CloudDesktopCSP.dll Handle ID: 0x83c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\CloudDomainJoinAUG.dll Handle ID: 0x83c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\CloudDomainJoinDataModelServer.dll Handle ID: 0x83c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\CloudExperienceHost.dll Handle ID: 0x83c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\CloudExperienceHostBroker.dll Handle ID: 0x83c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\CloudExperienceHostCommon.dll Handle ID: 0x83c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\CloudExperienceHostRedirection.dll Handle ID: 0x83c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\CloudExperienceHostUser.dll Handle ID: 0x83c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\CloudIdWxhExtension.dll Handle ID: 0x83c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\CloudNotifications.exe Handle ID: 0x83c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\CloudRestoreLauncher.dll Handle ID: 0x83c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\clusapi.dll Handle ID: 0x83c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\cmd.exe Handle ID: 0x83c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\cmdext.dll Handle ID: 0x83c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\cmdkey.exe Handle ID: 0x83c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\cmifw.dll Handle ID: 0x83c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\cmintegrator.dll Handle ID: 0x83c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\cmmon32.exe Handle ID: 0x83c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\cngcredui.dll Handle ID: 0x88c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\cngprovider.dll Handle ID: 0x88c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\CodeIntegrityAggregator.dll Handle ID: 0x88c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\COLORCNV.DLL Handle ID: 0x88c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\colorui.dll Handle ID: 0x88c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\combase.dll Handle ID: 0x88c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\comdlg32.dll Handle ID: 0x88c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\coml2.dll Handle ID: 0x88c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\CompatTelRunner.exe Handle ID: 0x88c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\ComposerFramework.dll Handle ID: 0x88c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\CompPkgSrv.exe Handle ID: 0x88c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\CompPkgSup.dll Handle ID: 0x83c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\computecore.dll Handle ID: 0x88c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\computenetwork.dll Handle ID: 0x88c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\computestorage.dll Handle ID: 0x88c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\comsvcs.dll Handle ID: 0x83c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\configmanager2.dll Handle ID: 0x88c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\ConfigureExpandedStorage.dll Handle ID: 0x88c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\conhost.exe Handle ID: 0x88c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\consent.exe Handle ID: 0x88c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\ConsentExperienceCommon.dll Handle ID: 0x88c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\ConsentUX.dll Handle ID: 0x88c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\ConsentUxClient.dll Handle ID: 0x88c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\ConsoleLogon.dll Handle ID: 0x88c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\ConstraintIndex.Search.dll Handle ID: 0x88c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\ContactActivation.dll Handle ID: 0x88c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\ContactHarvesterDS.dll Handle ID: 0x88c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\ContentDeliveryManager.Utilities.dll Handle ID: 0x88c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\ControlCenter.dll Handle ID: 0x88c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\coredpus.dll Handle ID: 0x88c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\coreglobconfig.dll Handle ID: 0x88c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\CoreMessaging.dll Handle ID: 0x88c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\CoreShell.dll Handle ID: 0x88c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\CoreShellAPI.dll Handle ID: 0x88c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\CoreShellExtFramework.dll Handle ID: 0x88c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\CoreUIComponents.dll Handle ID: 0x88c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\correngine.dll Handle ID: 0x88c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\CourtesyEngine.dll Handle ID: 0x88c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\CPFilters.dll Handle ID: 0x88c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\CredDialogBroker.dll Handle ID: 0x88c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\CredentialEnrollmentManager.exe Handle ID: 0x88c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\CredentialEnrollmentManagerForUser.dll Handle ID: 0x88c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\CredentialUIBroker.exe Handle ID: 0x88c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\CredProv2faHelper.dll Handle ID: 0x88c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\CredProvCommonCore.dll Handle ID: 0x88c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\CredProvDataModel.dll Handle ID: 0x88c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\CredProvHelper.dll Handle ID: 0x88c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\credprovhost.dll Handle ID: 0x88c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\credprovs.dll Handle ID: 0x88c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\credprovslegacy.dll Handle ID: 0x88c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\credui.dll Handle ID: 0x88c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\crypt32.dll Handle ID: 0x88c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\cryptbase.dll Handle ID: 0x88c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\cryptcatsvc.dll Handle ID: 0x88c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\cryptnet.dll Handle ID: 0x88c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\cryptngc.dll Handle ID: 0x88c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\cryptoss.dll Handle ID: 0x88c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\CryptoWinRT.dll Handle ID: 0x88c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\cryptsp.dll Handle ID: 0x88c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\cryptsvc.dll Handle ID: 0x88c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\cryptui.dll Handle ID: 0x88c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\cryptxml.dll Handle ID: 0x88c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\CscMig.dll Handle ID: 0x88c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\cscript.exe Handle ID: 0x88c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\cscsvc.dll Handle ID: 0x88c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\cscui.dll Handle ID: 0x88c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\csplte.dll Handle ID: 0x88c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\ctac.json Handle ID: 0x88c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\ctfmon.exe Handle ID: 0x88c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\curl.exe Handle ID: 0x88c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\CustomInstallExec.exe Handle ID: 0x88c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\CustomShellHost.exe Handle ID: 0x88c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\cxcredprov.dll Handle ID: 0x88c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\CXHProvisioningServer.dll Handle ID: 0x88c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\d2d1.dll Handle ID: 0x88c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\d3d10level9.dll Handle ID: 0x88c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\d3d10warp.dll Handle ID: 0x88c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\d3d11.dll Handle ID: 0x88c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\d3d11on12.dll Handle ID: 0x83c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\D3D12.dll Handle ID: 0x88c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\D3D12Core.dll Handle ID: 0x88c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\d3d9.dll Handle ID: 0x88c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\d3d9on12.dll Handle ID: 0x88c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\D3DCompiler_47.dll Handle ID: 0x88c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\D3DSCache.dll Handle ID: 0x88c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\dab.dll Handle ID: 0x88c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\dafAspInfraProvider.dll Handle ID: 0x88c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\dafBth.dll Handle ID: 0x88c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\DafDnsSd.dll Handle ID: 0x88c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\dafDockingProvider.dll Handle ID: 0x88c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\DAFESCL.dll Handle ID: 0x88c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\DafGip.dll Handle ID: 0x88c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\DAFIPP.dll Handle ID: 0x83c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\DAFMCP.dll Handle ID: 0x88c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\dafpos.dll Handle ID: 0x88c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\DafPrintProvider.dll Handle ID: 0x88c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\dafupnp.dll Handle ID: 0x88c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\dafWCN.dll Handle ID: 0x88c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\dafWfdProvider.dll Handle ID: 0x88c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\DAFWiProv.dll Handle ID: 0x88c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\DAFWSD.dll Handle ID: 0x88c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\das.dll Handle ID: 0x88c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\dasHost.exe Handle ID: 0x88c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\DataExchange.dll Handle ID: 0x88c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\DataStoreCacheDumpTool.exe Handle ID: 0x83c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\daxexec.dll Handle ID: 0x88c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\dbgcore.dll Handle ID: 0x88c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\dccw.exe Handle ID: 0x88c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\dcntel.dll Handle ID: 0x88c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\dcomp.dll Handle ID: 0x88c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\dcsvc.dll Handle ID: 0x74c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\DdcComImplementationsDesktop.dll Handle ID: 0x88c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\DDDS.dll Handle ID: 0x88c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\ddisplay.dll Handle ID: 0x88c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\ddraw.dll Handle ID: 0x88c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\desk.cpl Handle ID: 0x88c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\desktopimgdownldr.exe Handle ID: 0x88c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\DesktopShellExt.dll Handle ID: 0x88c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\DesktopSwitcherDataModel.dll Handle ID: 0x88c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\DevDispItemProvider.dll Handle ID: 0x88c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\DeveloperOptionsSettingsHandlers.dll Handle ID: 0x88c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\devenum.dll Handle ID: 0x88c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\deviceaccess.dll Handle ID: 0x88c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\deviceassociation.dll Handle ID: 0x88c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\DeviceCensus.exe Handle ID: 0x88c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\DeviceCenter.dll Handle ID: 0x88c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\DeviceDirectoryClient.dll Handle ID: 0x88c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\DeviceDriverRetrievalClient.dll Handle ID: 0x88c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\DeviceElementSource.dll Handle ID: 0x88c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\DeviceEnroller.exe Handle ID: 0x88c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\DeviceFlows.DataModel.dll Handle ID: 0x88c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\devicengccredprov.dll Handle ID: 0x88c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\DevicePairingExperienceMEM.dll Handle ID: 0x88c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\DevicePairingFolder.dll Handle ID: 0x88c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\DeviceReactivation.dll Handle ID: 0x734 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\DeviceSetupManager.dll Handle ID: 0x83c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\DeviceSetupManagerAPI.dll Handle ID: 0x754 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\DeviceSetupStatusProvider.dll Handle ID: 0x754 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\DevicesFlowBroker.dll Handle ID: 0x754 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\DeviceSoftwareInstallationClient.dll Handle ID: 0x754 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\DeviceUpdateAgent.dll Handle ID: 0x754 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\devinv.dll Handle ID: 0x754 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\devmgr.dll Handle ID: 0x83c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\DevPropMgr.dll Handle ID: 0x83c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\DevQueryBroker.dll Handle ID: 0x83c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\dfrgui.exe Handle ID: 0x83c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\dggpext.dll Handle ID: 0x83c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\dhcpcmonitor.dll Handle ID: 0x83c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\dhcpcore.dll Handle ID: 0x83c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\dhcpcore6.dll Handle ID: 0x83c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\dhcpcsvc.dll Handle ID: 0x83c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\dhcpcsvc6.dll Handle ID: 0x83c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\DiagnosticDataSettings.dll Handle ID: 0x83c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\DiagnosticLogCSP.dll Handle ID: 0x83c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\diagperf.dll Handle ID: 0x83c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\diagtrack.dll Handle ID: 0x83c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\dialclient.dll Handle ID: 0x83c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\dialserver.dll Handle ID: 0x83c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\dimsjob.dll Handle ID: 0x83c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\dimsroam.dll Handle ID: 0x83c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\directmanipulation.dll Handle ID: 0x83c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\directsr.dll Handle ID: 0x83c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\directxdatabasehelper.dll Handle ID: 0x83c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\directxdatabaseupdater.exe Handle ID: 0x498 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\discan.dll Handle ID: 0x498 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\diskusage.exe Handle ID: 0x8c8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\DismApi.dll Handle ID: 0x498 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\DispBroker.Desktop.dll Handle ID: 0x498 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\DispBroker.dll Handle ID: 0x498 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\dispdiag.exe Handle ID: 0x498 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\DisplayManager.dll Handle ID: 0x498 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\dlnashext.dll Handle ID: 0x498 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\DMAlertListener.ProxyStub.dll Handle ID: 0x498 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\DmApiSetExtImplDesktop.dll Handle ID: 0x498 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\dmcertinst.exe Handle ID: 0x498 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\dmcfghost.exe Handle ID: 0x498 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\dmclient.exe Handle ID: 0x498 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\dmcmnutils.dll Handle ID: 0x498 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\dmcsps.dll Handle ID: 0x8c8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\dmenrollengine.dll Handle ID: 0x498 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\dmloader.dll Handle ID: 0x8c8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\DmOsConfig.dll Handle ID: 0x498 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\DMRServer.dll Handle ID: 0x498 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\dmusic.dll Handle ID: 0x498 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\dmwappushsvc.dll Handle ID: 0x498 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\dmxmlhelputils.dll Handle ID: 0x498 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\dnsapi.dll Handle ID: 0x498 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\DnsClientCSP.dll Handle ID: 0x498 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\dnscmmc.dll Handle ID: 0x8c8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\dnsrslvr.dll Handle ID: 0x8c8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\Docking.VirtualInput.dll Handle ID: 0x8c8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\doclient.dll Handle ID: 0x8c8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\domgmt.dll Handle ID: 0x8c8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\dosettings.dll Handle ID: 0x8c8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\dosvc.dll Handle ID: 0x8c8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\dot3gpclnt.dll Handle ID: 0x8c8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\dot3gpui.dll Handle ID: 0x8c8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\dot3svc.dll Handle ID: 0x8c8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\dpapiprovider.dll Handle ID: 0x8c8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\dpapisrv.dll Handle ID: 0x8c8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\dps.dll Handle ID: 0x8c8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\drvinst.exe Handle ID: 0x8c8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\drvsetup.dll Handle ID: 0x8c8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\drvstore.dll Handle ID: 0x8c8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\dsclient.dll Handle ID: 0x9b8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\dsound.dll Handle ID: 0x8c8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\dsreg.dll Handle ID: 0x8c8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\dsregcmd.exe Handle ID: 0x8c8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\dsregtask.dll Handle ID: 0x8c8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\dssvc.dll Handle ID: 0x8c8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\dswave.dll Handle ID: 0x8c8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\dtdump.exe Handle ID: 0x8c8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\dtsh.dll Handle ID: 0x74c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\DuCsps.dll Handle ID: 0x8c8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\dui70.dll Handle ID: 0x8c8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\duser.dll Handle ID: 0x8c8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\dusmsvc.dll Handle ID: 0x8c8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\dusmtask.exe Handle ID: 0x8c8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\dwm.exe Handle ID: 0x8c8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\dwmapi.dll Handle ID: 0x8c8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\dwmcore.dll Handle ID: 0x8c8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\dwmghost.dll Handle ID: 0x8c8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\dwminit.dll Handle ID: 0x8c8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\dwmredir.dll Handle ID: 0x8c8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\DWrite.dll Handle ID: 0x8c8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\DWWIN.EXE Handle ID: 0x8c8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\DXCore.dll Handle ID: 0x8c8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\dxdiag.exe Handle ID: 0x498 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\dxdiagn.dll Handle ID: 0x498 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\dxgi.dll Handle ID: 0x74c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\dxgiadaptercache.exe Handle ID: 0x498 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\dxgwdi.dll Handle ID: 0x498 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\dxva2.dll Handle ID: 0x498 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\EAMProgressHandler.dll Handle ID: 0x498 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\Eap3Host.exe Handle ID: 0x9b8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\eapp3hst.dll Handle ID: 0x74c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\eappcfg.dll Handle ID: 0x74c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\eappcfgui.dll Handle ID: 0x9b8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\eapphost.dll Handle ID: 0x74c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\eapprovp.dll Handle ID: 0x74c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\eapputil.dll Handle ID: 0x74c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\eapsimextdesktop.dll Handle ID: 0x74c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\eapsvc.dll Handle ID: 0x74c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\EapTeapAuth.dll Handle ID: 0x74c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\EapTeapConfig.dll Handle ID: 0x74c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\EaseOfAccessDialog.exe Handle ID: 0x9b8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\easinvoker.exe Handle ID: 0x74c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\easwrt.dll Handle ID: 0x9b8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\EdgeContent.dll Handle ID: 0x74c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\edgehtml.dll Handle ID: 0x74c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\edgeIso.dll Handle ID: 0x74c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\edit.exe Handle ID: 0x74c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\EditBufferTestHook.dll Handle ID: 0x74c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\EditionUpgradeHelper.dll Handle ID: 0x9b8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\EditionUpgradeManagerObj.dll Handle ID: 0x9b8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\EDPCleanup.exe Handle ID: 0x74c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\edpnotify.exe Handle ID: 0x74c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\edptask.dll Handle ID: 0x9b8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\edputil.dll Handle ID: 0x9b8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\EduPrintProv.exe Handle ID: 0x9b8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\eeprov.dll Handle ID: 0x9b8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\eeutil.dll Handle ID: 0x9b8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\efsadu.dll Handle ID: 0x9b8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\efscore.dll Handle ID: 0x9b8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\efsext.dll Handle ID: 0x9b8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\efslsaext.dll Handle ID: 0x9b8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\efswrt.dll Handle ID: 0x9b8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\embeddedmodesvc.dll Handle ID: 0x9b8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\embeddedmodesvcapi.dll Handle ID: 0x9b8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\EmojiDS.dll Handle ID: 0x9b8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\energy.dll Handle ID: 0x9b8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\energyprov.dll Handle ID: 0x9b8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\energytask.dll Handle ID: 0x9b8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\enrollmentapi.dll Handle ID: 0x9b8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\EnterpriseAPNCsp.dll Handle ID: 0x9b8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\EnterpriseAppMgmtSvc.dll Handle ID: 0x9b8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\enterprisecsps.dll Handle ID: 0x9b8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\EnterpriseDesktopAppMgmtCSP.dll Handle ID: 0x9b8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\enterpriseresourcemanager.dll Handle ID: 0x9b8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\EoAExperiences.exe Handle ID: 0x9b8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\es.dll Handle ID: 0x9b8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\EsclProtocol.dll Handle ID: 0x9b8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\EsclScan.dll Handle ID: 0x1b88 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\EsclWiaDriver.dll Handle ID: 0x8c0 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\EsdSip.dll Handle ID: 0x9b8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\esent.dll Handle ID: 0x9b8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\eShims.dll Handle ID: 0x1b88 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\EthernetMediaManager.dll Handle ID: 0x9b8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\EtwRundown.dll Handle ID: 0x9b8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\eUICCsCSP.dll Handle ID: 0x9b8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\eventvwr.exe Handle ID: 0x9b8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\evr.dll Handle ID: 0x9b8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\ExecModelClient.dll Handle ID: 0x9b8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\ExplorerFrame.dll Handle ID: 0x9b8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\facecredentialprovider.dll Handle ID: 0x9b8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\Facilitator.dll Handle ID: 0x9b8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\Family.Cache.dll Handle ID: 0x9b8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\Family.SyncEngine.dll Handle ID: 0x9b8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\Faultrep.dll Handle ID: 0x9b8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\FaxPrinterInstaller.dll Handle ID: 0x9b8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\fclip.exe Handle ID: 0x9b8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\fcon.dll Handle ID: 0x9b8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\fdBth.dll Handle ID: 0x1b88 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\fdprint.dll Handle ID: 0x8c0 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\fdSSDP.dll Handle ID: 0x8c0 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\fdWSD.dll Handle ID: 0x8c0 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\feclient.dll Handle ID: 0x8c0 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\ffbroker.dll Handle ID: 0x8c0 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\fhcat.dll Handle ID: 0x1b88 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\fhcpl.dll Handle ID: 0x8c0 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\fhuxgraphics.dll Handle ID: 0x8c0 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\fidocredprov.dll Handle ID: 0x8c0 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\FileHistory.exe Handle ID: 0x8c0 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\FilterDS.dll Handle ID: 0x8c0 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\findstr.exe Handle ID: 0x8c0 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\fingerprintcredential.dll Handle ID: 0x8c0 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\FirewallAPI.dll Handle ID: 0x1b88 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\FlightSettings.dll Handle ID: 0x8c0 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\FluencyDS.dll Handle ID: 0x8c0 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\FntCache.dll Handle ID: 0x8c0 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\fontdrvhost.exe Handle ID: 0x8c0 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\fontext.dll Handle ID: 0x8c0 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\framedyn.dll Handle ID: 0x1b88 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\framedynos.dll Handle ID: 0x8c0 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\FrameServer.dll Handle ID: 0x8c0 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\FrameServerClient.dll Handle ID: 0x8c0 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\FrameServerCore.dll Handle ID: 0x8c0 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\FrameServerMonitor.dll Handle ID: 0x8c0 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\FrameServerMonitorClient.dll Handle ID: 0x8c0 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\FsIso.exe Handle ID: 0x8c0 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\fsquirt.exe Handle ID: 0x8c0 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\fsutil.exe Handle ID: 0x1b88 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\fundisc.dll Handle ID: 0x8c0 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\fveapi.dll Handle ID: 0x8c0 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\fveapibase.dll Handle ID: 0x8c0 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\fvecerts.dll Handle ID: 0x8c0 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\fveskybackup.dll Handle ID: 0x8c0 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\fveui.dll Handle ID: 0x1b88 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\fvewiz.dll Handle ID: 0x8c0 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\fwbase.dll Handle ID: 0x8c0 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\fwmdmcsp.dll Handle ID: 0x8c0 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\fwpolicyiomgr.dll Handle ID: 0x8c0 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\FwRemoteSvr.dll Handle ID: 0x8c0 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\GameChatTranscription.dll Handle ID: 0x8c0 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\GameInput.dll Handle ID: 0x8c0 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\GameInputSvc.exe Handle ID: 0x8c0 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\gamemode.dll Handle ID: 0x8c0 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\gdi32.dll Handle ID: 0x8c0 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\gdi32full.dll Handle ID: 0x8c0 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\GdiPlus.dll Handle ID: 0x8c0 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\generaltel.dll Handle ID: 0x8c0 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\genpix.dll Handle ID: 0x8c0 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\Geolocation.dll Handle ID: 0x8c0 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\globinputhost.dll Handle ID: 0x8c0 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\gmsaclient.dll Handle ID: 0x8c0 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\gpapi.dll Handle ID: 0x8c0 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\GPCSEWrapperCsp.dll Handle ID: 0x8c0 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\gpedit.dll Handle ID: 0x8c0 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\gpprefcl.dll Handle ID: 0x8c0 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\gpresult.exe Handle ID: 0x8c0 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\gpscript.dll Handle ID: 0x8c0 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\gpscript.exe Handle ID: 0x8c0 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\gpsvc.dll Handle ID: 0x8c0 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\gpupdate.exe Handle ID: 0x8c0 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\GraphicsCapture.dll Handle ID: 0x8c0 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\GraphicsPerfSvc.dll Handle ID: 0x8c0 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\hascsp.dll Handle ID: 0x8c0 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\HashtagDS.dll Handle ID: 0x8c0 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\HeatCore.dll Handle ID: 0x8c0 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\hgcpl.dll Handle ID: 0x8c0 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\hhctrl.ocx Handle ID: 0x8c0 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\hlink.dll Handle ID: 0x8c0 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\hmkd.dll Handle ID: 0x8c0 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\hotpatchutil.dll Handle ID: 0x8c0 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\hpatchmon.dll Handle ID: 0x8c0 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\hpatchmonTask.cmd Handle ID: 0x8c0 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\HrtfApo.dll Handle ID: 0x8c0 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\hspapi.dll Handle ID: 0x8c0 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\httpapi.dll Handle ID: 0x8c0 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:40 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\httpprxm.dll Handle ID: 0x8c0 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\HttpsDataSource.dll Handle ID: 0x8c0 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\hvax64.exe Handle ID: 0x8c0 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\hvhostsvc.dll Handle ID: 0x8c0 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\hvix64.exe Handle ID: 0x8c0 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\hvloader.dll Handle ID: 0x8c0 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\hvsievaluator.exe Handle ID: 0x8c0 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\HvsiManagementApi.dll Handle ID: 0x8c0 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\hwreqchk.dll Handle ID: 0x8c0 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\iasacct.dll Handle ID: 0x8c0 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\icsvc.dll Handle ID: 0x8c0 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\icsvcext.dll Handle ID: 0x1b88 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\icu.dll Handle ID: 0x8c0 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\IdCtrls.dll Handle ID: 0x8c0 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\IDStore.dll Handle ID: 0x8c0 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\ie4uinit.exe Handle ID: 0x1b88 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\ie4ushowIE.exe Handle ID: 0x1b88 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\ieapfltr.dll Handle ID: 0x1b88 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\ieframe.dll Handle ID: 0x8c0 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\iemigplugin.dll Handle ID: 0x8c0 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\iertutil.dll Handle ID: 0x1b88 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\IESettingSync.exe Handle ID: 0x8c0 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\ieui.dll Handle ID: 0x8c0 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\iexpress.exe Handle ID: 0x8c0 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\ifsutil.dll Handle ID: 0x8c0 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\IHDS.dll Handle ID: 0x8c0 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\ime_textinputhelpers.dll Handle ID: 0x8c0 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\imm32.dll Handle ID: 0x8c0 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\IndexedDbLegacy.dll Handle ID: 0x8c0 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\inetcomm.dll Handle ID: 0x8c0 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\inetcpl.cpl Handle ID: 0x8c0 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\inetpp.dll Handle ID: 0x8c0 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\inetppui.dll Handle ID: 0x8c0 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\INETRES.dll Handle ID: 0x8c0 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\input.dll Handle ID: 0x8c0 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\InputCloudStore.dll Handle ID: 0x8c0 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\InputHost.dll Handle ID: 0x8c0 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\InputInjectionBroker.dll Handle ID: 0x8c0 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\InputLocaleManager.dll Handle ID: 0x8c0 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\InputService.dll Handle ID: 0x8c0 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\InputSwitch.dll Handle ID: 0x8c0 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\InputSwitchToastHandler.exe Handle ID: 0x8c0 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\installmon.dll Handle ID: 0x8c0 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\InstallService.dll Handle ID: 0x8c0 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\InstallServiceTasks.dll Handle ID: 0x8c0 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\IntegratedServicesRegionPolicySet.json Handle ID: 0x8c0 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\intl.cpl Handle ID: 0x8c0 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\invagent.dll Handle ID: 0x8c0 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\InventorySvc.dll Handle ID: 0x8c0 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\ipconfig.exe Handle ID: 0x8c0 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\IPHLPAPI.DLL Handle ID: 0x8c0 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\ipnathlp.dll Handle ID: 0x8c0 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\IppCommon.dll Handle ID: 0x8c0 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\iprtprio.dll Handle ID: 0x8c0 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\iprtrmgr.dll Handle ID: 0x8c0 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\ipxlatcfg.dll Handle ID: 0x8c0 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\iscsicli.exe Handle ID: 0x8c0 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\iscsicpl.exe Handle ID: 0x8c0 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\ISM.dll Handle ID: 0x8c0 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\itss.dll Handle ID: 0x8c0 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\iuilp.dll Handle ID: 0x8c0 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\iumbase.dll Handle ID: 0x8c0 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\iumdll.dll Handle ID: 0x8c0 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\IumSdk.dll Handle ID: 0x8c0 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\joinproviderol.dll Handle ID: 0x8c0 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\JpMapControl.dll Handle ID: 0x8c0 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\jpndecoder.dll Handle ID: 0x8c0 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\jpninputrouter.dll Handle ID: 0x8c0 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\jpnranker.dll Handle ID: 0x8c0 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\JpnServiceDS.dll Handle ID: 0x8c0 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\jscript.dll Handle ID: 0x8c0 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\jscript9.dll Handle ID: 0x8c0 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\jscript9diag.dll Handle ID: 0x8c0 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\jscript9Legacy.dll Handle ID: 0x8c0 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\jsproxy.dll Handle ID: 0x8c0 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\kdcpw.dll Handle ID: 0x8c0 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\kdnet.dll Handle ID: 0x8c0 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\kerb3961.dll Handle ID: 0x8c0 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\kerberos.dll Handle ID: 0x8c0 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\kernel.appcore.dll Handle ID: 0x8c0 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\kernel32.dll Handle ID: 0x8c0 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\KernelBase.dll Handle ID: 0x8c0 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\KeyboardFilterSvc.dll Handle ID: 0x8c0 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\keyiso.dll Handle ID: 0x8c0 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\LampArray.dll Handle ID: 0x8c0 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\LanguageComponentsInstaller.dll Handle ID: 0x8c0 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\LanguageOverlayServer.dll Handle ID: 0x8c0 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\LanguageOverlayUtil.dll Handle ID: 0x8c0 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\LanguagePackDiskCleanup.dll Handle ID: 0x8c0 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\laps.dll Handle ID: 0x8c0 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\lapscsp.dll Handle ID: 0x8c0 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\LaunchTM.exe Handle ID: 0x8c0 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\LaunchWinApp.exe Handle ID: 0x8c0 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\LegacyNetUXHost.exe Handle ID: 0x8c0 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\lfsvc.dll Handle ID: 0x8c0 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\LicenseManager.dll Handle ID: 0x8c0 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\LicenseManagerApi.dll Handle ID: 0x8c0 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\LicenseManagerShellext.exe Handle ID: 0x8c0 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\LicenseManagerSvc.dll Handle ID: 0x8c0 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\LicensingCSP.dll Handle ID: 0x8c0 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\licensingdiag.exe Handle ID: 0x8c0 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\LicensingDiagSpp.dll Handle ID: 0x8c0 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\LicensingWinRT.dll Handle ID: 0x8c0 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\LiveCaptions.exe Handle ID: 0x8c0 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\lltdapi.dll Handle ID: 0x8c0 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\lltdsvc.dll Handle ID: 0x8c0 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\localkdcsvc.dll Handle ID: 0x8c0 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\localspl.dll Handle ID: 0x8c0 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\localui.dll Handle ID: 0x8c0 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\LocationApi.dll Handle ID: 0x8c0 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\LocationFramework.dll Handle ID: 0x8c0 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\LocationFrameworkInternalPS.dll Handle ID: 0x8c0 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\LocationFrameworkPS.dll Handle ID: 0x8c0 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\LocationWinPalMisc.dll Handle ID: 0x8c0 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\LockAppBroker.dll Handle ID: 0x8c0 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\LockAppHost.exe Handle ID: 0x8c0 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\LockController.dll Handle ID: 0x8c0 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\LockHostingFramework.dll Handle ID: 0x8c0 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\LockScreenData.dll Handle ID: 0x498 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\logoncli.dll Handle ID: 0x498 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\LogonController.dll Handle ID: 0x498 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\LogonUI.exe Handle ID: 0x498 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\lpasvc.dll Handle ID: 0x498 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\lpksetup.exe Handle ID: 0x498 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\lpremove.exe Handle ID: 0x498 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\lsass.exe Handle ID: 0x498 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\lsm.dll Handle ID: 0x498 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\luiapi.dll Handle ID: 0x498 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\Magnify.exe Handle ID: 0x498 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\manage-bde.exe Handle ID: 0x498 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\mapi32.dll Handle ID: 0x498 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\mapistub.dll Handle ID: 0x498 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\MapRouter.dll Handle ID: 0x498 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\mavinject.exe Handle ID: 0x498 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\MbaeApi.dll Handle ID: 0x498 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\MbaeApiPublic.dll Handle ID: 0x498 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\MBMediaManager.dll Handle ID: 0x498 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\MBR2GPT.EXE Handle ID: 0x498 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\mbsmsapi.dll Handle ID: 0x498 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\MCCSEngineShared.dll Handle ID: 0x498 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\mcmsvc.dll Handle ID: 0x498 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\McpManagementService.dll Handle ID: 0x498 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\MCRecvSrc.dll Handle ID: 0x498 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\MDEServer.exe Handle ID: 0x498 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\MDMAgent.exe Handle ID: 0x498 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\MDMAppInstaller.exe Handle ID: 0x498 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\MdmCommon.dll Handle ID: 0x498 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\MdmDiagnostics.dll Handle ID: 0x498 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\mdmmigrator.dll Handle ID: 0x498 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\mdmregistration.dll Handle ID: 0x498 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\MdSched.exe Handle ID: 0x498 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\MemoryDiagnostic.dll Handle ID: 0x498 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\mf.dll Handle ID: 0x498 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\mf3216.dll Handle ID: 0x498 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\mfasfsrcsnk.dll Handle ID: 0x498 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\mfaudiocnv.dll Handle ID: 0x498 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\MFCaptureEngine.dll Handle ID: 0x498 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\mfcore.dll Handle ID: 0x498 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\mfh264enc.dll Handle ID: 0x498 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\mfksproxy.dll Handle ID: 0x498 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\MFMediaEngine.dll Handle ID: 0x498 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\mfmjpegdec.dll Handle ID: 0x498 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\mfmkvsrcsnk.dll Handle ID: 0x498 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\mfmp4srcsnk.dll Handle ID: 0x498 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\mfmpeg2srcsnk.dll Handle ID: 0x498 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\mfplat.dll Handle ID: 0x498 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\MFPlay.dll Handle ID: 0x498 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\mfpmp.exe Handle ID: 0x498 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\mfreadwrite.dll Handle ID: 0x498 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\mfsensorgroup.dll Handle ID: 0x498 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\mfsrcsnk.dll Handle ID: 0x498 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\mfsvr.dll Handle ID: 0x498 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\mgmtrefreshcredprov.dll Handle ID: 0x498 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\Microsoft-Windows-Internal-Shell-NearShareExperience.dll Handle ID: 0x498 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\microsoft-windows-kernel-power-events.dll Handle ID: 0x498 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\microsoft-windows-system-events.dll Handle ID: 0x498 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\Microsoft.Bluetooth.Audio.dll Handle ID: 0x498 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\Microsoft.Bluetooth.Proxy.dll Handle ID: 0x498 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\Microsoft.Bluetooth.Service.dll Handle ID: 0x498 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\Microsoft.Bluetooth.UserService.dll Handle ID: 0x498 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\Microsoft.Data.UsageAndQualityInsights.dll Handle ID: 0x498 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\Microsoft.Data.UsageAndQualityInsights.MaintenanceTask.exe Handle ID: 0x498 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\Microsoft.Graphics.Display.DisplayEnhancementService.dll Handle ID: 0x498 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\Microsoft.Internal.FrameworkUdk.System.dll Handle ID: 0x498 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\Microsoft.LocalUserImageProvider.dll Handle ID: 0x498 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\Microsoft.Uev.AppAgent.dll Handle ID: 0x498 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\Microsoft.Uev.CommonBridge.dll Handle ID: 0x498 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\Microsoft.Uev.ModernAppAgent.dll Handle ID: 0x498 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\Microsoft.Uev.Office2013CustomActions.dll Handle ID: 0x498 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\Microsoft.Uev.PrinterCustomActions.dll Handle ID: 0x738 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\MicrosoftAccount.TokenProvider.Core.dll Handle ID: 0x738 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\MicrosoftAccountCloudAP.dll Handle ID: 0x738 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\MicrosoftAccountExtension.dll Handle ID: 0x738 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\MicrosoftAccountTokenProvider.dll Handle ID: 0x738 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\MicrosoftAccountWAMExtension.dll Handle ID: 0x738 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\Midi2.BS2UMPTransform.dll Handle ID: 0x738 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\Midi2.DiagnosticsTransport.dll Handle ID: 0x738 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\Midi2.KSAggregateTransport.dll Handle ID: 0x738 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\Midi2.KSTransport.dll Handle ID: 0x738 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\Midi2.LoopbackMidiTransport.dll Handle ID: 0x738 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\Midi2.MidiSrvTransport.dll Handle ID: 0x738 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\Midi2.SchedulerTransform.dll Handle ID: 0x738 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\Midi2.UMP2BSTransform.dll Handle ID: 0x738 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\Midi2.UmpProtocolDownscalerTransform.dll Handle ID: 0x738 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\Midi2.VirtualMidiTransport.dll Handle ID: 0x738 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\MidiSrv.exe Handle ID: 0x738 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\miguiresource.dll Handle ID: 0x738 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\mimefilt.dll Handle ID: 0x738 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\MiracastReceiver.dll Handle ID: 0x738 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\MiracastReceiverExt.dll Handle ID: 0x738 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\mispace.dll Handle ID: 0x738 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\MissionControlAggregator.dll Handle ID: 0x738 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\MitigationClient.dll Handle ID: 0x738 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\MitigationConfiguration.dll Handle ID: 0x738 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\mlang.dll Handle ID: 0x738 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\mmc.exe Handle ID: 0x738 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\mmcndmgr.dll Handle ID: 0x738 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\MMDevAPI.dll Handle ID: 0x738 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\mmsys.cpl Handle ID: 0x738 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\modernexecserver.dll Handle ID: 0x738 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\ModernPrintConfigHelper.dll Handle ID: 0x738 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\MosStorage.dll Handle ID: 0x738 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\MP4SDECD.DLL Handle ID: 0x738 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\mpr.dll Handle ID: 0x738 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\mprapi.dll Handle ID: 0x738 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\mprddm.dll Handle ID: 0x738 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\mprdim.dll Handle ID: 0x738 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\MPSSVC.dll Handle ID: 0x738 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\MptfGenericService.exe Handle ID: 0x738 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\MrmCoreR.dll Handle ID: 0x738 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\MrmDeploy.dll Handle ID: 0x738 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\MrmIndexer.dll Handle ID: 0x738 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\msacm32.dll Handle ID: 0x738 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\msasn1.dll Handle ID: 0x738 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\MSAudDecMFT.dll Handle ID: 0x738 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\msaudite.dll Handle ID: 0x738 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\mscandui.dll Handle ID: 0x738 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\mscms.dll Handle ID: 0x738 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\msconfig.exe Handle ID: 0x738 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\msctf.dll Handle ID: 0x738 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\MsCtfMonitor.dll Handle ID: 0x738 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\msctfui.dll Handle ID: 0x738 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\msctfuimanager.dll Handle ID: 0x738 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\msdt.exe Handle ID: 0x738 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\msdtc.exe Handle ID: 0x738 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\msdtckrm.dll Handle ID: 0x738 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\msdtclog.dll Handle ID: 0x738 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\msdtcprx.dll Handle ID: 0x738 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\msdtctm.dll Handle ID: 0x738 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\msdtcuiu.dll Handle ID: 0x738 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\MSFlacDecoder.dll Handle ID: 0x738 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\MSFlacEncoder.dll Handle ID: 0x738 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\msftedit.dll Handle ID: 0x738 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\mshtml.dll Handle ID: 0x738 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\msi.dll Handle ID: 0x738 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\msieftp.dll Handle ID: 0x738 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\msihnd.dll Handle ID: 0x738 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\msimsg.dll Handle ID: 0x738 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\msinfo32.exe Handle ID: 0x738 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\msisip.dll Handle ID: 0x738 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\msIso.dll Handle ID: 0x738 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\mskeyprotcli.dll Handle ID: 0x738 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\mskeyprotect.dll Handle ID: 0x738 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\msmpeg2adec.dll Handle ID: 0x738 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\MSMPEG2ENC.DLL Handle ID: 0x738 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\msmpeg2vdec.dll Handle ID: 0x738 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\msobjs.dll Handle ID: 0x738 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\msoert2.dll Handle ID: 0x738 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\MSPhotography.dll Handle ID: 0x738 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\msra.exe Handle ID: 0x738 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\msscntrs.dll Handle ID: 0x738 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\mssign32.dll Handle ID: 0x738 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\mssitlb.dll Handle ID: 0x738 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\MsSpellCheckingFacility.dll Handle ID: 0x738 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\MsSpellCheckingHost.exe Handle ID: 0x738 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\mssph.dll Handle ID: 0x738 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\mssprxy.dll Handle ID: 0x738 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\mssrch.dll Handle ID: 0x738 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\mssvp.dll Handle ID: 0x738 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\mstsc.exe Handle ID: 0x738 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\mstscax.dll Handle ID: 0x738 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\msutb.dll Handle ID: 0x738 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\msv1_0.dll Handle ID: 0x738 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\msvcp110_win.dll Handle ID: 0x738 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\msvcp_win.dll Handle ID: 0x738 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\msvcrt.dll Handle ID: 0x738 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\msvproc.dll Handle ID: 0x738 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\MSWB7.dll Handle ID: 0x738 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\mswsock.dll Handle ID: 0x738 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\msxml3.dll Handle ID: 0x738 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\msxml6.dll Handle ID: 0x738 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\MtcModel.dll Handle ID: 0x738 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\MTF.dll Handle ID: 0x738 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\MTFAppServiceDS.dll Handle ID: 0x738 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\MtfDecoder.dll Handle ID: 0x738 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\MTFServer.dll Handle ID: 0x738 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\mtxclu.dll Handle ID: 0x738 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\mtxoci.dll Handle ID: 0x738 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\MuiUnattend.exe Handle ID: 0x738 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\museuxdocked.dll Handle ID: 0x738 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\MusUpdateHandlers.dll Handle ID: 0x738 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\MusUpdateHandlers1.dll Handle ID: 0x738 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\mycomput.dll Handle ID: 0x738 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\NAPCRYPT.DLL Handle ID: 0x828 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\Narrator.exe Handle ID: 0x738 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\NarratorControlTemplates.xml Handle ID: 0x738 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\NaturalAuth.dll Handle ID: 0x738 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\NaturalLanguage6.dll Handle ID: 0x738 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\navshutdown.dll Handle ID: 0x738 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\NcdAutoSetup.dll Handle ID: 0x738 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\ncobjapi.dll Handle ID: 0x738 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\ncrypt.dll Handle ID: 0x738 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\ncryptprov.dll Handle ID: 0x738 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\ncsi.dll Handle ID: 0x738 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\ndfapi.dll Handle ID: 0x738 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\nduprov.dll Handle ID: 0x738 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\negoexts.dll Handle ID: 0x738 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\net.exe Handle ID: 0x738 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\net1.exe Handle ID: 0x738 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\netapi32.dll Handle ID: 0x738 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\netcfg.exe Handle ID: 0x738 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\netid.dll Handle ID: 0x738 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\netiohlp.dll Handle ID: 0x738 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\netlogon.dll Handle ID: 0x738 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\netman.dll Handle ID: 0x738 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\netplwiz.dll Handle ID: 0x738 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\netprofm.dll Handle ID: 0x738 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\netprofmsvc.dll Handle ID: 0x738 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\NetSetupApi.dll Handle ID: 0x738 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\NetSetupEngine.dll Handle ID: 0x738 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\NetSetupSvc.dll Handle ID: 0x738 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\netsh.exe Handle ID: 0x738 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\netshell.dll Handle ID: 0x738 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\nettrace.dll Handle ID: 0x1b88 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\nettracehelper.dll Handle ID: 0x738 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\NetworkBindingEngineMigPlugin.dll Handle ID: 0x738 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\NetworkDesktopSettings.dll Handle ID: 0x1b88 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\NetworkIcon.dll Handle ID: 0x738 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\NetworkMobileSettings.dll Handle ID: 0x738 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\NetworkUXBroker.dll Handle ID: 0x738 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\newdev.dll Handle ID: 0x738 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\ngccredprov.dll Handle ID: 0x738 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\NgcCtnr.dll Handle ID: 0x738 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\NgcCtnrSvc.dll Handle ID: 0x738 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\NgcIso.exe Handle ID: 0x738 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\NgcIsoCtnr.dll Handle ID: 0x738 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\ngckeyenum.dll Handle ID: 0x1b88 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\ngcksp.dll Handle ID: 0x1b88 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\ngcpopkeysrv.dll Handle ID: 0x1b88 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\NgcProCsp.dll Handle ID: 0xae8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\ngcrecovery.dll Handle ID: 0x1b88 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\ngcsvc.dll Handle ID: 0x1b88 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\ngctasks.dll Handle ID: 0x1b88 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\ngcutils.dll Handle ID: 0x1b88 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\ninput.dll Handle ID: 0x1b88 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\nlaapi.dll Handle ID: 0x754 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\nlansp_c.dll Handle ID: 0x754 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\nlhtml.dll Handle ID: 0xae8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\nlmproxy.dll Handle ID: 0xae8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\nlmsprep.dll Handle ID: 0x754 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\nltest.exe Handle ID: 0x754 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\NmaDirect.dll Handle ID: 0x754 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\noise.dll Handle ID: 0x754 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\nonarpinv.dll Handle ID: 0x754 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\NotificationController.dll Handle ID: 0x754 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\NotificationControllerPS.dll Handle ID: 0x754 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\NotificationIntelligencePlatform.dll Handle ID: 0x754 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\NPSM.dll Handle ID: 0x754 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\NPSMDesktopProvider.dll Handle ID: 0x754 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\nshdnsclient.dll Handle ID: 0xae8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\nshwfp.dll Handle ID: 0x754 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\nslookup.exe Handle ID: 0x754 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\ntfsres.dll Handle ID: 0x754 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\ntlanman.dll Handle ID: 0x754 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\ntmarta.dll Handle ID: 0x754 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\ntshrui.dll Handle ID: 0x754 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\ocsetapi.dll Handle ID: 0x498 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\odbc32.dll Handle ID: 0x498 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\odbcad32.exe Handle ID: 0x498 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\offfilt.dll Handle ID: 0x498 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\offlinesam.dll Handle ID: 0x498 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\offreg.dll Handle ID: 0x498 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\ole32.dll Handle ID: 0x498 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\oleacc.dll Handle ID: 0xae8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\oleaut32.dll Handle ID: 0xae8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\oleprn.dll Handle ID: 0xae8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\omadmapi.dll Handle ID: 0xae8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\omadmclient.exe Handle ID: 0xae8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\omadmprc.exe Handle ID: 0xae8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\OnDemandConnRouteHelper.dll Handle ID: 0xae8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\OneBackupHandler.dll Handle ID: 0xae8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\OneCoreCommonProxyStub.dll Handle ID: 0xae8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\OneCoreUAPCommonProxyStub.dll Handle ID: 0xae8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\onex.dll Handle ID: 0xae8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:41 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\OobeWv2Host.dll Handle ID: 0xae8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\OpcServices.dll Handle ID: 0xae8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\opengl32.dll Handle ID: 0xae8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\OpenWith.exe Handle ID: 0xae8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\osk.exe Handle ID: 0xae8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\pairtool.exe Handle ID: 0xae8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\PasswordEnrollmentManager.dll Handle ID: 0xae8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\PasswordOnWakeSettingFlyout.exe Handle ID: 0xae8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\PATHPING.EXE Handle ID: 0xae8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\pcacli.dll Handle ID: 0xae8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\pcadm.dll Handle ID: 0xae8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\pcalua.exe Handle ID: 0xae8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\pcasvc.dll Handle ID: 0xae8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\pcaui.dll Handle ID: 0xae8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\pcaui.exe Handle ID: 0xae8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\PCPKsp.dll Handle ID: 0xae8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\pcrpf.dll Handle ID: 0xae8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\pcwutl.dll Handle ID: 0xae8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\pdh.dll Handle ID: 0xae8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\pdhui.dll Handle ID: 0xae8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\PeerDistCacheProvider.dll Handle ID: 0xae8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\PeerDistCleaner.dll Handle ID: 0xae8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\PeerDistHttpTrans.dll Handle ID: 0xae8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\PeerDistSh.dll Handle ID: 0xae8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\PeerDistSvc.dll Handle ID: 0xae8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\PeerDistWSDDiscoProv.dll Handle ID: 0x8b8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\PenService.dll Handle ID: 0xae8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\PeopleAPIs.dll Handle ID: 0xae8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\PeopleBand.dll Handle ID: 0xae8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\PerceptionSimulationManager.dll Handle ID: 0xae8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\perfdisk.dll Handle ID: 0x8b8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\perfmon.exe Handle ID: 0x8b8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\perfnet.dll Handle ID: 0xae8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\PerformanceTraceHandler.dll Handle ID: 0xae8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\perfos.dll Handle ID: 0xae8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\perfproc.dll Handle ID: 0xae8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\PersonalizationCSP.dll Handle ID: 0xae8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\PhoneOm.dll Handle ID: 0xae8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\PhonePlatformAbstraction.dll Handle ID: 0xae8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\PhoneProviders.dll Handle ID: 0xae8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\PhoneService.dll Handle ID: 0xae8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\Phoneutil.dll Handle ID: 0xae8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\PhotoMetadataHandler.dll Handle ID: 0xae8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\PickerHost.exe Handle ID: 0xae8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\PickerPlatform.dll Handle ID: 0xae8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\pidgenx.dll Handle ID: 0xae8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\PimIndexMaintenance.dll Handle ID: 0xae8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\Pimstore.dll Handle ID: 0xae8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\PinEnrollmentBroker.exe Handle ID: 0xae8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\PinEnrollmentHelper.dll Handle ID: 0x8b8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\pkeyhelper.dll Handle ID: 0xae8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\PkgMgr.exe Handle ID: 0xae8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\PktMon.exe Handle ID: 0xae8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\PktMonApi.dll Handle ID: 0xae8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\pku2u.dll Handle ID: 0xae8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\pla.dll Handle ID: 0xae8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\PlaySndSrv.dll Handle ID: 0xae8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\PlayToDevice.dll Handle ID: 0xae8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\PlayToReceiver.dll Handle ID: 0xae8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\plutonapi.dll Handle ID: 0xae8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\plutonksp.dll Handle ID: 0xae8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\plutontasks.dll Handle ID: 0xae8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\pmcsnap.dll Handle ID: 0xae8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\pnpdiag.dll Handle ID: 0xae8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\pnppolicy.dll Handle ID: 0xae8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\pnpui.dll Handle ID: 0xae8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\pnputil.exe Handle ID: 0xae8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\PNPXAssoc.dll Handle ID: 0xae8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\policymanager.dll Handle ID: 0xae8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\policymanagerprecheck.dll Handle ID: 0xae8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\PortableDeviceSyncProvider.dll Handle ID: 0x8b8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\PortableDeviceWiaCompat.dll Handle ID: 0xae8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\powercfg.cpl Handle ID: 0xae8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\powercfg.exe Handle ID: 0xae8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\PowerGridForecastTask.dll Handle ID: 0x8b8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\ppcsnap.dll Handle ID: 0xae8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\prauthproviders.dll Handle ID: 0xae8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\Print.PrintSupport.Source.dll Handle ID: 0xae8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\Print.Workflow.Source.dll Handle ID: 0xae8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\PrintBrmUi.exe Handle ID: 0xae8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\PrintDeviceConfigurationService.dll Handle ID: 0xae8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\printfilterpipelineprxy.dll Handle ID: 0x8b8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\printfilterpipelinesvc.exe Handle ID: 0xae8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\PrintIsolationProxy.dll Handle ID: 0xae8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\PrintRenderAPIHost.DLL Handle ID: 0x8b8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\PrintScanBrokerService.dll Handle ID: 0xae8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\printui.dll Handle ID: 0xae8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\PrintWorkflowService.dll Handle ID: 0xae8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\PrintWSDAHost.dll Handle ID: 0xae8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\prnfldr.dll Handle ID: 0xae8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\prnntfy.dll Handle ID: 0xae8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\prntvpt.dll Handle ID: 0xae8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\ProductEnumerator.dll Handle ID: 0xae8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\profapi.dll Handle ID: 0xae8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\profext.dll Handle ID: 0xae8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\profsvc.dll Handle ID: 0xae8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\propsys.dll Handle ID: 0xae8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\provcore.dll Handle ID: 0xae8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\provengine.dll Handle ID: 0xae8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\provhandlers.dll Handle ID: 0xae8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\provisioningcsp.dll Handle ID: 0xae8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\ProvisioningHandlers.dll Handle ID: 0xae8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\provmigrate.dll Handle ID: 0xae8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\provops.dll Handle ID: 0xae8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\provplatformdesktop.dll Handle ID: 0xae8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\ProvPluginEng.dll Handle ID: 0xae8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\ProximityService.dll Handle ID: 0xae8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\ProximityServicePal.dll Handle ID: 0xae8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\prxyqry.dll Handle ID: 0xae8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\PsmServiceExtHost.dll Handle ID: 0xae8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\psmsrv.dll Handle ID: 0xae8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\psr.exe Handle ID: 0xae8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\ptpprov.dll Handle ID: 0x8b8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\puiapi.dll Handle ID: 0xae8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\PushToInstall.dll Handle ID: 0xae8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\qdvd.dll Handle ID: 0xae8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\qmgr.dll Handle ID: 0xae8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\quartz.dll Handle ID: 0xae8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\Query.dll Handle ID: 0xae8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\QuickActionsDataModel.dll Handle ID: 0x498 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\QuietHours.dll Handle ID: 0x498 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\qwave.dll Handle ID: 0x498 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\RandomAccessStreamDataSource.dll Handle ID: 0x498 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\rasapi32.dll Handle ID: 0x498 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\raschap.dll Handle ID: 0x498 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\raschapext.dll Handle ID: 0x498 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\rascustom.dll Handle ID: 0x498 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\rasdial.exe Handle ID: 0x780 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\rasdlg.dll Handle ID: 0x8b8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\rasgcw.dll Handle ID: 0x8b8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\rasman.dll Handle ID: 0x780 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\rasmans.dll Handle ID: 0x780 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\RasMediaManager.dll Handle ID: 0x780 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\rasmontr.dll Handle ID: 0x780 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\rasphone.exe Handle ID: 0x780 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\rasplap.dll Handle ID: 0x780 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\rasppp.dll Handle ID: 0x780 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\rastls.dll Handle ID: 0x780 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\rastlsext.dll Handle ID: 0x780 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\rdbui.dll Handle ID: 0x780 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\RdpAvenc.dll Handle ID: 0x780 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\rdpbase.dll Handle ID: 0x780 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\rdpclip.exe Handle ID: 0x780 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\rdpcorets.dll Handle ID: 0x780 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\RdpDwmEncoder.dll Handle ID: 0x780 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\rdpinit.exe Handle ID: 0x780 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\rdpinput.exe Handle ID: 0x780 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\rdplite.dll Handle ID: 0x780 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\RdpSaUacHelper.exe Handle ID: 0x780 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\rdpserverbase.dll Handle ID: 0x780 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\rdpsharercom.dll Handle ID: 0x780 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\rdpshell.exe Handle ID: 0x780 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\RdpShellExt.dll Handle ID: 0x780 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\RdpShellLoader.dll Handle ID: 0x780 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\rdpviewerax.dll Handle ID: 0x780 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\rdrleakdiag.exe Handle ID: 0x780 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\rdsdwmdr.dll Handle ID: 0x780 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\rdvvmtransport.dll Handle ID: 0x780 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\RDXService.dll Handle ID: 0x780 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\RDXTaskFactory.dll Handle ID: 0x780 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\ReAgent.dll Handle ID: 0x780 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\ReAgentc.exe Handle ID: 0x780 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\RecoveryDrive.exe Handle ID: 0x780 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\ReFsDedupSvc.exe Handle ID: 0x780 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\refsutil.exe Handle ID: 0x780 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\regedt32.exe Handle ID: 0x1b9c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\regsvc.dll Handle ID: 0x780 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\regsvr32.exe Handle ID: 0x780 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\ReInfo.dll Handle ID: 0x780 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\RelPost.exe Handle ID: 0x780 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\RemoteRemediationCSP.dll Handle ID: 0x780 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\ReportingCSP.dll Handle ID: 0x780 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\RESAMPLEDMO.DLL Handle ID: 0x780 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\ResetEngine.dll Handle ID: 0x780 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\ResetEngine.exe Handle ID: 0x780 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\ResetEngOnline.dll Handle ID: 0x780 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\resmon.exe Handle ID: 0x780 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\resutils.dll Handle ID: 0x780 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\rgnupdt.exe Handle ID: 0x780 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\RjvMDMConfig.dll Handle ID: 0x780 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\rmclient.dll Handle ID: 0x1b9c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\Robocopy.exe Handle ID: 0x780 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\rometadata.dll Handle ID: 0x780 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\RpcEpMap.dll Handle ID: 0x780 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\rpcnsh.dll Handle ID: 0x780 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\rpcrt4.dll Handle ID: 0x780 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\RpcRtRemote.dll Handle ID: 0x780 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\rpcss.dll Handle ID: 0x780 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\rsaenh.dll Handle ID: 0x780 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\RstrtMgr.dll Handle ID: 0x780 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\rstrui.exe Handle ID: 0x780 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\rtffilt.dll Handle ID: 0x780 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\rtm.dll Handle ID: 0x780 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\RTWorkQ.dll Handle ID: 0x780 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\RuleBasedDS.dll Handle ID: 0x780 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\rundll32.exe Handle ID: 0x780 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\runonce.exe Handle ID: 0x780 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\RuntimeBroker.exe Handle ID: 0x780 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\samcli.dll Handle ID: 0x780 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\samlib.dll Handle ID: 0x780 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\samsrv.dll Handle ID: 0x780 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\SCardBi.dll Handle ID: 0x780 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\SCardSvr.dll Handle ID: 0x780 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\scavengeui.dll Handle ID: 0x780 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\scecli.dll Handle ID: 0x780 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\scesrv.dll Handle ID: 0x780 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\schannel.dll Handle ID: 0x780 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\schedsvc.dll Handle ID: 0x780 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\schtasks.exe Handle ID: 0x780 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\scksp.dll Handle ID: 0x780 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\scrptadm.dll Handle ID: 0x780 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\scrrun.dll Handle ID: 0x780 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:42 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\sdbinst.exe Handle ID: 0x780 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\sdchange.exe Handle ID: 0x780 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\SDDS.dll Handle ID: 0x780 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\sdengin2.dll Handle ID: 0x780 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\SDFHost.dll Handle ID: 0x780 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\sdiageng.dll Handle ID: 0x780 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\sdrsvc.dll Handle ID: 0x780 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\Search.ProtocolHandler.MAPI2.dll Handle ID: 0x780 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\SearchFilterHost.exe Handle ID: 0x780 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\SearchFolder.dll Handle ID: 0x780 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\SearchIndexer.exe Handle ID: 0x780 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\SearchIndexerCore.dll Handle ID: 0x780 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\SearchProtocolHost.exe Handle ID: 0x780 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\SecConfig.efi Handle ID: 0x780 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\SecEdit.exe Handle ID: 0x780 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\sechost.dll Handle ID: 0x780 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\SecureAssessmentHandlers.dll Handle ID: 0x780 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\SecureTimeAggregator.dll Handle ID: 0x780 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\SecurityHealthAgent.dll Handle ID: 0x780 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\SecurityHealthCore.dll Handle ID: 0x780 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\SecurityHealthHost.exe Handle ID: 0x780 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\SecurityHealthService.exe Handle ID: 0x780 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\SecurityHealthSsoUdk.dll Handle ID: 0x780 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\SecurityHealthUdk.dll Handle ID: 0x780 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\SEMgrSvc.dll Handle ID: 0x780 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\sendmail.dll Handle ID: 0x780 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\SenseSubAuth.dll Handle ID: 0x780 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\SensorRuntimeBroker.exe Handle ID: 0x780 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\SensorsApi.dll Handle ID: 0x780 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\SensorService.dll Handle ID: 0x780 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\SensorsNativeApi.dll Handle ID: 0x780 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\SensorsNativeApi.V2.dll Handle ID: 0x780 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\SensorsUtilsV2.dll Handle ID: 0x780 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\services.exe Handle ID: 0x780 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\ServicingCommon.dll Handle ID: 0x780 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\ServicingUAPI.dll Handle ID: 0x780 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\SessEnv.dll Handle ID: 0x780 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\sethc.exe Handle ID: 0x780 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\SetNetworkLocation.dll Handle ID: 0x780 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\SettingsConfigTask.dll Handle ID: 0x780 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\SettingsEnvironment.Desktop.dll Handle ID: 0x780 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\SettingsExtensibilityHandlers.dll Handle ID: 0x780 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\SettingsHandlers_A9.dll Handle ID: 0x780 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\SettingsHandlers_Accessibility.dll Handle ID: 0x780 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\SettingsHandlers_AdvertisingId.dll Handle ID: 0x780 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\SettingsHandlers_AppControl.dll Handle ID: 0x780 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\SettingsHandlers_AppExecutionAlias.dll Handle ID: 0x780 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\SettingsHandlers_AssignedAccess.dll Handle ID: 0x780 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\SettingsHandlers_Authentication.dll Handle ID: 0x780 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\SettingsHandlers_BackgroundApps.dll Handle ID: 0x780 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\SettingsHandlers_Backup.dll Handle ID: 0x780 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\SettingsHandlers_BatteryUsage.dll Handle ID: 0x1b9c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\SettingsHandlers_Camera.dll Handle ID: 0x780 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\SettingsHandlers_CapabilityAccess.dll Handle ID: 0x780 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\SettingsHandlers_Clipboard.dll Handle ID: 0x780 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\SettingsHandlers_ClosedCaptioning.dll Handle ID: 0x780 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\SettingsHandlers_CloudPC.dll Handle ID: 0x780 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\SettingsHandlers_ContentDeliveryManager.dll Handle ID: 0x780 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\SettingsHandlers_Copilot.dll Handle ID: 0x780 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\SettingsHandlers_Cortana.dll Handle ID: 0x780 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\SettingsHandlers_DesktopDisplay.dll Handle ID: 0x780 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\SettingsHandlers_DesktopTaskbar.dll Handle ID: 0x780 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\SettingsHandlers_Devices.dll Handle ID: 0x780 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\SettingsHandlers_Display.dll Handle ID: 0x780 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\SettingsHandlers_Flights.dll Handle ID: 0x780 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\SettingsHandlers_Fonts.dll Handle ID: 0x780 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\SettingsHandlers_ForceSync.dll Handle ID: 0x780 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\SettingsHandlers_Gaming.dll Handle ID: 0x780 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\SettingsHandlers_Geolocation.dll Handle ID: 0x780 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\SettingsHandlers_Gpu.dll Handle ID: 0x780 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\SettingsHandlers_HumanPresence.dll Handle ID: 0x780 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\SettingsHandlers_IME.dll Handle ID: 0x780 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\SettingsHandlers_InkingTypingPrivacy.dll Handle ID: 0x780 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\SettingsHandlers_InputPersonalization.dll Handle ID: 0x780 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\SettingsHandlers_InstalledUpdates.dll Handle ID: 0x780 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\SettingsHandlers_Keyboard.dll Handle ID: 0x780 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\SettingsHandlers_Language.dll Handle ID: 0x780 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\SettingsHandlers_Lighting.dll Handle ID: 0x780 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\SettingsHandlers_ManagePhone.dll Handle ID: 0x780 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\SettingsHandlers_Maps.dll Handle ID: 0x780 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\SettingsHandlers_Mouse.dll Handle ID: 0x780 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\SettingsHandlers_Notifications.dll Handle ID: 0x780 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\SettingsHandlers_nt.dll Handle ID: 0x780 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\SettingsHandlers_OneCore_BatterySaver.dll Handle ID: 0x780 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\SettingsHandlers_OneCore_PowerAndSleep.dll Handle ID: 0x780 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\SettingsHandlers_OneDriveBackup.dll Handle ID: 0x780 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\SettingsHandlers_OptionalFeatures.dll Handle ID: 0x780 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\SettingsHandlers_PCDisplay.dll Handle ID: 0x780 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\SettingsHandlers_PCDisplayRemote.dll Handle ID: 0x780 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\SettingsHandlers_Pen.dll Handle ID: 0x780 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\SettingsHandlers_Region.dll Handle ID: 0x780 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\SettingsHandlers_Resume.dll Handle ID: 0x780 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\SettingsHandlers_SharedExperiences_Rome.dll Handle ID: 0x780 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\SettingsHandlers_SIUF.dll Handle ID: 0x780 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\SettingsHandlers_SpeechPrivacy.dll Handle ID: 0x780 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\SettingsHandlers_Startup.dll Handle ID: 0x780 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\SettingsHandlers_Storage.dll Handle ID: 0x780 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\SettingsHandlers_StorageSense.dll Handle ID: 0x780 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\SettingsHandlers_Touch.dll Handle ID: 0x780 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\SettingsHandlers_Troubleshoot.dll Handle ID: 0x780 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\SettingsHandlers_User.dll Handle ID: 0x780 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\SettingsHandlers_UserAccount.dll Handle ID: 0x780 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\SettingsHandlers_UserExperience.dll Handle ID: 0x780 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\SettingsHandlers_UserIntent.dll Handle ID: 0x780 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\SettingsHandlers_WorkAccess.dll Handle ID: 0x780 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\setupapi.dll Handle ID: 0x780 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\setupugc.exe Handle ID: 0x780 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\SFAPE.dll Handle ID: 0x780 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\SFAPM.dll Handle ID: 0x780 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\sfc.exe Handle ID: 0x780 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\SfSEnclave.dll Handle ID: 0x780 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\ShareHost.dll Handle ID: 0x780 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\ShareTargets.dll Handle ID: 0x780 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\SHCore.dll Handle ID: 0x780 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\shdocvw.dll Handle ID: 0x780 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\shell32.dll Handle ID: 0x780 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\ShellAppRuntime.exe Handle ID: 0x780 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\ShellCommonCommonProxyStub.dll Handle ID: 0x780 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\ShellConfigTask.dll Handle ID: 0x780 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\ShellHost.exe Handle ID: 0x780 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\shlwapi.dll Handle ID: 0x780 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\shsetup.dll Handle ID: 0x780 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\shsvcs.dll Handle ID: 0x780 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\shutdown.exe Handle ID: 0x780 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\shutdownux.dll Handle ID: 0x780 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\shwebsvc.dll Handle ID: 0x780 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\SIHClient.exe Handle ID: 0x780 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\sihost.exe Handle ID: 0x780 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\SimAuth.dll Handle ID: 0x780 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\SimCfg.dll Handle ID: 0x780 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\slui.exe Handle ID: 0x780 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\SmartActionPlatform.dll Handle ID: 0x780 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\SmartcardCredentialProvider.dll Handle ID: 0x780 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\smartscreen.exe Handle ID: 0x780 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\smbwmiv2.dll Handle ID: 0x780 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\smphost.dll Handle ID: 0x780 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\SmsRouterSvc.dll Handle ID: 0x780 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\SndVolSSO.dll Handle ID: 0x780 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\softkbd.dll Handle ID: 0x780 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\SpaceAgent.exe Handle ID: 0x780 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\SpaceControl.dll Handle ID: 0x780 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\spaceman.exe Handle ID: 0x780 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\spaceutil.exe Handle ID: 0x780 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\SpatialAudioLicenseSrv.exe Handle ID: 0x780 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\spoolss.dll Handle ID: 0x780 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\spoolsv.exe Handle ID: 0x780 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\spoolsvworker.exe Handle ID: 0x780 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\sppc.dll Handle ID: 0x780 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\sppcext.dll Handle ID: 0x780 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\sppcomapi.dll Handle ID: 0x780 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\SppExtComObj.Exe Handle ID: 0x780 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\sppnp.dll Handle ID: 0x780 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\sppobjs.dll Handle ID: 0x780 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\sppsvc.exe Handle ID: 0x780 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\sppwinob.dll Handle ID: 0x780 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\spwizeng.dll Handle ID: 0x780 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\sqmapi.dll Handle ID: 0x780 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\srchadmin.dll Handle ID: 0x780 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\SRH.dll Handle ID: 0x780 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\srms.dat Handle ID: 0x780 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\srpapi.dll Handle ID: 0x780 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\srumsvc.dll Handle ID: 0x780 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\srvsvc.dll Handle ID: 0x780 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\srwmi.dll Handle ID: 0x780 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\sscore.dll Handle ID: 0x780 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\ssdm.dll Handle ID: 0x780 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\ssdpapi.dll Handle ID: 0x780 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\ssdpsrv.dll Handle ID: 0x780 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\sspicli.dll Handle ID: 0x780 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\sspisrv.dll Handle ID: 0x780 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\StartTileData.dll Handle ID: 0x780 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\StateRepository.Core.dll Handle ID: 0x780 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\stdole32.tlb Handle ID: 0x780 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\sti_ci.dll Handle ID: 0x780 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\stobject.dll Handle ID: 0x780 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\StorageUsage.dll Handle ID: 0x780 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\storagewmi.dll Handle ID: 0x780 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\stordiag.exe Handle ID: 0x780 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\StorSvc.dll Handle ID: 0x780 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\StringFeedbackEngine.dll Handle ID: 0x780 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\StructuredQuery.dll Handle ID: 0x780 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\SubAuthLoader.dll Handle ID: 0x780 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\sud.dll Handle ID: 0x780 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\SustainabilityService.dll Handle ID: 0x780 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\SyncCenter.dll Handle ID: 0x780 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\SyncController.dll Handle ID: 0x780 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\SyncSettings.dll Handle ID: 0x780 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\sysmain.dll Handle ID: 0x780 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\sysmon.ocx Handle ID: 0x780 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\SysResetErr.exe Handle ID: 0x780 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\SystemSettings.DataModel.dll Handle ID: 0x780 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\SystemSettings.DeviceEncryptionHandlers.dll Handle ID: 0x780 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\SystemSettings.Handlers.dll Handle ID: 0x780 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\SystemSettings.SettingsExtensibility.dll Handle ID: 0x780 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\SystemSettings.UserAccountsHandlers.dll Handle ID: 0x780 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\SystemSettingsAdminFlows.exe Handle ID: 0x780 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\SystemSettingsBroker.exe Handle ID: 0x780 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\SystemSettingsThresholdAdminFlowUI.dll Handle ID: 0x780 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\SystemUWPLauncher.exe Handle ID: 0x780 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\TabletPC.cpl Handle ID: 0x780 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\TabSvc.dll Handle ID: 0x780 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\tapisrv.dll Handle ID: 0x780 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\tar.exe Handle ID: 0x780 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\Taskbar.dll Handle ID: 0x780 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\taskhostw.exe Handle ID: 0x780 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\TaskManagerDataLayer.dll Handle ID: 0x828 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\Taskmgr.exe Handle ID: 0x780 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\tbauth.dll Handle ID: 0x780 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\tbs.dll Handle ID: 0x780 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\tcpmon.dll Handle ID: 0x780 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\tcpmonui.dll Handle ID: 0x780 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\tdh.dll Handle ID: 0x780 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\tdhres.dll Handle ID: 0x780 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\TDLMigration.dll Handle ID: 0x780 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\tellib.dll Handle ID: 0x780 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\termsrv.dll Handle ID: 0x780 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\TetheringMgr.dll Handle ID: 0x780 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\tetheringservice.dll Handle ID: 0x780 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\TextInputFramework.dll Handle ID: 0x780 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\TextInputMethodFormatter.dll Handle ID: 0x780 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\TextShaping.dll Handle ID: 0x780 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\themecpl.dll Handle ID: 0x780 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\Themes.SsfDownload.ScheduledTask.dll Handle ID: 0x780 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\themeservice.dll Handle ID: 0x780 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\themeui.dll Handle ID: 0x780 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\ThreatExperienceManager.dll Handle ID: 0x780 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\ThreatIntelligence.dll Handle ID: 0x780 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\ThreatResponseEngine.dll Handle ID: 0x780 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\thumbcache.dll Handle ID: 0x780 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\TileDataRepository.dll Handle ID: 0x780 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\TimeBrokerServer.dll Handle ID: 0x780 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\timedate.cpl Handle ID: 0x780 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\TokenBroker.dll Handle ID: 0x780 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\TokenBrokerUI.dll Handle ID: 0x780 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\TpmCertResources.dll Handle ID: 0x780 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\TpmCoreProvisioning.dll Handle ID: 0x780 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\TpmTasks.dll Handle ID: 0x780 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\TpmTool.exe Handle ID: 0x780 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\tprtdll.dll Handle ID: 0x780 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\tquery.dll Handle ID: 0x780 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\TranscodeWallpaper.dll Handle ID: 0x780 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\TransferTargets.dll Handle ID: 0x780 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\trie.dll Handle ID: 0x780 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\TrustedSignalCredProv.dll Handle ID: 0x780 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\tscfgwmi.dll Handle ID: 0x780 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\TSErrRedir.dll Handle ID: 0x780 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\tsf3gip.dll Handle ID: 0x780 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\tsgqec.dll Handle ID: 0x780 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\tsmf.dll Handle ID: 0x780 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\TSpkg.dll Handle ID: 0x780 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\TtlsAuth.dll Handle ID: 0x780 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\TtlsCfg.dll Handle ID: 0x780 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\twext.dll Handle ID: 0x780 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\twinapi.appcore.dll Handle ID: 0x780 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\twinapi.dll Handle ID: 0x780 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\twinui.appcore.dll Handle ID: 0x780 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\twinui.dll Handle ID: 0x780 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\twinui.pcshell.dll Handle ID: 0x780 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\tzautoupdate.dll Handle ID: 0x780 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\tzsync.exe Handle ID: 0x780 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\ubpm.dll Handle ID: 0x780 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\UCPDMgr.exe Handle ID: 0x780 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\ucrtbase.dll Handle ID: 0x780 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\ucrtbase_enclave.dll Handle ID: 0x780 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\UdiApiClient.dll Handle ID: 0x780 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\uDWM.dll Handle ID: 0x780 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\UiaManager.dll Handle ID: 0x780 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\UIAnimation.dll Handle ID: 0x780 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\UIAutomationCore.dll Handle ID: 0x780 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\UIEOrchestrator.exe Handle ID: 0x780 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\uireng.dll Handle ID: 0x780 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\ulib.dll Handle ID: 0x780 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\umpdc.dll Handle ID: 0x780 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\umpo-overrides.dll Handle ID: 0x780 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\umpo.dll Handle ID: 0x780 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\umpodev.dll Handle ID: 0x780 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\umpoext.dll Handle ID: 0x780 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\umrdp.dll Handle ID: 0x780 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\unattend.dll Handle ID: 0x780 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\unenrollhook.dll Handle ID: 0x780 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\UnifiedConsent.dll Handle ID: 0x780 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\UnionFSApi.dll Handle ID: 0x780 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\Unistore.dll Handle ID: 0x780 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\UpdateAgent.dll Handle ID: 0x780 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\UpdateCompression.dll Handle ID: 0x780 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\updatepolicy.dll Handle ID: 0x780 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\upfc.exe Handle ID: 0x780 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\upnp.dll Handle ID: 0x780 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\upnphost.dll Handle ID: 0x780 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\UPPrinterInstaller.exe Handle ID: 0x780 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\UPPrinterInstallsCSP.dll Handle ID: 0x780 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\uReFS.dll Handle ID: 0x780 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\urlmon.dll Handle ID: 0x780 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\usbceip.dll Handle ID: 0x780 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\usbmon.dll Handle ID: 0x780 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\UsbPmApi.dll Handle ID: 0x780 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\UsbSettingsHandlers.dll Handle ID: 0x780 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\user32.dll Handle ID: 0x780 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\UserAccountControlSettings.dll Handle ID: 0x780 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\UserAccountControlSettings.exe Handle ID: 0x780 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\useractivitybroker.dll Handle ID: 0x780 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\usercpl.dll Handle ID: 0x780 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\UserDataPlatformHelperUtil.dll Handle ID: 0x780 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\UserDataService.dll Handle ID: 0x780 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\UserDataSource.exe Handle ID: 0x780 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\UserDeviceRegistration.dll Handle ID: 0x780 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\UserDeviceRegistration.Ngc.dll Handle ID: 0x780 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\userenv.dll Handle ID: 0x780 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\userinit.exe Handle ID: 0x780 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\UserLanguageProfileCallback.dll Handle ID: 0x780 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\usermgr.dll Handle ID: 0x780 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\usermgrcli.dll Handle ID: 0x780 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\UserMgrProxy.dll Handle ID: 0x780 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\usoapi.dll Handle ID: 0x780 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\usocoreps.dll Handle ID: 0x780 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\usodocked.dll Handle ID: 0x780 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\usosvc.dll Handle ID: 0x1b9c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\utcapi.dll Handle ID: 0x780 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\UtcDecoderHost.exe Handle ID: 0x780 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\utcutil.dll Handle ID: 0x780 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\Utilman.exe Handle ID: 0x780 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\UvcModel.dll Handle ID: 0x780 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\uwfcsp.dll Handle ID: 0x780 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\UXFrame.dll Handle ID: 0x780 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\UXInit.dll Handle ID: 0x780 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\uxtheme.dll Handle ID: 0x780 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\vaultsvc.dll Handle ID: 0x780 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\vbsapi.dll Handle ID: 0x780 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\vbscript.dll Handle ID: 0x780 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\vbssysprep.dll Handle ID: 0x780 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\vds.exe Handle ID: 0x780 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\veinterop.dll Handle ID: 0x780 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\verifier.exe Handle ID: 0x780 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\vertdll.dll Handle ID: 0x780 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\vfuprov.dll Handle ID: 0x780 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\VideoHandlers.dll Handle ID: 0x780 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\VIDRESZR.DLL Handle ID: 0x780 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\VirtualMon.dll Handle ID: 0x780 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\VirtualSurroundApo.dll Handle ID: 0x780 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\VocabRoamingHandler.dll Handle ID: 0x780 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\VoiceAccess.exe Handle ID: 0x780 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\vpnike.dll Handle ID: 0x780 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\vssapi.dll Handle ID: 0x780 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\VSSVC.exe Handle ID: 0x780 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\w32time.dll Handle ID: 0x828 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\w32tm.exe Handle ID: 0x828 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\WaaSAssessment.dll Handle ID: 0x828 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\WalletBackgroundServiceProxy.dll Handle ID: 0x828 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\wbadmin.exe Handle ID: 0x828 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\wbemcomn.dll Handle ID: 0x828 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\wbengine.exe Handle ID: 0x828 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\wbiosrvc.dll Handle ID: 0x828 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\wc_storage.dll Handle ID: 0x828 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\wcimage.dll Handle ID: 0x828 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\wcmapi.dll Handle ID: 0x828 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\wcmcsp.dll Handle ID: 0x828 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\wcmsvc.dll Handle ID: 0x828 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\wcncsvc.dll Handle ID: 0x828 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\wcnwiz.dll Handle ID: 0x828 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\wdc.dll Handle ID: 0x828 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\wdi.dll Handle ID: 0x828 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\wdigest.dll Handle ID: 0x828 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\wdmaud2.drv Handle ID: 0x828 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\webauthn.dll Handle ID: 0x828 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\WebcamUi.dll Handle ID: 0x828 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\webio.dll Handle ID: 0x828 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\webplatstorageserver.dll Handle ID: 0x828 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\WebRuntimeManager.dll Handle ID: 0x828 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\webservices.dll Handle ID: 0x828 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\webthreatdefsvc.dll Handle ID: 0x828 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\wer.dll Handle ID: 0x828 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\wercplsupport.dll Handle ID: 0x828 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\werdiagcontroller.dll Handle ID: 0x828 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\WerEnc.dll Handle ID: 0x828 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\weretw.dll Handle ID: 0x828 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\WerFault.exe Handle ID: 0x828 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\WerFaultSecure.exe Handle ID: 0x828 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\wermgr.exe Handle ID: 0x828 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\wersvc.dll Handle ID: 0x828 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\werui.dll Handle ID: 0x828 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\wevtapi.dll Handle ID: 0x828 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\wevtsvc.dll Handle ID: 0x828 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\wevtutil.exe Handle ID: 0x828 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\wextract.exe Handle ID: 0x828 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\wfapigp.dll Handle ID: 0x828 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\wfdprov.dll Handle ID: 0x828 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\WFDSConMgr.dll Handle ID: 0x828 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\WFDSConMgrSvc.dll Handle ID: 0x828 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\whesvc.dll Handle ID: 0x828 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\whesvc_assets.dll Handle ID: 0x828 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\wiaservc.dll Handle ID: 0x828 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\WiFiCloudStore.dll Handle ID: 0xbd0 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\WiFiConfigSP.dll Handle ID: 0xbd0 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:43 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\wifidatacapabilityhandler.dll Handle ID: 0xbd0 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\WiFiDisplay.dll Handle ID: 0xbd0 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\wifinetworkmanager.dll Handle ID: 0xbd0 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\wifitask.exe Handle ID: 0xbd0 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\wimgapi.dll Handle ID: 0xbd0 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\wimserv.exe Handle ID: 0xbd0 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\win32appinventorycsp.dll Handle ID: 0xbd0 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\Win32CompatibilityAppraiserCSP.dll Handle ID: 0xbd0 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\win32k.sys Handle ID: 0xbd0 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\win32kbase.sys Handle ID: 0xbd0 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\win32kbase_rs.sys Handle ID: 0xbd0 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\win32kfull.sys Handle ID: 0xbd0 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\win32spl.dll Handle ID: 0xbd0 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\win32u.dll Handle ID: 0xbd0 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\winbio.dll Handle ID: 0xbd0 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\WinBioDataModel.dll Handle ID: 0xbd0 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\WinBioDataModelOOBE.exe Handle ID: 0xbd0 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\winbioext.dll Handle ID: 0xbd0 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\winbrand.dll Handle ID: 0xbd0 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\wincorlib.dll Handle ID: 0xbd0 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\wincredprovider.dll Handle ID: 0xbd0 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\wincredui.dll Handle ID: 0xbd0 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\WinCsFlags.exe Handle ID: 0xbd0 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\windiag.dll Handle ID: 0xbd0 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\windlp.dll Handle ID: 0xbd0 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\WindowManagement.dll Handle ID: 0xbd0 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\WindowManagementAPI.dll Handle ID: 0xbd0 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\Windows.AccountsControl.dll Handle ID: 0xbd0 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\Windows.ApplicationModel.ConversationalAgent.dll Handle ID: 0xbd0 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\Windows.ApplicationModel.Core.dll Handle ID: 0xbd0 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\windows.applicationmodel.datatransfer.dll Handle ID: 0xbd0 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\Windows.ApplicationModel.dll Handle ID: 0xbd0 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\Windows.ApplicationModel.LockScreen.dll Handle ID: 0xbd0 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\Windows.ApplicationModel.Store.dll Handle ID: 0xbd0 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\Windows.ApplicationModel.Store.TestingFramework.dll Handle ID: 0xbd0 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\Windows.CloudStore.dll Handle ID: 0xbd0 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\Windows.CloudStore.EarlyDownloader.dll Handle ID: 0xbd0 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\Windows.CloudStore.Schema.DesktopShell.dll Handle ID: 0xbd0 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\Windows.CloudStore.Schema.Shell.dll Handle ID: 0xbd0 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\Windows.Cortana.Desktop.dll Handle ID: 0xbd0 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\Windows.Cortana.OneCore.dll Handle ID: 0xbd0 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\Windows.Data.Activities.dll Handle ID: 0xbd0 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\Windows.Data.Pdf.dll Handle ID: 0xbd0 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\Windows.Devices.Background.dll Handle ID: 0xbd0 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\Windows.Devices.Bluetooth.dll Handle ID: 0xbd0 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\Windows.Devices.Custom.dll Handle ID: 0xbd0 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\Windows.Devices.Enumeration.dll Handle ID: 0xbd0 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\Windows.Devices.HumanInterfaceDevice.dll Handle ID: 0xbd0 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\Windows.Devices.Lights.dll Handle ID: 0xbd0 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\Windows.Devices.Midi.dll Handle ID: 0xbd0 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\Windows.Devices.Perception.dll Handle ID: 0xbd0 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\Windows.Devices.Picker.dll Handle ID: 0xbd0 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\Windows.Devices.PointOfService.dll Handle ID: 0xbd0 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\Windows.Devices.Portable.dll Handle ID: 0xbd0 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\Windows.Devices.Sensors.dll Handle ID: 0xbd0 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\Windows.Devices.SmartCards.dll Handle ID: 0xbd0 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\Windows.Devices.SmartCards.Phone.dll Handle ID: 0xbd0 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\Windows.Devices.Usb.dll Handle ID: 0xbd0 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\Windows.Devices.WiFiDirect.dll Handle ID: 0xbd0 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\Windows.Energy.dll Handle ID: 0xbd0 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\Windows.FileExplorer.Common.dll Handle ID: 0xbd0 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\Windows.Gaming.Input.dll Handle ID: 0xbd0 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\Windows.Gaming.Preview.dll Handle ID: 0xbd0 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\Windows.Gaming.UI.GameBar.dll Handle ID: 0xbd0 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\Windows.Globalization.dll Handle ID: 0xbd0 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\Windows.Graphics.Display.BrightnessOverride.dll Handle ID: 0xbd0 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\Windows.Graphics.Display.DisplayEnhancementOverride.dll Handle ID: 0xbd0 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\Windows.Graphics.dll Handle ID: 0xbd0 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\Windows.Graphics.Printing.dll Handle ID: 0xbd0 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\Windows.Graphics.Printing.ProtectedPrint.dll Handle ID: 0xbd0 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\Windows.Graphics.Printing.Workflow.dll Handle ID: 0xbd0 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\Windows.Graphics.Printing.Workflow.Native.dll Handle ID: 0xbd0 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\windows.immersiveshell.serviceprovider.dll Handle ID: 0xbd0 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\Windows.Internal.CapturePicker.Desktop.dll Handle ID: 0xbd0 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\Windows.Internal.Devices.Bluetooth.dll Handle ID: 0xbd0 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\Windows.Internal.Devices.Lights.BacklightServer.dll Handle ID: 0xbd0 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\Windows.Internal.Devices.Lights.Configuration.dll Handle ID: 0xbd0 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\Windows.Internal.Devices.Sensors.dll Handle ID: 0xbd0 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\Windows.Internal.Graphics.Display.DisplayColorManagement.dll Handle ID: 0xbd0 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\Windows.Internal.HardwareConfirmator.dll Handle ID: 0xbd0 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\Windows.Internal.Management.dll Handle ID: 0xbd0 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\Windows.Internal.OpenWithHost.dll Handle ID: 0xbd0 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\Windows.Internal.OpenWithHost_WinUI3.dll Handle ID: 0xbd0 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\Windows.Internal.PlatformExtension.DevicePickerExperience.dll Handle ID: 0xbd0 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\Windows.Internal.PlatformExtension.MiracastBannerExperience.dll Handle ID: 0xbd0 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\Windows.Internal.PredictionUnit.dll Handle ID: 0xbd0 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\Windows.Internal.Shell.Broker.dll Handle ID: 0xbd0 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\Windows.Internal.Shell.CloudDesktop.TransitionScreen.dll Handle ID: 0xbd0 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\Windows.Internal.Shell.XamlInputViewHost.dll Handle ID: 0xbd0 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\windows.internal.shellcommon.AccountsControlExperience.dll Handle ID: 0xbd0 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\windows.internal.shellcommon.AppResolverModal.dll Handle ID: 0xbd0 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\Windows.Internal.ShellCommon.dll Handle ID: 0xbd0 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\windows.internal.shellcommon.shareexperience.dll Handle ID: 0xbd0 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\Windows.Internal.Signals.dll Handle ID: 0xbd0 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\Windows.Internal.System.UserProfile.dll Handle ID: 0xbd0 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\Windows.Internal.UI.Dialogs.dll Handle ID: 0xbd0 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\Windows.Internal.UI.Shell.WindowTabManager.dll Handle ID: 0xbd0 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\Windows.Management.EnrollmentStatusTracking.ConfigProvider.dll Handle ID: 0xbd0 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\Windows.Management.InprocObjects.dll Handle ID: 0xbd0 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\Windows.Management.ModernDeployment.ConfigProviders.dll Handle ID: 0xbd0 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\Windows.Management.Service.dll Handle ID: 0xbd0 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\Windows.Management.Update.dll Handle ID: 0xbd0 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\Windows.Management.Workplace.dll Handle ID: 0xbd0 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\Windows.Media.Audio.dll Handle ID: 0xbd0 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\Windows.Media.BackgroundMediaPlayback.dll Handle ID: 0x1b9c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\Windows.Media.Devices.dll Handle ID: 0x1b9c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\Windows.Media.dll Handle ID: 0x1b9c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\Windows.Media.Import.dll Handle ID: 0x1b9c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\Windows.Media.MediaControl.dll Handle ID: 0x718 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\Windows.Media.Playback.BackgroundMediaPlayer.dll Handle ID: 0x718 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\Windows.Media.Playback.MediaPlayer.dll Handle ID: 0x718 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\Windows.Media.Protection.PlayReady.dll Handle ID: 0x718 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\Windows.Media.Speech.dll Handle ID: 0x718 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\Windows.Media.Streaming.dll Handle ID: 0x718 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\Windows.Networking.BackgroundTransfer.dll Handle ID: 0x718 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\Windows.Networking.Connectivity.dll Handle ID: 0x718 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\Windows.Networking.dll Handle ID: 0x718 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\Windows.Networking.HostName.dll Handle ID: 0x718 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\Windows.Networking.NetworkOperators.ESim.dll Handle ID: 0x718 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\Windows.Networking.NetworkOperators.HotspotAuthentication.dll Handle ID: 0x72c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\Windows.Networking.Proximity.dll Handle ID: 0x72c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\Windows.Networking.Sockets.PushEnabledApplication.dll Handle ID: 0x72c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\Windows.Networking.UX.EapRequestHandler.dll Handle ID: 0x72c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\Windows.Networking.Vpn.dll Handle ID: 0x72c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\Windows.Payments.dll Handle ID: 0x72c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\Windows.Security.Authentication.OnlineId.dll Handle ID: 0x72c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\Windows.Security.Authentication.Web.Core.dll Handle ID: 0x72c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\Windows.Security.Credentials.UI.UserConsentVerifier.dll Handle ID: 0x72c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\Windows.Services.TargetedContent.dll Handle ID: 0x72c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\Windows.SharedPC.AccountManager.dll Handle ID: 0x72c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\Windows.Shell.BlueLightReduction.dll Handle ID: 0x72c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\Windows.StateRepository.dll Handle ID: 0x72c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\Windows.StateRepositoryBroker.dll Handle ID: 0x72c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\Windows.StateRepositoryClient.dll Handle ID: 0x72c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\Windows.StateRepositoryCore.dll Handle ID: 0x72c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\Windows.StateRepositoryPS.dll Handle ID: 0x72c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\Windows.StateRepositoryUpgrade.dll Handle ID: 0x1868 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\Windows.Storage.ApplicationData.dll Handle ID: 0x72c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\windows.storage.dll Handle ID: 0x72c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\Windows.Storage.OneCore.dll Handle ID: 0x74c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\Windows.Storage.Search.dll Handle ID: 0x74c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\Windows.System.Launcher.dll Handle ID: 0x74c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\Windows.System.Power.Thermal.dll Handle ID: 0x74c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\Windows.System.Profile.HardwareId.dll Handle ID: 0x74c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\Windows.System.Profile.SystemId.dll Handle ID: 0x74c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\Windows.System.Profile.SystemManufacturers.dll Handle ID: 0x74c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\Windows.System.RemoteDesktop.dll Handle ID: 0x74c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\Windows.System.SystemManagement.dll Handle ID: 0x74c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\Windows.System.UserProfile.DiagnosticsSettings.dll Handle ID: 0x74c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\Windows.UI.Accessibility.dll Handle ID: 0x74c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\Windows.UI.AppDefaults.dll Handle ID: 0x74c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\Windows.UI.BioFeedback.dll Handle ID: 0x74c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\Windows.UI.BlockedShutdown.dll Handle ID: 0x74c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\Windows.UI.Core.TextInput.dll Handle ID: 0x74c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\Windows.UI.Cred.dll Handle ID: 0x74c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\Windows.UI.CredDialogController.dll Handle ID: 0x74c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\Windows.UI.dll Handle ID: 0x74c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\Windows.UI.FileExplorer.dll Handle ID: 0x74c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\Windows.UI.Immersive.dll Handle ID: 0x74c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\Windows.UI.Input.Inking.dll Handle ID: 0x74c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\Windows.UI.Logon.dll Handle ID: 0x74c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\Windows.UI.PicturePassword.dll Handle ID: 0x74c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\Windows.UI.Search.dll Handle ID: 0x74c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\Windows.UI.Shell.Internal.AdaptiveCards.dll Handle ID: 0x74c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\Windows.UI.Storage.dll Handle ID: 0x74c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\Windows.UI.Xaml.Controls.dll Handle ID: 0x1868 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\Windows.UI.Xaml.dll Handle ID: 0x1868 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\Windows.UI.Xaml.Maps.dll Handle ID: 0x1868 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\Windows.UI.Xaml.Phone.dll Handle ID: 0x1868 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\Windows.UI.XamlHost.dll Handle ID: 0x1868 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\Windows.WARP.JITService.dll Handle ID: 0x1868 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\Windows.WARP.JITService.exe Handle ID: 0x1868 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\Windows.Web.Http.dll Handle ID: 0x1868 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\WindowsActionDialog.exe Handle ID: 0x1868 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\WindowsBackupAndRestoreCSP.dll Handle ID: 0x1868 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\WindowsCodecs.dll Handle ID: 0x1868 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\WindowsCodecsExt.dll Handle ID: 0x1868 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\WindowsDefaultHeatProcessor.dll Handle ID: 0x1868 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\windowsdefenderapplicationguardcsp.dll Handle ID: 0x1868 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\WindowsInternal.ComposableShell.Display.dll Handle ID: 0x1868 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\windowslivelogin.dll Handle ID: 0x1868 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\windowsperformancerecordercontrol.dll Handle ID: 0x1868 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\WindowsProtectedPrintConfiguration.dll Handle ID: 0x1868 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\windowsudk.shellcommon.dll Handle ID: 0x1868 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\windowsudkservices.shellcommon.dll Handle ID: 0x1868 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\winhttp.dll Handle ID: 0x1868 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\winhttpcom.dll Handle ID: 0x1868 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\WinHvEmulation.dll Handle ID: 0x1868 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\WinHvPlatform.dll Handle ID: 0x1868 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\wini3c.dll Handle ID: 0x1868 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\wininet.dll Handle ID: 0x1868 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\wininit.exe Handle ID: 0x1868 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\wininitext.dll Handle ID: 0x1868 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\Winlangdb.dll Handle ID: 0x1868 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\winlogon.exe Handle ID: 0x1868 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\winlogonext.dll Handle ID: 0x1868 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\winmde.dll Handle ID: 0x1868 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\winmm.dll Handle ID: 0x1868 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\winmmbase.dll Handle ID: 0x1868 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\WinREAgent.dll Handle ID: 0x1868 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\winrs.exe Handle ID: 0x1868 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\winrscmd.dll Handle ID: 0x1868 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\winrshost.exe Handle ID: 0x1868 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\winrsmgr.dll Handle ID: 0x1868 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\winrssrv.dll Handle ID: 0x1868 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\WinSAT.exe Handle ID: 0x1868 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\WinSATAPI.dll Handle ID: 0x1868 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\winsku.dll Handle ID: 0x1868 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\winspool.drv Handle ID: 0x1868 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\winsrv.dll Handle ID: 0x1868 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\winsrvext.dll Handle ID: 0x1868 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\winsta.dll Handle ID: 0x1868 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\wintrust.dll Handle ID: 0x1868 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\WinTypes.dll Handle ID: 0x1868 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\WinUICohabitation.dll Handle ID: 0x1868 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\WirelessNetworkPreferenceCSP.dll Handle ID: 0x1868 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\wisp.dll Handle ID: 0x1868 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\wkscli.dll Handle ID: 0x1868 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\wkspbroker.exe Handle ID: 0x1868 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\wkssvc.dll Handle ID: 0x1868 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\wlanapi.dll Handle ID: 0x1868 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\wlancfg.dll Handle ID: 0x1868 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\wlanext.exe Handle ID: 0x1868 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\wlangpui.dll Handle ID: 0x1868 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\wlanhlp.dll Handle ID: 0x1868 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\WlanMediaManager.dll Handle ID: 0x1868 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\wlanmsm.dll Handle ID: 0x1868 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\wlansec.dll Handle ID: 0x1868 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\wlansvc.dll Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\wlansvcpal.dll Handle ID: 0x1868 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\wlanui.dll Handle ID: 0x1868 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\Wldap32.dll Handle ID: 0x1868 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\wldp.dll Handle ID: 0x1868 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\wlgpclnt.dll Handle ID: 0x1868 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\wlidcli.dll Handle ID: 0x1868 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\wlidcredprov.dll Handle ID: 0x1868 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\wlidfdp.dll Handle ID: 0x1868 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\wlidnsp.dll Handle ID: 0x1868 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\wlidprov.dll Handle ID: 0x1868 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\wlidsvc.dll Handle ID: 0x1868 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\wlrmdr.exe Handle ID: 0x1868 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\WMADMOD.DLL Handle ID: 0x1868 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\WMADMOE.DLL Handle ID: 0x1868 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\WMNetMgr.dll Handle ID: 0x1868 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\wmp.dll Handle ID: 0x1868 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\WMPDMC.exe Handle ID: 0x1868 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\WMPhoto.dll Handle ID: 0x1868 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\wmsgapi.dll Handle ID: 0x1868 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\WMSPDMOD.DLL Handle ID: 0x1868 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\WMSPDMOE.DLL Handle ID: 0x1868 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\WMVCORE.DLL Handle ID: 0x1f8c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\WMVDECOD.DLL Handle ID: 0x1f8c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\WMVENCOD.DLL Handle ID: 0x1f8c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\WMVSDECD.DLL Handle ID: 0x1f8c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\WMVSENCD.DLL Handle ID: 0x1f8c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\WMVXENCD.DLL Handle ID: 0x1f8c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\WordBreakers.dll Handle ID: 0x1f8c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\workfolderssvc.dll Handle ID: 0x1f8c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\wosc.dll Handle ID: 0x1f8c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\wow64con.dll Handle ID: 0x1f8c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\wow64win.dll Handle ID: 0x1f8c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\Wpc.dll Handle ID: 0x1f8c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\WpcDesktopMonSvc.dll Handle ID: 0x1f8c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\WpcMon.exe Handle ID: 0x1f8c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\WpcRefreshTask.dll Handle ID: 0x1f8c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\WpcTok.exe Handle ID: 0x1f8c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\WpcWebFilter.dll Handle ID: 0x1f8c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\wpd_ci.dll Handle ID: 0x1f8c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\wpdbusenum.dll Handle ID: 0x1f8c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\wpdshext.dll Handle ID: 0x1f8c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\wpnapps.dll Handle ID: 0x1f8c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\wpnclient.dll Handle ID: 0x1f8c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\wpncore.dll Handle ID: 0x1f8c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\wpnprv.dll Handle ID: 0x1f8c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\wpnservice.dll Handle ID: 0x1f8c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\wpnsruprov.dll Handle ID: 0x1f8c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\WppRecorderUM.dll Handle ID: 0x1f8c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\wpr.exe Handle ID: 0x1f8c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\wpx.dll Handle ID: 0x1f8c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\ws2_32.dll Handle ID: 0x1f8c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\WSAIFabricHost.dll Handle ID: 0x1f8c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\wscapi.dll Handle ID: 0x1f8c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\wscript.exe Handle ID: 0x1f8c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\wscsvc.dll Handle ID: 0x1f8c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\WSDApi.dll Handle ID: 0x1f8c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\wsdchngr.dll Handle ID: 0x1f8c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\wsecedit.dll Handle ID: 0x1f8c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\wsepno.dll Handle ID: 0x1f8c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\wsmprovhost.exe Handle ID: 0x1f8c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\WsmSvc.dll Handle ID: 0x1f8c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\wsp_fs.dll Handle ID: 0x1f8c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\wsp_health.dll Handle ID: 0x1f8c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\wsqmcons.exe Handle ID: 0x1f8c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\WSReset.exe Handle ID: 0x1f8c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\wtsapi32.dll Handle ID: 0x1f8c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\wuapi.dll Handle ID: 0x1f8c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\wuauclt.exe Handle ID: 0x1f8c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\wuaueng.dll Handle ID: 0x1f8c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\wuceffects.dll Handle ID: 0x1f8c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\WUDFCoinstaller.dll Handle ID: 0x1f8c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\WUDFCompanionHost.exe Handle ID: 0x1f8c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\WUDFHost.exe Handle ID: 0x1f8c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\WUDFPlatform.dll Handle ID: 0x1f8c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\WudfSMCClassExt.dll Handle ID: 0x1f8c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\WUDFx.dll Handle ID: 0x1f8c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\WUDFx02000.dll Handle ID: 0x1f8c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\wups2.dll Handle ID: 0x1f8c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\wusa.exe Handle ID: 0x1f8c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\wusys.dll Handle ID: 0x1f8c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\wvc.dll Handle ID: 0x1f8c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\WWAHost.exe Handle ID: 0x1f8c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\WWanAPI.dll Handle ID: 0x1f8c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\wwancfg.dll Handle ID: 0x1f8c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\WwanPrfl.dll Handle ID: 0x1f8c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\wwanprotdim.dll Handle ID: 0x1f8c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\wwansvc.dll Handle ID: 0x1f8c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\wwapi.dll Handle ID: 0x1f8c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\XamlTileRender.dll Handle ID: 0x1f8c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\XAudio2_9.dll Handle ID: 0x1f8c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\XblAuthManager.dll Handle ID: 0x1f8c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\XblAuthManagerProxy.dll Handle ID: 0x1f8c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\XblAuthTokenBrokerExt.dll Handle ID: 0x1f8c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\XblGameSave.dll Handle ID: 0x1f8c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\XblGameSaveTask.exe Handle ID: 0x1f8c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\XInput1_4.dll Handle ID: 0x1f8c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\XInputUap.dll Handle ID: 0x1f8c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\xmlfilter.dll Handle ID: 0x1f8c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\xmllite.dll Handle ID: 0x1f8c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\xolehlp.dll Handle ID: 0x1f8c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\XpsDocumentTargetPrint.dll Handle ID: 0x1f8c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\XpsPrint.dll Handle ID: 0x1f8c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\xpsservices.dll Handle ID: 0x1f8c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\XpsToPclmConverter.dll Handle ID: 0x1f8c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\XpsToPwgrConverter.dll Handle ID: 0x1f8c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\XpsToTiffConverter.dll Handle ID: 0x1f8c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\zipcontainer.dll Handle ID: 0x1f8c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\zipfldr.dll Handle ID: 0x1f8c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\ztdnsapi.dll Handle ID: 0x1f8c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\zthelper.dll Handle ID: 0x1f8c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\af-ZA\mlang.dll.mui Handle ID: 0x1f8c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\af-ZA\WWAHost.exe.mui Handle ID: 0x1f8c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\am-ET\mlang.dll.mui Handle ID: 0x1f8c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\am-ET\WWAHost.exe.mui Handle ID: 0x1f8c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\appraiser\appraiser.sdb Handle ID: 0x1f8c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\appraiser\appraiser_oobe.sdb Handle ID: 0x1f8c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\ar-SA\mlang.dll.mui Handle ID: 0x1f8c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\ar-SA\WWAHost.exe.mui Handle ID: 0x1f8c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\as-IN\mlang.dll.mui Handle ID: 0x1f8c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\as-IN\WWAHost.exe.mui Handle ID: 0x1f8c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\az-Latn-AZ\mlang.dll.mui Handle ID: 0x1f8c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\az-Latn-AZ\WWAHost.exe.mui Handle ID: 0x1f8c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\be-BY\mlang.dll.mui Handle ID: 0x1f8c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\be-BY\WWAHost.exe.mui Handle ID: 0x1f8c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\bg-BG\mlang.dll.mui Handle ID: 0x1f8c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\bg-BG\WWAHost.exe.mui Handle ID: 0x1f8c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\bn-IN\mlang.dll.mui Handle ID: 0x1f8c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\bn-IN\WWAHost.exe.mui Handle ID: 0x1f8c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\bs-Latn-BA\mlang.dll.mui Handle ID: 0x1f8c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\bs-Latn-BA\WWAHost.exe.mui Handle ID: 0x1f8c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\ca-ES\mlang.dll.mui Handle ID: 0x1f8c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\ca-ES\WWAHost.exe.mui Handle ID: 0x1f8c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\ca-ES-valencia\mlang.dll.mui Handle ID: 0x1f8c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\ca-ES-valencia\WWAHost.exe.mui Handle ID: 0x1f8c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\SbatLevel.cat Handle ID: 0x1f8c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\chr-CHER-US\mlang.dll.mui Handle ID: 0x1f8c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\chr-CHER-US\WWAHost.exe.mui Handle ID: 0x1f8c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\cs-CZ\mlang.dll.mui Handle ID: 0x1f8c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\cs-CZ\WWAHost.exe.mui Handle ID: 0x1f8c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\cy-GB\mlang.dll.mui Handle ID: 0x1f8c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\cy-GB\WWAHost.exe.mui Handle ID: 0x1f8c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\da-DK\mlang.dll.mui Handle ID: 0x1f8c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\da-DK\WWAHost.exe.mui Handle ID: 0x1f8c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\DDFs\NGCProDDF_v1.2_final.xml Handle ID: 0x1f8c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\de-DE\mlang.dll.mui Handle ID: 0x1f8c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\de-DE\WWAHost.exe.mui Handle ID: 0x1f8c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\Dism\AppxProvider.dll Handle ID: 0x1f8c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\Dism\CbsProvider.dll Handle ID: 0x1f8c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\Dism\DismCore.dll Handle ID: 0x1f8c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\Dism\DismCorePS.dll Handle ID: 0x1868 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\Dism\DismProv.dll Handle ID: 0x1f8c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\Dism\DmiProvider.dll Handle ID: 0x1f8c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\Dism\FolderProvider.dll Handle ID: 0x1f8c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\Dism\GenericProvider.dll Handle ID: 0x1f8c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\Dism\IntlProvider.dll Handle ID: 0x1f8c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\Dism\LogProvider.dll Handle ID: 0x1f8c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\Dism\MsuProvider.dll Handle ID: 0x1f8c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\Dism\OfflineSetupProvider.dll Handle ID: 0x1f8c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\Dism\OSProvider.dll Handle ID: 0x1f8c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\Dism\ProvProvider.dll Handle ID: 0x1f8c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\Dism\SmiProvider.dll Handle ID: 0x1f8c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\Dism\TransmogProvider.dll Handle ID: 0x1f8c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\Dism\UnattendProvider.dll Handle ID: 0x1f8c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\Dism\en-US\DismCore.dll.mui Handle ID: 0x1f8c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\Dism\en-US\DismProv.dll.mui Handle ID: 0x1f8c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\Dism\en-US\FfuProvider.dll.mui Handle ID: 0x1f8c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\Dism\en-US\FolderProvider.dll.mui Handle ID: 0x1f8c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\Dism\en-US\ImagingProvider.dll.mui Handle ID: 0x1f8c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\Dism\en-US\LogProvider.dll.mui Handle ID: 0x1f8c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\Dism\en-US\VhdProvider.dll.mui Handle ID: 0x1f8c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\Dism\en-US\WimProvider.dll.mui Handle ID: 0x1f8c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\drivers\Acx01000.sys Handle ID: 0x1f8c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\drivers\afunix.sys Handle ID: 0x1f8c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\drivers\agilevpn.sys Handle ID: 0x1f8c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\drivers\appid.sys Handle ID: 0x1f8c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\drivers\applockerfltr.sys Handle ID: 0x1f8c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\drivers\bindflt.sys Handle ID: 0x1f8c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\drivers\cimfs.sys Handle ID: 0x1f8c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\drivers\Classpnp.sys Handle ID: 0x1f8c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\drivers\cldflt.sys Handle ID: 0x1f8c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\drivers\ClipSp.sys Handle ID: 0x1f8c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\drivers\csc.sys Handle ID: 0x1f8c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\drivers\Dumpstorport.sys Handle ID: 0x1f8c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\drivers\ExecutionContext.sys Handle ID: 0x1f8c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\drivers\globmerger.sys Handle ID: 0x1f8c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\drivers\HidSpiCx.sys Handle ID: 0x1f8c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\drivers\http.sys Handle ID: 0x1f8c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:44 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\drivers\hvsocket.sys Handle ID: 0x1f8c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\drivers\IndirectKmd.sys Handle ID: 0x1f8c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\drivers\ipfltdrv.sys Handle ID: 0x1f8c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\drivers\ksthunk.sys Handle ID: 0x1f8c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\drivers\lltdio.sys Handle ID: 0x1f8c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\drivers\MbbCx.sys Handle ID: 0x1f8c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\drivers\mmcss.sys Handle ID: 0x1f8c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\drivers\msgpioclx.sys Handle ID: 0x1f8c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\drivers\Ndu.sys Handle ID: 0x1f8c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\drivers\netadaptercx.sys Handle ID: 0x1f8c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\drivers\nwifi.sys Handle ID: 0x1f8c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\drivers\PEAuth.sys Handle ID: 0x1f8c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\drivers\PktMon.sys Handle ID: 0x1f8c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\drivers\PktMonApi.sys Handle ID: 0x1f8c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\drivers\qwavedrv.sys Handle ID: 0x1f8c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\drivers\rdpdr.sys Handle ID: 0x1f8c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\drivers\rspndr.sys Handle ID: 0x1f8c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\drivers\SpbCx.sys Handle ID: 0x1f8c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\drivers\srv2.sys Handle ID: 0x1f8c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\drivers\srvnet.sys Handle ID: 0x1f8c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\drivers\tape.sys Handle ID: 0x1f8c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\drivers\tbs.sys Handle ID: 0x1f8c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\drivers\UcmCx.sys Handle ID: 0x1f8c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\drivers\UcmTcpciCx.sys Handle ID: 0x1f8c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\drivers\UcmUcsiCx.sys Handle ID: 0x1f8c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\drivers\UCPD.sys Handle ID: 0x1f8c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\drivers\Ucx01000.sys Handle ID: 0x1f8c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\drivers\UsbPmApi.sys Handle ID: 0x1f8c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\drivers\VerifierExt.sys Handle ID: 0x1f8c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\drivers\vmbkmcl.sys Handle ID: 0x1f8c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\drivers\wcifs.sys Handle ID: 0x1f8c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\drivers\WdiWiFi.sys Handle ID: 0x1f8c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\drivers\WifiCx.sys Handle ID: 0x1f8c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\drivers\winhvr.sys Handle ID: 0x1f8c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\drivers\WUDFPf.sys Handle ID: 0x1f8c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\drivers\WUDFRd.sys Handle ID: 0x1f8c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\drivers\ztdns.sys Handle ID: 0x1f8c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\drivers\en-US\dumpsd.sys.mui Handle ID: 0x1f8c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\drivers\en-US\msseccore.sys.mui Handle ID: 0x1f8c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\drivers\en-US\mssecflt.sys.mui Handle ID: 0x1f8c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\drivers\en-US\mssecwfp.sys.mui Handle ID: 0x1f8c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\drivers\en-US\pci.sys.mui Handle ID: 0x1f8c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\drivers\en-US\sdbus.sys.mui Handle ID: 0x1f8c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\drivers\en-US\tcpip.sys.mui Handle ID: 0x1f8c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\drivers\en-US\vfpext.sys.mui Handle ID: 0x1f8c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\drivers\UMDF\IddCx.dll Handle ID: 0x1f8c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\drivers\UMDF\netadaptercxum.dll Handle ID: 0x1f8c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\drivers\UMDF\NfcCx.dll Handle ID: 0x9b8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\drivers\UMDF\SensorsCx.dll Handle ID: 0x1f8c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\drivers\UMDF\UcmCx.dll Handle ID: 0x1f8c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\DriverStore\en-US\USBMidi2.inf_loc Handle ID: 0x1f8c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\el-GR\mlang.dll.mui Handle ID: 0x1f8c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\el-GR\WWAHost.exe.mui Handle ID: 0x1f8c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\en\AuthFWSnapIn.Resources.dll Handle ID: 0x1f8c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\en\AuthFWWizFwk.Resources.dll Handle ID: 0x1f8c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\en-GB\mlang.dll.mui Handle ID: 0x1f8c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\en-GB\WWAHost.exe.mui Handle ID: 0x1f8c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\en-US\AboutSettingsHandlers.dll.mui Handle ID: 0x1f8c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\en-US\accessibilitycpl.dll.mui Handle ID: 0x1f8c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\en-US\adtschema.dll.mui Handle ID: 0x1f8c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\en-US\appinfo.dll.mui Handle ID: 0x1f8c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\en-US\AppXDeploymentClient.dll.mui Handle ID: 0x1f8c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\en-US\AppXDeploymentServer.dll.mui Handle ID: 0x1f8c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\en-US\AppxPackaging.dll.mui Handle ID: 0x1f8c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\en-US\authfwgp.dll.mui Handle ID: 0x1f8c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\en-US\bcastdvruserservice.dll.mui Handle ID: 0x1f8c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\en-US\bdesvc.dll.mui Handle ID: 0x1f8c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\en-US\BioCredProv.dll.mui Handle ID: 0x1f8c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\en-US\BitLockerWizard.exe.mui Handle ID: 0x1f8c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\en-US\BitLockerWizardElev.exe.mui Handle ID: 0x1f8c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\en-US\bootux.dll.mui Handle ID: 0x1f8c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\en-US\CapabilityAccessManager.dll.mui Handle ID: 0x1f8c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\en-US\charmap.exe.mui Handle ID: 0x1f8c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\en-US\CloudRestoreLauncher.dll.mui Handle ID: 0x1f8c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\en-US\combase.dll.mui Handle ID: 0x1f8c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\en-US\consent.exe.mui Handle ID: 0x1f8c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\en-US\ConsentUX.dll.mui Handle ID: 0x1f8c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\en-US\credprovhost.dll.mui Handle ID: 0x1f8c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\en-US\credprovslegacy.dll.mui Handle ID: 0x1f8c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\en-US\CryptNgc.dll.mui Handle ID: 0x1f8c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\en-US\CustomInstallExec.exe.mui Handle ID: 0x1f8c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\en-US\datamap.0409.dat Handle ID: 0x1f8c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\en-US\devmgr.dll.mui Handle ID: 0x1f8c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\en-US\diskusage.exe.mui Handle ID: 0x1f8c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\en-US\Dism.exe.mui Handle ID: 0x1f8c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\en-US\DismApi.dll.mui Handle ID: 0x1f8c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\en-US\dxgwdi.dll.mui Handle ID: 0x1f8c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\en-US\eapsvc.dll.mui Handle ID: 0x1f8c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\en-US\EditionUpgradeHelper.dll.mui Handle ID: 0x1f8c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\en-US\EditionUpgradeManagerObj.dll.mui Handle ID: 0x1f8c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\en-US\edptask.dll.mui Handle ID: 0x730 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\en-US\ExpressiveInput.0409.lex Handle ID: 0x1f8c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\en-US\FaceCredentialProvider.dll.mui Handle ID: 0x1f8c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\en-US\faultrep.dll.mui Handle ID: 0x1868 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\en-US\fsutil.exe.mui Handle ID: 0x1868 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\en-US\fveapi.dll.mui Handle ID: 0x1868 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\en-US\fvecpl.dll.mui Handle ID: 0x1868 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\en-US\fveui.dll.mui Handle ID: 0x1868 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\en-US\fvewiz.dll.mui Handle ID: 0x1868 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\en-US\hnsdiag.exe.mui Handle ID: 0x1868 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\en-US\HostNetSvc.dll.mui Handle ID: 0x1868 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\en-US\iprtrmgr.dll.mui Handle ID: 0x1868 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\en-US\kernel32.dll.mui Handle ID: 0x1868 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\en-US\KernelBase.dll.mui Handle ID: 0x1868 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\en-US\localui.dll.mui Handle ID: 0x1868 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\en-US\logoncli.dll.mui Handle ID: 0x1868 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\en-US\lsasrv.dll.mui Handle ID: 0x1868 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\en-US\lsm.dll.mui Handle ID: 0x1868 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\en-US\mcmsvc.dll.mui Handle ID: 0x1868 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\en-US\microsoft-windows-kernel-power-events.dll.mui Handle ID: 0x1868 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\en-US\microsoft-windows-system-events.dll.mui Handle ID: 0x1868 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\en-US\Microsoft.Data.UsageAndQualityInsights.dll.mui Handle ID: 0x1868 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\en-US\Midi2.BS2UMPTransform.dll.mui Handle ID: 0x730 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\en-US\Midi2.DiagnosticsTransport.dll.mui Handle ID: 0x1868 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\en-US\Midi2.KSAggregateTransport.dll.mui Handle ID: 0x1868 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\en-US\Midi2.KSTransport.dll.mui Handle ID: 0x1868 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\en-US\Midi2.LoopbackMidiTransport.dll.mui Handle ID: 0x1868 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\en-US\Midi2.MidiSrvTransport.dll.mui Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\en-US\Midi2.SchedulerTransform.dll.mui Handle ID: 0x1868 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\en-US\Midi2.UMP2BSTransform.dll.mui Handle ID: 0x1868 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\en-US\Midi2.UmpProtocolDownscalerTransform.dll.mui Handle ID: 0x1868 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\en-US\Midi2.VirtualMidiTransport.dll.mui Handle ID: 0x1868 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\en-US\MidiSrv.exe.mui Handle ID: 0x1868 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\en-US\mlang.dll.mui Handle ID: 0x1868 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\en-US\mprdim.dll.mui Handle ID: 0x1868 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\en-US\msaudite.dll.mui Handle ID: 0x1868 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\en-US\msinfo32.exe.mui Handle ID: 0x1868 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\en-US\msobjs.dll.mui Handle ID: 0x1868 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\en-US\mssph.dll.mui Handle ID: 0x1868 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\en-US\mssrch.dll.mui Handle ID: 0x1868 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\en-US\mssvp.dll.mui Handle ID: 0x1868 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\en-US\msv1_0.dll.mui Handle ID: 0x1868 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\en-US\MusUpdateHandlers1.dll.mui Handle ID: 0x1868 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\en-US\netlogon.dll.mui Handle ID: 0x1868 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\en-US\ngccredprov.dll.mui Handle ID: 0x1868 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\en-US\nlsbres.dll.mui Handle ID: 0x1868 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\en-US\nltest.exe.mui Handle ID: 0x1868 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\en-US\nshdnsclient.dll.mui Handle ID: 0x1868 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\en-US\ntdll.dll.mui Handle ID: 0x1868 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\en-US\ole32.dll.mui Handle ID: 0x1868 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\en-US\pdhui.dll.mui Handle ID: 0x1868 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\en-US\perfmon.exe.mui Handle ID: 0x1868 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\en-US\printercleanuptask.dll.mui Handle ID: 0x1868 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\en-US\qmgr.dll.mui Handle ID: 0x1868 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\en-US\QuickActionsDataModel.dll.mui Handle ID: 0x1868 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\en-US\rasmans.dll.mui Handle ID: 0x1868 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\en-US\RdpAvenc.dll.mui Handle ID: 0x1868 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\en-US\RdpLite.dll.mui Handle ID: 0x1868 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\en-US\ResetEngine.dll.mui Handle ID: 0x1868 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\en-US\ResetEngOnline.dll.mui Handle ID: 0x1868 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\en-US\rtm.dll.mui Handle ID: 0x1868 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\en-US\samsrv.dll.mui Handle ID: 0x1868 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\en-US\Search.ProtocolHandler.MAPI2.dll.mui Handle ID: 0x1868 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\en-US\SearchIndexer.exe.mui Handle ID: 0x1868 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\en-US\SettingsHandlers_CapabilityAccess.dll.mui Handle ID: 0x1868 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\en-US\SettingsHandlers_Geolocation.dll.mui Handle ID: 0x1868 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\en-US\SettingsHandlers_OneCore_BatterySaver.dll.mui Handle ID: 0x1868 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\en-US\sfc.exe.mui Handle ID: 0x1868 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\en-US\shdocvw.dll.mui Handle ID: 0x1868 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\en-US\shell32.dll.mui Handle ID: 0x1868 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\en-US\shsvcs.dll.mui Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\en-US\sihclient.exe.mui Handle ID: 0x1868 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\en-US\slui.exe.mui Handle ID: 0x1868 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\en-US\SmartcardCredentialProvider.dll.mui Handle ID: 0x1868 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\en-US\sppcomapi.dll.mui Handle ID: 0x1868 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\en-US\SRH.dll.mui Handle ID: 0x1868 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\en-US\storagewmi.dll.mui Handle ID: 0x1868 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\en-US\sysmon.ocx.mui Handle ID: 0x1868 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\en-US\sysreseterr.exe.mui Handle ID: 0x1868 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\en-US\SystemSettingsAdminFlows.exe.mui Handle ID: 0x1868 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\en-US\Taskmgr.exe.mui Handle ID: 0x1868 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\en-US\termsrv.dll.mui Handle ID: 0x1868 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\en-US\tier2punctuations.dll.mui Handle ID: 0x1868 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\en-US\TpmCoreProvisioning.dll.mui Handle ID: 0x1868 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\en-US\tquery.dll.mui Handle ID: 0x1868 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\en-US\TransferTargets.dll.mui Handle ID: 0x1868 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\en-US\twinui.dll.mui Handle ID: 0x1868 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\en-US\ubpm.dll.mui Handle ID: 0x1868 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\en-US\UpdatePolicy.dll.mui Handle ID: 0x1868 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\en-US\usbmon.dll.mui Handle ID: 0x1868 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\en-US\usercpl.dll.mui Handle ID: 0x1868 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\en-US\usermgr.dll.mui Handle ID: 0x1868 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\en-US\usosvc.dll.mui Handle ID: 0x1868 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\en-US\uxtheme.dll.mui Handle ID: 0x1868 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\en-US\VSSVC.exe.mui Handle ID: 0x1868 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\en-US\wbiosrvc.dll.mui Handle ID: 0x1868 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\en-US\wdc.dll.mui Handle ID: 0x1868 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\en-US\wdmaud2.drv.mui Handle ID: 0x1868 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\en-US\webauthn.dll.mui Handle ID: 0x1868 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\en-US\wer.dll.mui Handle ID: 0x1868 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\en-US\WerFault.exe.mui Handle ID: 0x1868 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\en-US\WerFaultSecure.exe.mui Handle ID: 0x1868 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\en-US\wevtapi.dll.mui Handle ID: 0x1868 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\en-US\wevtsvc.dll.mui Handle ID: 0x1868 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\en-US\win32kbase.sys.mui Handle ID: 0x1868 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\en-US\windows.storage.dll.mui Handle ID: 0x1868 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\en-US\Windows.UI.CredDialogController.dll.mui Handle ID: 0x1868 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\en-US\winlogon.exe.mui Handle ID: 0x1868 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\en-US\wintypes.dll.mui Handle ID: 0x1868 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\en-US\WSAIFabricHost.dll.mui Handle ID: 0x1868 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\en-US\wsecedit.dll.mui Handle ID: 0x1868 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\en-US\wuapi.dll.mui Handle ID: 0x1868 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\en-US\wuaueng.dll.mui Handle ID: 0x1868 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\en-US\WudfSMCClassExt.dll.mui Handle ID: 0x1868 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\en-US\wusa.exe.mui Handle ID: 0x1868 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\en-US\wvc.dll.mui Handle ID: 0x1868 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\en-US\WWAHost.exe.mui Handle ID: 0x1868 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\en-US\wwancfg.dll.mui Handle ID: 0x1868 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\es-ES\mlang.dll.mui Handle ID: 0x1868 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\es-ES\WWAHost.exe.mui Handle ID: 0x1868 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\es-MX\mlang.dll.mui Handle ID: 0x1868 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\es-MX\WWAHost.exe.mui Handle ID: 0x1868 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\et-EE\mlang.dll.mui Handle ID: 0x1868 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\et-EE\WWAHost.exe.mui Handle ID: 0x1868 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\eu-ES\mlang.dll.mui Handle ID: 0x1868 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\eu-ES\WWAHost.exe.mui Handle ID: 0x1868 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\fa-IR\mlang.dll.mui Handle ID: 0x1868 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\fa-IR\WWAHost.exe.mui Handle ID: 0x1868 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\fi-FI\mlang.dll.mui Handle ID: 0x1868 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\fi-FI\WWAHost.exe.mui Handle ID: 0x1868 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\fil-PH\mlang.dll.mui Handle ID: 0x1868 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\fil-PH\WWAHost.exe.mui Handle ID: 0x1868 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\fr-CA\mlang.dll.mui Handle ID: 0x1868 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\fr-CA\WWAHost.exe.mui Handle ID: 0x1868 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\fr-FR\mlang.dll.mui Handle ID: 0x1868 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\fr-FR\WWAHost.exe.mui Handle ID: 0x1868 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\ga-IE\mlang.dll.mui Handle ID: 0x1868 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\ga-IE\WWAHost.exe.mui Handle ID: 0x1868 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\gd-GB\mlang.dll.mui Handle ID: 0x1868 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\gd-GB\WWAHost.exe.mui Handle ID: 0x1868 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\gl-ES\mlang.dll.mui Handle ID: 0x1868 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\gl-ES\WWAHost.exe.mui Handle ID: 0x1868 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\gu-IN\mlang.dll.mui Handle ID: 0x1868 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\gu-IN\WWAHost.exe.mui Handle ID: 0x1868 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\he-IL\mlang.dll.mui Handle ID: 0x1868 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\he-IL\WWAHost.exe.mui Handle ID: 0x1868 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\HealthAttestationClient\HealthAttestationClientAgent.exe Handle ID: 0x1868 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\hi-IN\mlang.dll.mui Handle ID: 0x1868 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\hi-IN\WWAHost.exe.mui Handle ID: 0x1868 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\hr-HR\mlang.dll.mui Handle ID: 0x1868 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\hr-HR\WWAHost.exe.mui Handle ID: 0x1868 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\hu-HU\mlang.dll.mui Handle ID: 0x1868 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\hu-HU\WWAHost.exe.mui Handle ID: 0x1868 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\hy-AM\mlang.dll.mui Handle ID: 0x1868 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\hy-AM\WWAHost.exe.mui Handle ID: 0x1868 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\id-ID\mlang.dll.mui Handle ID: 0x1868 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\id-ID\WWAHost.exe.mui Handle ID: 0x1868 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\IME\IMEJP\IMJPAPI.DLL Handle ID: 0x730 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\IME\IMEJP\IMJPCD.DLL Handle ID: 0x730 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\IME\IMEJP\IMJPCMLD.DLL Handle ID: 0x730 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\IME\IMEJP\imjpcus.dll Handle ID: 0x730 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\IME\IMEJP\IMJPDAPI.DLL Handle ID: 0x730 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\IME\IMEJP\IMJPDCT.EXE Handle ID: 0x730 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\IME\IMEJP\IMJPDCTP.DLL Handle ID: 0x730 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\IME\IMEJP\IMJPLMP.DLL Handle ID: 0x730 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\IME\IMEJP\IMJPPRED.DLL Handle ID: 0x730 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\IME\IMEJP\IMJPSET.EXE Handle ID: 0x730 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\IME\IMEJP\IMJPTIP.DLL Handle ID: 0x730 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\IME\IMEJP\IMJPUEX.EXE Handle ID: 0x730 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\IME\IMEJP\imjpuexc.exe Handle ID: 0x730 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\IME\IMEJP\imjputyc.dll Handle ID: 0x730 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\IME\IMEJP\APPLETS\IMJPCAC.DLL Handle ID: 0x730 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\IME\IMEJP\APPLETS\IMJPCLST.DLL Handle ID: 0x730 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\IME\IMEJP\APPLETS\IMJPKDIC.DLL Handle ID: 0x730 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\IME\IMEJP\APPLETS\imjpskey.DLL Handle ID: 0x730 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\IME\IMEJP\APPLETS\IMJPSKF.DLL Handle ID: 0x730 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\IME\IMEKR\imkrapi.dll Handle ID: 0x730 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\IME\IMEKR\imkrotip.dll Handle ID: 0x730 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\IME\IMEKR\imkrtip.dll Handle ID: 0x730 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\IME\IMEKR\imkrudt.dll Handle ID: 0x730 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\IME\IMEKR\APPLETS\imkrcac.dll Handle ID: 0x730 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\IME\IMEKR\APPLETS\imkrskf.dll Handle ID: 0x730 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\IME\IMEKR\DICTS\imkrhjd.dll Handle ID: 0x730 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\IME\IMETC\IMTCCFG.DLL Handle ID: 0x730 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\IME\IMETC\IMTCCORE.DLL Handle ID: 0x730 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\IME\IMETC\IMTCLNWZ.EXE Handle ID: 0x730 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\IME\IMETC\IMTCPROP.exe Handle ID: 0x730 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\IME\IMETC\IMTCTIP.dll Handle ID: 0x730 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\IME\IMETC\applets\IMTCCAC.dll Handle ID: 0x730 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\IME\IMETC\applets\IMTCSKF.dll Handle ID: 0x730 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\IME\SHARED\IMCCPHR.exe Handle ID: 0x730 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\IME\SHARED\ImeBroker.exe Handle ID: 0x730 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\IME\SHARED\ImeBrokerps.dll Handle ID: 0x730 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\IME\SHARED\imecfm.dll Handle ID: 0x730 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\IME\SHARED\imecfmui.exe Handle ID: 0x730 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\IME\SHARED\IMEFILES.DLL Handle ID: 0x730 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\IME\SHARED\IMELM.DLL Handle ID: 0x730 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\IME\SHARED\IMEPADSM.DLL Handle ID: 0x730 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\IME\SHARED\IMEPADSV.EXE Handle ID: 0x730 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\IME\SHARED\IMESEARCH.EXE Handle ID: 0x730 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\IME\SHARED\IMESEARCHDLL.DLL Handle ID: 0x730 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\IME\SHARED\IMETIP.DLL Handle ID: 0x730 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\IME\SHARED\IMEWDBLD.EXE Handle ID: 0x730 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\IME\SHARED\IMJKAPI.DLL Handle ID: 0x730 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\IME\SHARED\MSCAND20.DLL Handle ID: 0x730 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\IME\SHARED\res\padrs411.dll Handle ID: 0x730 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\IME\SHARED\res\padrs412.dll Handle ID: 0x730 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\InputMethod\CHS\ChsAdvancedDS.dll Handle ID: 0x730 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\InputMethod\CHS\ChsEM.dll Handle ID: 0x730 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\InputMethod\CHS\ChsIFEComp.dll Handle ID: 0x730 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\InputMethod\CHS\ChsIME.exe Handle ID: 0x730 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\InputMethod\CHS\ChsLexiconUpdateDS.dll Handle ID: 0x730 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\InputMethod\CHS\ChsPinyinDS.dll Handle ID: 0x730 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\InputMethod\CHS\ChsProxyDS.dll Handle ID: 0x730 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\InputMethod\CHS\ChsRoaming.DLL Handle ID: 0x730 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\InputMethod\CHS\ChsWubiDS.dll Handle ID: 0x730 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\InputMethod\CHS\ServiceDS.dll Handle ID: 0x730 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\InputMethod\CHT\ChtChangjieDS.DLL Handle ID: 0x730 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\InputMethod\CHT\ChtQuickDS.DLL Handle ID: 0x730 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\InputMethod\SHARED\ChxAdvancedDS.DLL Handle ID: 0x730 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\InputMethod\SHARED\ChxEM.DLL Handle ID: 0x730 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\InputMethod\SHARED\ChxUserDictDS.DLL Handle ID: 0x730 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\InputMethod\SHARED\IHDS.DLL Handle ID: 0x730 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\is-IS\mlang.dll.mui Handle ID: 0x730 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\is-IS\WWAHost.exe.mui Handle ID: 0x730 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\it-IT\mlang.dll.mui Handle ID: 0x730 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\it-IT\WWAHost.exe.mui Handle ID: 0x730 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\ja-jp\mlang.dll.mui Handle ID: 0x730 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\ja-jp\WWAHost.exe.mui Handle ID: 0x730 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\ka-GE\mlang.dll.mui Handle ID: 0x730 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\ka-GE\WWAHost.exe.mui Handle ID: 0x730 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\kk-KZ\mlang.dll.mui Handle ID: 0x730 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\kk-KZ\WWAHost.exe.mui Handle ID: 0x730 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\km-KH\mlang.dll.mui Handle ID: 0x730 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\km-KH\WWAHost.exe.mui Handle ID: 0x730 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\kn-IN\mlang.dll.mui Handle ID: 0x730 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\kn-IN\WWAHost.exe.mui Handle ID: 0x730 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\ko-KR\mlang.dll.mui Handle ID: 0x730 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\ko-KR\WWAHost.exe.mui Handle ID: 0x730 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\kok-IN\mlang.dll.mui Handle ID: 0x730 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\kok-IN\WWAHost.exe.mui Handle ID: 0x730 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\lb-LU\mlang.dll.mui Handle ID: 0x730 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\lb-LU\WWAHost.exe.mui Handle ID: 0x730 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\lo-LA\mlang.dll.mui Handle ID: 0x730 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\lo-LA\WWAHost.exe.mui Handle ID: 0x730 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\lt-LT\mlang.dll.mui Handle ID: 0x730 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\lt-LT\WWAHost.exe.mui Handle ID: 0x730 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\lv-LV\mlang.dll.mui Handle ID: 0x730 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\lv-LV\WWAHost.exe.mui Handle ID: 0x730 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\mi-NZ\mlang.dll.mui Handle ID: 0x730 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\mi-NZ\WWAHost.exe.mui Handle ID: 0x730 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\Microsoft-Edge-WebView\141.0.3537.57.manifest Handle ID: 0x730 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\Microsoft-Edge-WebView\concrt140.dll Handle ID: 0x730 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\Microsoft-Edge-WebView\d3dcompiler_47.dll Handle ID: 0x730 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\Microsoft-Edge-WebView\dual_engine_adapter_x64.dll Handle ID: 0x730 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\Microsoft-Edge-WebView\dxcompiler.dll Handle ID: 0x730 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\Microsoft-Edge-WebView\dxil.dll Handle ID: 0x730 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\Microsoft-Edge-WebView\elevated_tracing_service.exe Handle ID: 0x730 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\Microsoft-Edge-WebView\eventlog_provider.dll Handle ID: 0x730 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\Microsoft-Edge-WebView\ffmpeg.dll Handle ID: 0x730 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\Microsoft-Edge-WebView\learning_tools.dll Handle ID: 0x730 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\Microsoft-Edge-WebView\libEGL.dll Handle ID: 0x730 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\Microsoft-Edge-WebView\libGLESv2.dll Handle ID: 0x730 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\Microsoft-Edge-WebView\microsoft_shell_integration.dll Handle ID: 0x730 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\Microsoft-Edge-WebView\mip_core.dll Handle ID: 0x730 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\Microsoft-Edge-WebView\mip_core_gn.dll Handle ID: 0x730 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\Microsoft-Edge-WebView\mip_protection_sdk.dll Handle ID: 0x730 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\Microsoft-Edge-WebView\msedge.dll Handle ID: 0x730 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\Microsoft-Edge-WebView\msedge.dll.sig Handle ID: 0x730 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\Microsoft-Edge-WebView\msedge_100_percent.pak Handle ID: 0x730 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\Microsoft-Edge-WebView\msedge_200_percent.pak Handle ID: 0x730 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\Microsoft-Edge-WebView\msedge_elf.dll Handle ID: 0x730 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\Microsoft-Edge-WebView\msedge_wer.dll Handle ID: 0x730 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\Microsoft-Edge-WebView\msedgewebview2.exe Handle ID: 0x730 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\Microsoft-Edge-WebView\msedgewebview2.exe.sig Handle ID: 0x730 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\Microsoft-Edge-WebView\mspdf.dll Handle ID: 0x730 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\Microsoft-Edge-WebView\msvcp140.dll Handle ID: 0x730 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\Microsoft-Edge-WebView\msvcp140_codecvt_ids.dll Handle ID: 0x730 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\Microsoft-Edge-WebView\notification_helper.exe Handle ID: 0x730 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\Microsoft-Edge-WebView\oneauth.dll Handle ID: 0x730 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\Microsoft-Edge-WebView\oneds.dll Handle ID: 0x730 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\Microsoft-Edge-WebView\onnxruntime.dll Handle ID: 0x730 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\Microsoft-Edge-WebView\onramp.dll Handle ID: 0x730 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\Microsoft-Edge-WebView\prefs_enclave_x64.dll Handle ID: 0x730 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\Microsoft-Edge-WebView\resources.pak Handle ID: 0x730 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\Microsoft-Edge-WebView\telclient.dll Handle ID: 0x730 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\Microsoft-Edge-WebView\v8_context_snapshot.bin Handle ID: 0x730 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\Microsoft-Edge-WebView\vccorlib140.dll Handle ID: 0x730 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\Microsoft-Edge-WebView\vcruntime140.dll Handle ID: 0x730 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\Microsoft-Edge-WebView\vcruntime140_1.dll Handle ID: 0x730 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\Microsoft-Edge-WebView\vk_swiftshader.dll Handle ID: 0x730 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\Microsoft-Edge-WebView\vulkan-1.dll Handle ID: 0x730 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\Microsoft-Edge-WebView\wdag.dll Handle ID: 0x730 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\Microsoft-Edge-WebView\webview2_integration.dll Handle ID: 0x730 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\Microsoft-Edge-WebView\wns_push_client.dll Handle ID: 0x730 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\Microsoft-Edge-WebView\EBWebView\x64\EmbeddedBrowserWebView.dll Handle ID: 0x730 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\Microsoft-Edge-WebView\EBWebView\x86\EmbeddedBrowserWebView.dll Handle ID: 0x730 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\Microsoft-Edge-WebView\Locales\af.pak Handle ID: 0x730 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\Microsoft-Edge-WebView\Locales\am.pak Handle ID: 0x730 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\Microsoft-Edge-WebView\Locales\ar.pak Handle ID: 0x730 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\Microsoft-Edge-WebView\Locales\as.pak Handle ID: 0x730 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\Microsoft-Edge-WebView\Locales\az.pak Handle ID: 0x730 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\Microsoft-Edge-WebView\Locales\bg.pak Handle ID: 0x730 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\Microsoft-Edge-WebView\Locales\bn-IN.pak Handle ID: 0x730 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\Microsoft-Edge-WebView\Locales\bs.pak Handle ID: 0x730 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\Microsoft-Edge-WebView\Locales\ca-Es-VALENCIA.pak Handle ID: 0x730 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\Microsoft-Edge-WebView\Locales\ca.pak Handle ID: 0x730 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\Microsoft-Edge-WebView\Locales\cs.pak Handle ID: 0x730 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\Microsoft-Edge-WebView\Locales\cy.pak Handle ID: 0x730 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\Microsoft-Edge-WebView\Locales\da.pak Handle ID: 0x730 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\Microsoft-Edge-WebView\Locales\de.pak Handle ID: 0x730 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\Microsoft-Edge-WebView\Locales\el.pak Handle ID: 0x730 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\Microsoft-Edge-WebView\Locales\en-GB.pak Handle ID: 0x730 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\Microsoft-Edge-WebView\Locales\en-US.pak Handle ID: 0x730 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\Microsoft-Edge-WebView\Locales\es-419.pak Handle ID: 0x730 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\Microsoft-Edge-WebView\Locales\es.pak Handle ID: 0x730 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\Microsoft-Edge-WebView\Locales\et.pak Handle ID: 0x730 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\Microsoft-Edge-WebView\Locales\eu.pak Handle ID: 0x730 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\Microsoft-Edge-WebView\Locales\fa.pak Handle ID: 0x730 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\Microsoft-Edge-WebView\Locales\fi.pak Handle ID: 0x730 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\Microsoft-Edge-WebView\Locales\fil.pak Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\Microsoft-Edge-WebView\Locales\fr-CA.pak Handle ID: 0x730 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\Microsoft-Edge-WebView\Locales\fr.pak Handle ID: 0x730 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\Microsoft-Edge-WebView\Locales\ga.pak Handle ID: 0x730 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\Microsoft-Edge-WebView\Locales\gd.pak Handle ID: 0x730 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\Microsoft-Edge-WebView\Locales\gl.pak Handle ID: 0x730 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\Microsoft-Edge-WebView\Locales\gu.pak Handle ID: 0x730 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\Microsoft-Edge-WebView\Locales\he.pak Handle ID: 0x730 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\Microsoft-Edge-WebView\Locales\hi.pak Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\Microsoft-Edge-WebView\Locales\hr.pak Handle ID: 0x730 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\Microsoft-Edge-WebView\Locales\hu.pak Handle ID: 0x730 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\Microsoft-Edge-WebView\Locales\id.pak Handle ID: 0x730 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\Microsoft-Edge-WebView\Locales\is.pak Handle ID: 0x730 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\Microsoft-Edge-WebView\Locales\it.pak Handle ID: 0x730 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\Microsoft-Edge-WebView\Locales\ja.pak Handle ID: 0x730 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\Microsoft-Edge-WebView\Locales\ka.pak Handle ID: 0x730 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\Microsoft-Edge-WebView\Locales\kk.pak Handle ID: 0x730 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\Microsoft-Edge-WebView\Locales\km.pak Handle ID: 0x730 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\Microsoft-Edge-WebView\Locales\kn.pak Handle ID: 0x730 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\Microsoft-Edge-WebView\Locales\ko.pak Handle ID: 0x730 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\Microsoft-Edge-WebView\Locales\kok.pak Handle ID: 0x730 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\Microsoft-Edge-WebView\Locales\lb.pak Handle ID: 0x730 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\Microsoft-Edge-WebView\Locales\lo.pak Handle ID: 0x730 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\Microsoft-Edge-WebView\Locales\lt.pak Handle ID: 0x730 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\Microsoft-Edge-WebView\Locales\lv.pak Handle ID: 0x730 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\Microsoft-Edge-WebView\Locales\mi.pak Handle ID: 0x730 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\Microsoft-Edge-WebView\Locales\mk.pak Handle ID: 0x730 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\Microsoft-Edge-WebView\Locales\ml.pak Handle ID: 0x730 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\Microsoft-Edge-WebView\Locales\mr.pak Handle ID: 0x730 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\Microsoft-Edge-WebView\Locales\ms.pak Handle ID: 0x730 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\Microsoft-Edge-WebView\Locales\mt.pak Handle ID: 0x730 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\Microsoft-Edge-WebView\Locales\nb.pak Handle ID: 0x730 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\Microsoft-Edge-WebView\Locales\ne.pak Handle ID: 0x730 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\Microsoft-Edge-WebView\Locales\nl.pak Handle ID: 0x730 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\Microsoft-Edge-WebView\Locales\nn.pak Handle ID: 0x730 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:45 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\Microsoft-Edge-WebView\Locales\or.pak Handle ID: 0x730 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\Microsoft-Edge-WebView\Locales\pa.pak Handle ID: 0x730 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\Microsoft-Edge-WebView\Locales\pl.pak Handle ID: 0x730 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\Microsoft-Edge-WebView\Locales\pt-BR.pak Handle ID: 0x730 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\Microsoft-Edge-WebView\Locales\pt-PT.pak Handle ID: 0x730 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\Microsoft-Edge-WebView\Locales\qu.pak Handle ID: 0x730 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\Microsoft-Edge-WebView\Locales\ro.pak Handle ID: 0x730 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\Microsoft-Edge-WebView\Locales\ru.pak Handle ID: 0x730 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\Microsoft-Edge-WebView\Locales\sk.pak Handle ID: 0x730 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\Microsoft-Edge-WebView\Locales\sl.pak Handle ID: 0x730 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\Microsoft-Edge-WebView\Locales\sq.pak Handle ID: 0x730 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\Microsoft-Edge-WebView\Locales\sr-Cyrl-BA.pak Handle ID: 0x730 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\Microsoft-Edge-WebView\Locales\sr-Latn-RS.pak Handle ID: 0x730 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\Microsoft-Edge-WebView\Locales\sr.pak Handle ID: 0x730 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\Microsoft-Edge-WebView\Locales\sv.pak Handle ID: 0x730 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\Microsoft-Edge-WebView\Locales\ta.pak Handle ID: 0x730 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\Microsoft-Edge-WebView\Locales\te.pak Handle ID: 0x730 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\Microsoft-Edge-WebView\Locales\th.pak Handle ID: 0x730 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\Microsoft-Edge-WebView\Locales\tr.pak Handle ID: 0x730 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\Microsoft-Edge-WebView\Locales\tt.pak Handle ID: 0x730 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\Microsoft-Edge-WebView\Locales\ug.pak Handle ID: 0x730 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\Microsoft-Edge-WebView\Locales\uk.pak Handle ID: 0x730 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\Microsoft-Edge-WebView\Locales\ur.pak Handle ID: 0x730 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\Microsoft-Edge-WebView\Locales\vi.pak Handle ID: 0x730 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\Microsoft-Edge-WebView\Locales\zh-CN.pak Handle ID: 0x730 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\Microsoft-Edge-WebView\Locales\zh-TW.pak Handle ID: 0x730 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\Microsoft-Edge-WebView\PdfPreview\PdfPreviewHandler.dll Handle ID: 0x730 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\Microsoft-Edge-WebView\Trust Protection Lists\manifest.json Handle ID: 0x730 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\Microsoft-Edge-WebView\Trust Protection Lists\Mu\Advertising Handle ID: 0x730 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\Microsoft-Edge-WebView\Trust Protection Lists\Mu\Analytics Handle ID: 0x730 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\Microsoft-Edge-WebView\Trust Protection Lists\Mu\Content Handle ID: 0x730 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\Microsoft-Edge-WebView\Trust Protection Lists\Mu\Cryptomining Handle ID: 0x730 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\Microsoft-Edge-WebView\Trust Protection Lists\Mu\Entities Handle ID: 0x730 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\Microsoft-Edge-WebView\Trust Protection Lists\Mu\Fingerprinting Handle ID: 0x730 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\Microsoft-Edge-WebView\Trust Protection Lists\Mu\Social Handle ID: 0x730 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\Microsoft-Edge-WebView\Trust Protection Lists\Sigma\Advertising Handle ID: 0x730 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\Microsoft-Edge-WebView\Trust Protection Lists\Sigma\Analytics Handle ID: 0x730 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\Microsoft-Edge-WebView\Trust Protection Lists\Sigma\Content Handle ID: 0x730 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\Microsoft-Edge-WebView\Trust Protection Lists\Sigma\Entities Handle ID: 0x730 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\Microsoft-Edge-WebView\Trust Protection Lists\Sigma\Fingerprinting Handle ID: 0x730 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\Microsoft-Edge-WebView\Trust Protection Lists\Sigma\Other Handle ID: 0x730 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\Microsoft-Edge-WebView\Trust Protection Lists\Sigma\Social Handle ID: 0x730 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\Microsoft-Edge-WebView\Trust Protection Lists\Sigma\Staging Handle ID: 0x730 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\Microsoft-Edge-WebView\WidevineCdm\_platform_specific\win_x64\widevinecdm.dll Handle ID: 0x730 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\Microsoft-Edge-WebView\WidevineCdm\_platform_specific\win_x64\widevinecdm.dll.sig Handle ID: 0x730 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\migration\APMonPortMig.dll Handle ID: 0x730 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\migration\AppManMigrationPlugin.dll Handle ID: 0x730 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\migration\AppxUpgradeMigrationPlugin.dll Handle ID: 0x730 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\migration\ClipMigPlugin.dll Handle ID: 0x730 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\migration\dafmigplugin.dll Handle ID: 0x730 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\migration\DiskMonMigPlugin.dll Handle ID: 0x730 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\migration\imjpmig.dll Handle ID: 0x730 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\migration\pnpmig.dll Handle ID: 0x730 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\migration\shmig.dll Handle ID: 0x730 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\migration\sppmig.dll Handle ID: 0x730 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\migration\UsbPortMig.dll Handle ID: 0x730 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\migration\VsmKeyMigPlugin.dll Handle ID: 0x730 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\migration\WMIMigrationPlugin.dll Handle ID: 0x730 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\migration\WSearchMigPlugin.dll Handle ID: 0x730 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\migwiz\AppExtAgent.dll Handle ID: 0x730 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\migwiz\cmi2migxml.dll Handle ID: 0x730 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\migwiz\csiagent.dll Handle ID: 0x730 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\migwiz\migapp.dll Handle ID: 0x730 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\migwiz\migcore.dll Handle ID: 0x730 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\migwiz\mighost.exe Handle ID: 0x730 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\migwiz\migres.dll Handle ID: 0x730 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\migwiz\migstore.dll Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\migwiz\MXEAgent.dll Handle ID: 0x730 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\migwiz\USMCommunicationManager.dll Handle ID: 0x730 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\migwiz\dlmanifests\Microsoft-Windows-TextServicesFramework-Migration-DL\imjpmig.dll Handle ID: 0x730 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\migwiz\dlmanifests\Microsoft-Windows-WMI-Core\WMIMigrationPlugin.dll Handle ID: 0x730 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\migwiz\replacementmanifests\microsoft-activedirectory-webservices\adwsmigrate.dll Handle ID: 0x730 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\migwiz\replacementmanifests\Microsoft-Windows-DirectoryServices-ADAM-Client\adammigrate.dll Handle ID: 0x730 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\migwiz\replacementmanifests\Microsoft-Windows-RasApi-Mig\pbkmigr.dll Handle ID: 0x730 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\migwiz\replacementmanifests\Microsoft-Windows-RasServer-MigPlugin\RasMigPlugin.dll Handle ID: 0x730 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\migwiz\replacementmanifests\microsoft-windows-shmig\shmig.dll Handle ID: 0x730 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\migwiz\replacementmanifests\SppMig\SppMig.dll Handle ID: 0x730 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\migwiz\replacementmanifests\WindowsSearchEngine\WSearchMigPlugin.dll Handle ID: 0x730 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\mk-MK\mlang.dll.mui Handle ID: 0x730 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\mk-MK\WWAHost.exe.mui Handle ID: 0x730 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\ml-IN\mlang.dll.mui Handle ID: 0x730 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\ml-IN\WWAHost.exe.mui Handle ID: 0x730 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\mr-IN\mlang.dll.mui Handle ID: 0x730 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\mr-IN\WWAHost.exe.mui Handle ID: 0x730 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\ms-MY\mlang.dll.mui Handle ID: 0x730 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\ms-MY\WWAHost.exe.mui Handle ID: 0x730 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\mt-MT\mlang.dll.mui Handle ID: 0x730 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\mt-MT\WWAHost.exe.mui Handle ID: 0x730 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\nb-NO\mlang.dll.mui Handle ID: 0x730 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\nb-NO\WWAHost.exe.mui Handle ID: 0x730 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\ne-NP\mlang.dll.mui Handle ID: 0x730 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\ne-NP\WWAHost.exe.mui Handle ID: 0x730 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\nl-NL\mlang.dll.mui Handle ID: 0x730 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\nl-NL\WWAHost.exe.mui Handle ID: 0x730 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\nn-NO\mlang.dll.mui Handle ID: 0x730 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\nn-NO\WWAHost.exe.mui Handle ID: 0x730 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\oobe\audit.exe Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\oobe\diagER.dll Handle ID: 0x730 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\oobe\diagnostic.dll Handle ID: 0x730 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\oobe\msoobe.exe Handle ID: 0x730 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\oobe\msoobedui.dll Handle ID: 0x730 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\oobe\msoobeplugins.dll Handle ID: 0x730 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\oobe\msoobewirelessplugin.dll Handle ID: 0x730 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\oobe\oobecoreadapters.dll Handle ID: 0x730 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\oobe\Setup.exe Handle ID: 0x730 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\oobe\spprgrss.dll Handle ID: 0x730 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\oobe\unbcl.dll Handle ID: 0x1868 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\oobe\UserOOBE.dll Handle ID: 0x1868 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\oobe\UserOOBEBroker.exe Handle ID: 0x1868 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\oobe\W32UIImg.dll Handle ID: 0x1868 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\oobe\W32UIRes.dll Handle ID: 0x1868 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\oobe\wdsutil.dll Handle ID: 0x1868 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\oobe\win32ui.dll Handle ID: 0x1868 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\oobe\windeploy.exe Handle ID: 0x1868 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\oobe\WinLGDep.dll Handle ID: 0x1868 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\oobe\winsetup.dll Handle ID: 0x1868 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\or-IN\mlang.dll.mui Handle ID: 0x1868 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\or-IN\WWAHost.exe.mui Handle ID: 0x1868 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\pa-IN\mlang.dll.mui Handle ID: 0x730 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\pa-IN\WWAHost.exe.mui Handle ID: 0x730 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\pl-PL\mlang.dll.mui Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\pl-PL\WWAHost.exe.mui Handle ID: 0x730 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\pt-BR\mlang.dll.mui Handle ID: 0x730 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\pt-BR\WWAHost.exe.mui Handle ID: 0x730 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\pt-PT\mlang.dll.mui Handle ID: 0x730 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\pt-PT\WWAHost.exe.mui Handle ID: 0x730 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\qps-ploc\mlang.dll.mui Handle ID: 0xae8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\qps-ploc\WWAHost.exe.mui Handle ID: 0x74c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\qps-plocm\mlang.dll.mui Handle ID: 0x74c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\qps-plocm\WWAHost.exe.mui Handle ID: 0x74c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\quz-PE\mlang.dll.mui Handle ID: 0x74c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\quz-PE\WWAHost.exe.mui Handle ID: 0x74c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\ro-RO\mlang.dll.mui Handle ID: 0x74c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\ro-RO\WWAHost.exe.mui Handle ID: 0x74c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\ru-RU\mlang.dll.mui Handle ID: 0x74c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\ru-RU\WWAHost.exe.mui Handle ID: 0x74c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\ruxim\ruximics.exe Handle ID: 0x74c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\SecureBootUpdates\BucketConfidenceData.cab Handle ID: 0x74c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\SecureBootUpdates\dbxupdate.bin Handle ID: 0x74c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\SecureBootUpdates\SKUSiPolicy.P7b Handle ID: 0x74c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\setup\msdtcstp.dll Handle ID: 0x74c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\setup\pbkmigr.dll Handle ID: 0x74c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\setup\RasMigPlugin.dll Handle ID: 0x74c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\ShellExperiences\Windows.UI.Shell.SharedUtilities.dll Handle ID: 0x74c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\ShellExperiences\WindowsInternal.Xaml.Controls.Tabs.dll Handle ID: 0x74c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\sk-SK\mlang.dll.mui Handle ID: 0x74c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\sk-SK\WWAHost.exe.mui Handle ID: 0x74c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\sl-SI\mlang.dll.mui Handle ID: 0x74c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\sl-SI\WWAHost.exe.mui Handle ID: 0x74c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\Speech\Common\sapi.dll Handle ID: 0x74c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\Speech\SpeechUX\SpeechUX.dll Handle ID: 0x74c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\Speech_OneCore\common\sapi_extensions.dll Handle ID: 0x74c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\Speech_OneCore\common\sapi_onecore.dll Handle ID: 0x74c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\Speech_OneCore\common\SpeechBrokeredApi.dll Handle ID: 0x74c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\Speech_OneCore\common\SpeechModelDownload.exe Handle ID: 0x74c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\Speech_OneCore\common\SpeechRuntime.exe Handle ID: 0x74c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\Speech_OneCore\common\SpeechServiceWinRTApi.ProxyStub.dll Handle ID: 0x74c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\Speech_OneCore\common\Windows.Speech.Dictation.dll Handle ID: 0x74c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\Speech_OneCore\common\Windows.Speech.Shell.dll Handle ID: 0x74c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\Speech_OneCore\Engines\SR\spsreng_onecore.dll Handle ID: 0x74c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\Speech_OneCore\Engines\TTS\MSTTSEngine_OneCore.dll Handle ID: 0x74c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\Speech_OneCore\Engines\TTS\MSTTSLoc_OneCore.dll Handle ID: 0x74c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\spool\tools\PrintBrm.exe Handle ID: 0x74c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\spool\tools\PrintBrmEngine.exe Handle ID: 0x74c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\spp\tokens\pkeyconfig\pkeyconfig.xrm-ms Handle ID: 0x74c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\spp\tokens\skus\CloudEdition\CloudEdition-ppdlic.xrm-ms Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\spp\tokens\skus\CloudEdition\DefaultPpd-CloudEdition-ppdlic.xrm-ms Handle ID: 0x74c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\spp\tokens\skus\csvlk-pack\DefaultPpd-csvlk-pack-ppdlic.xrm-ms Handle ID: 0x74c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\spp\tokens\skus\Education\DefaultPpd-Education-ppdlic.xrm-ms Handle ID: 0x74c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\spp\tokens\skus\Education\Education-ppdlic.xrm-ms Handle ID: 0x74c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\spp\tokens\skus\Enterprise\DefaultPpd-Enterprise-ppdlic.xrm-ms Handle ID: 0x74c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\spp\tokens\skus\Enterprise\Enterprise-ppdlic.xrm-ms Handle ID: 0x74c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\spp\tokens\skus\IoTEnterprise\DefaultPpd-IoTEnterprise-ppdlic.xrm-ms Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\spp\tokens\skus\IoTEnterprise\IoTEnterprise-ppdlic.xrm-ms Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\spp\tokens\skus\IoTEnterpriseK\DefaultPpd-IoTEnterpriseK-ppdlic.xrm-ms Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\spp\tokens\skus\IoTEnterpriseK\IoTEnterpriseK-ppdlic.xrm-ms Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\spp\tokens\skus\Professional\DefaultPpd-Professional-ppdlic.xrm-ms Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\spp\tokens\skus\Professional\Professional-ppdlic.xrm-ms Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\spp\tokens\skus\ProfessionalCountrySpecific\DefaultPpd-ProfessionalCountrySpecific-ppdlic.xrm-ms Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\spp\tokens\skus\ProfessionalCountrySpecific\ProfessionalCountrySpecific-ppdlic.xrm-ms Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\spp\tokens\skus\ProfessionalEducation\DefaultPpd-ProfessionalEducation-ppdlic.xrm-ms Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\spp\tokens\skus\ProfessionalEducation\ProfessionalEducation-ppdlic.xrm-ms Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\spp\tokens\skus\ProfessionalSingleLanguage\DefaultPpd-ProfessionalSingleLanguage-ppdlic.xrm-ms Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\spp\tokens\skus\ProfessionalSingleLanguage\ProfessionalSingleLanguage-ppdlic.xrm-ms Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\spp\tokens\skus\ProfessionalWorkstation\DefaultPpd-ProfessionalWorkstation-ppdlic.xrm-ms Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\spp\tokens\skus\ProfessionalWorkstation\ProfessionalWorkstation-ppdlic.xrm-ms Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\spp\tokens\skus\ServerRdsh\DefaultPpd-ServerRdsh-ppdlic.xrm-ms Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\spp\tokens\skus\ServerRdsh\ServerRdsh-ppdlic.xrm-ms Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\sq-AL\mlang.dll.mui Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\sq-AL\WWAHost.exe.mui Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\sr-Cyrl-BA\mlang.dll.mui Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\sr-Cyrl-BA\WWAHost.exe.mui Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\sr-Cyrl-RS\mlang.dll.mui Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\sr-Cyrl-RS\WWAHost.exe.mui Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\sr-Latn-RS\mlang.dll.mui Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\sr-Latn-RS\WWAHost.exe.mui Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\sv-SE\mlang.dll.mui Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\sv-SE\WWAHost.exe.mui Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\ta-IN\mlang.dll.mui Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\ta-IN\WWAHost.exe.mui Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\te-IN\mlang.dll.mui Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\te-IN\WWAHost.exe.mui Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\th-TH\mlang.dll.mui Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\th-TH\WWAHost.exe.mui Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\tr-TR\mlang.dll.mui Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\tr-TR\WWAHost.exe.mui Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\tt-RU\mlang.dll.mui Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\tt-RU\WWAHost.exe.mui Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\ug-CN\mlang.dll.mui Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\ug-CN\WWAHost.exe.mui Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\uk-UA\mlang.dll.mui Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\uk-UA\WWAHost.exe.mui Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\ur-PK\mlang.dll.mui Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\ur-PK\WWAHost.exe.mui Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\uz-Latn-UZ\mlang.dll.mui Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\uz-Latn-UZ\WWAHost.exe.mui Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\vi-VN\mlang.dll.mui Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\vi-VN\WWAHost.exe.mui Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\wbem\cimwin32.dll Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\wbem\DMWmiBridgeProv.dll Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\wbem\DMWmiBridgeProv1.dll Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\wbem\esscli.dll Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\wbem\EventTracingManagement.dll Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\wbem\fastprox.dll Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\wbem\Microsoft.Uev.AgentWmi.dll Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\wbem\mofcomp.exe Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\wbem\mofd.dll Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\wbem\msdtcwmi.dll Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\wbem\NCProv.dll Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\wbem\NetAdapterCim.dll Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\wbem\NetEventPacketCapture.dll Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\wbem\NetPeerDistCim.dll Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\wbem\PrintManagementProvider.dll Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\wbem\scrcons.exe Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\wbem\SMTPCons.dll Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\wbem\storagewmi.mof Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\wbem\unsecapp.exe Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\wbem\wbemcons.dll Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\wbem\wbemcore.dll Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\wbem\wbemdisp.dll Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\wbem\wbemprox.dll Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\wbem\wbemsvc.dll Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:46 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\wbem\wfascim.dll Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:47 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\wbem\Win32_EncryptableVolume.dll Handle ID: 0x73c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:47 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\wbem\WinMgmtR.dll Handle ID: 0x1af0 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:47 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\wbem\WMIADAP.exe Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:47 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\wbem\WmiApRes.dll Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:47 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\wbem\WmiApSrv.exe Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:47 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\wbem\WMICOOKR.dll Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:47 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\wbem\WmiPrvSE.exe Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:47 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\wbem\wmiutils.dll Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:47 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\wbem\en-US\storagewmi.mfl Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:47 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\WinBioPlugIns\FaceBootstrapAdapter.dll Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:47 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\WinBioPlugIns\FaceFodUninstaller.exe Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:47 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppvClientComConsumer.dll Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:47 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\Appx\Appx.format.ps1xml Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:47 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\Appx\Microsoft.Windows.Appx.PackageManager.Commands.Core.dll Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:47 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\Appx\en\Appx.psd1 Handle ID: 0x1af0 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:47 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\Appx\en\Microsoft.Windows.Appx.PackageManager.Commands.Core.Resources.dll Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:47 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\Appx\en-US\Appx.psd1 Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:47 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitsTransfer\Microsoft.BackgroundIntelligentTransfer.Management.Interop.dll Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:47 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\Dism\Microsoft.Dism.PowerShell.dll Handle ID: 0x1af0 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:47 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\LAPS\lapspsh.dll Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:47 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\Microsoft.ReFsDedup.Commands\Microsoft.ReFsDedup.Commands.dll Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:47 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\Microsoft.ReFsDedup.Commands\Microsoft.ReFSDedup.Interop.dll Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:47 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\OsConfiguration\Microsoft.Management.OsConfiguration.Commands.dll Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:47 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\Provisioning\provpackageapi.dll Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:47 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\Storage\Storage.types.ps1xml Handle ID: 0x1af0 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:47 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\Storage\StorageScripts.psm1 Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:47 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\Storage\StorageSubSystem.cdxml Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:47 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\Wdac\MSFT_OdbcDriverTask_v1.0.cdxml Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:47 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\Wdac\MSFT_OdbcDsnTask_v1.0.cdxml Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:47 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\Wdac\MSFT_OdbcPerfCounterTask_v1.0.cdxml Handle ID: 0x1af0 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:47 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\Wdac\MSFT_WdacBidTraceTask_v1.0.cdxml Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:47 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\Wdac\Wdac.format.ps1xml Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:47 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\Wdac\Wdac.types.ps1xml Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:47 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\WinMetadata\Windows.AI.winmd Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:47 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\WinMetadata\Windows.ApplicationModel.winmd Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:47 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\WinMetadata\Windows.Data.winmd Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:47 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\WinMetadata\Windows.Devices.winmd Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:47 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\WinMetadata\Windows.Foundation.winmd Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:47 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\WinMetadata\Windows.Gaming.winmd Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:47 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\WinMetadata\Windows.Globalization.winmd Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:47 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\WinMetadata\Windows.Graphics.winmd Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:47 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\WinMetadata\Windows.Management.Setup.winmd Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:47 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\WinMetadata\Windows.Management.winmd Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:47 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\WinMetadata\Windows.Media.winmd Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:47 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\WinMetadata\Windows.Networking.winmd Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:47 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\WinMetadata\Windows.Perception.winmd Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:47 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\WinMetadata\Windows.Security.winmd Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:47 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\WinMetadata\Windows.Services.winmd Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:47 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\WinMetadata\Windows.Storage.winmd Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:47 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\WinMetadata\Windows.System.winmd Handle ID: 0x1af0 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:47 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\WinMetadata\Windows.UI.winmd Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:47 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\WinMetadata\Windows.UI.Xaml.winmd Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:47 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\WinMetadata\Windows.Web.winmd Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:47 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\zh-CN\mlang.dll.mui Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:47 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\zh-CN\WWAHost.exe.mui Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:47 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\zh-TW\mlang.dll.mui Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:47 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\System32\zh-TW\WWAHost.exe.mui Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:47 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\Microsoft.AAD.BrokerPlugin_cw5n1h2txyewy\AAD.Core.dll Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:47 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\Microsoft.AAD.BrokerPlugin_cw5n1h2txyewy\Microsoft.AAD.BrokerPlugin.exe Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:47 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\Microsoft.AAD.BrokerPlugin_cw5n1h2txyewy\Microsoft.AAD.BrokerPlugin.winmd Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:47 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\Microsoft.AAD.BrokerPlugin_cw5n1h2txyewy\resources.pri Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:47 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\Microsoft.AccountsControl_cw5n1h2txyewy\AccountsControlHost.exe Handle ID: 0x1af0 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:47 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\Microsoft.AccountsControl_cw5n1h2txyewy\AccountsControlUI.dll Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:47 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\Microsoft.BioEnrollment_cw5n1h2txyewy\BioEnrollmentUI.dll Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:47 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\Microsoft.BioEnrollment_cw5n1h2txyewy\resources.pri Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:47 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\Microsoft.BioEnrollment_cw5n1h2txyewy\pris\resources.en-US.pri Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:47 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\Microsoft.ECApp_8wekyb3d8bbwe\Microsoft.ECApp.exe Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:47 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\Microsoft.LockApp_cw5n1h2txyewy\AppxBlockMap.xml Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:47 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\Microsoft.LockApp_cw5n1h2txyewy\LockApp.exe Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:47 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\Microsoft.LockApp_cw5n1h2txyewy\LockSearchAPI.dll Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:47 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\Microsoft.LockApp_cw5n1h2txyewy\resources.pri Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:47 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\Microsoft.LockApp_cw5n1h2txyewy\Assets\LockIcons.ttf Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:47 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\Microsoft.LockApp_cw5n1h2txyewy\pris\resources.en-US.pri Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:47 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\Microsoft.Windows.AppResolverUX_cw5n1h2txyewy\AppResolverUX.exe Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:47 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\Microsoft.Windows.CapturePicker_cw5n1h2txyewy\CapturePicker.exe Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:47 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\ApplicationTheme.winmd Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:47 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\CloudDomainJoin.DataModel.winmd Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:47 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\cloudexperiencehostapi.provisioning.winmd Handle ID: 0x73c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:47 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\CloudExperienceHostAPI.SyncSettings.winmd Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:47 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\CloudExperienceHostAPI.winmd Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:47 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\CloudExperienceHostBroker.Account.winmd Handle ID: 0x1af0 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:47 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\CloudExperienceHostBroker.Cortana.winmd Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:47 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\CloudExperienceHostBroker.Hello.winmd Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:47 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\CloudExperienceHostBroker.LocalNgc.winmd Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:47 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\CloudExperienceHostBroker.RetailDemo.winmd Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:47 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\CloudExperienceHostBroker.SyncEngine.winmd Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:47 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\ContentManagement.winmd Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:47 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\enterprisedevicemanagement.enrollment.winmd Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:47 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\Family.Cache.winmd Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:47 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\GuidedSetup.winmd Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:47 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\Microsoft.CloudExperienceHost.dll Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:47 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\microsoft.resourceaccountmanager.winmd Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:47 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\MicrosoftAccount.Extension.winmd Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:47 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\MicrosoftAccount.TokenProvider.dll Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:47 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\MicrosoftAccount.UserOperations.winmd Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:47 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\resources.pri Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:47 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\RetailDemo.Internal.winmd Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:47 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\SystemSettings.DataModel.winmd Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:47 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\UnifiedEnrollment.DataModel.winmd Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:47 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\userdeviceregistration.ngc.winmd Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:47 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\WindowsUdk.winmd Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:47 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\core\js\appLaunchers\OobeDeviceNameCommit.js Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:47 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\core\view\oobe-light-progress-template.html Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:47 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\css\oobe-light.css Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:47 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\data\prod\navigation.json Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:47 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\js\appManager.js Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:47 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\js\environment.js Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:47 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\js\expeditedupdate.js Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:47 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\js\globalization.js Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:47 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\pris\resources.en-US.pri Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:47 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\webapps\inclusiveOobe\js\common\oobe-toggle-vm.js Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:47 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\ContentDeliveryManager.Background.dll Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:47 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\ContentManagementSDK.dll Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:47 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\resources.pri Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:47 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\Microsoft.Windows.FileExplorer_cw5n1h2txyewy\FileExplorer.exe Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:47 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\Microsoft.Windows.FilePicker_cw5n1h2txyewy\FilePicker.exe Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:47 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\Microsoft.Windows.FilePicker_cw5n1h2txyewy\resources.pri Handle ID: 0x1af0 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:47 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\microsoft.windows.narratorquickstart_8wekyb3d8bbwe\NarratorQuickStart.exe Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:47 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\Microsoft.Windows.OOBENetworkCaptivePortal_cw5n1h2txyewy\OOBENetworkCaptivePortal.exe Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:47 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\Microsoft.Windows.OOBENetworkConnectionFlow_cw5n1h2txyewy\AppxBlockMap.xml Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:47 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\Microsoft.Windows.OOBENetworkConnectionFlow_cw5n1h2txyewy\AppxManifest.xml Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:47 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\Microsoft.Windows.OOBENetworkConnectionFlow_cw5n1h2txyewy\AppxSignature.p7x Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:47 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\Microsoft.Windows.OOBENetworkConnectionFlow_cw5n1h2txyewy\OOBENetworkConnectionFlow.exe Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:47 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\Microsoft.Windows.OOBENetworkConnectionFlow_cw5n1h2txyewy\OOBENetworkConnectionFlowExtensions.dll Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:47 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\Microsoft.Windows.OOBENetworkConnectionFlow_cw5n1h2txyewy\resources.pri Handle ID: 0x1af0 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:47 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\Microsoft.Windows.OOBENetworkConnectionFlow_cw5n1h2txyewy\pris\resources.en-US.pri Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:47 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\Microsoft.Windows.PeopleExperienceHost_cw5n1h2txyewy\PeopleExperienceHost.exe Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:47 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\Microsoft.Windows.PeopleExperienceHost_cw5n1h2txyewy\resources.pri Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:47 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\Microsoft.Windows.PinningConfirmationDialog_cw5n1h2txyewy\PinningConfirmationDialog.exe Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:47 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\Microsoft.Windows.PrintQueueActionCenter_cw5n1h2txyewy\PrintQueueActionCenter.exe Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:47 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\Microsoft.Windows.PrintQueueActionCenter_cw5n1h2txyewy\resources.pri Handle ID: 0x1af0 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:47 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\Microsoft.Windows.PrintQueueActionCenter_cw5n1h2txyewy\pris\resources.en-US.pri Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:47 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\Microsoft.Windows.SecureAssessmentBrowser_cw5n1h2txyewy\resources.pri Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:47 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\Microsoft.Windows.SecureAssessmentBrowser_cw5n1h2txyewy\pris\resources.de-DE.pri Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:47 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\Microsoft.Windows.SecureAssessmentBrowser_cw5n1h2txyewy\pris\resources.el-GR.pri Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:47 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\Microsoft.Windows.SecureAssessmentBrowser_cw5n1h2txyewy\pris\resources.it-IT.pri Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:47 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\Microsoft.Windows.SecureAssessmentBrowser_cw5n1h2txyewy\pris\resources.nl-NL.pri Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:47 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\Microsoft.Windows.SecureAssessmentBrowser_cw5n1h2txyewy\pris\resources.pt-BR.pri Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:47 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\Microsoft.Windows.SecureAssessmentBrowser_cw5n1h2txyewy\pris\resources.tr-TR.pri Handle ID: 0x1af0 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:47 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\Microsoft.Windows.SecureAssessmentBrowser_cw5n1h2txyewy\pris\resources.zh-TW.pri Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:47 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartDocked.dll Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:47 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe Handle ID: 0x73c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:47 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\Microsoft.WindowsAppRuntime.CBS_8wekyb3d8bbwe\AppxBlockMap.xml Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:47 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\Microsoft.WindowsAppRuntime.CBS_8wekyb3d8bbwe\AppxManifest.xml Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:47 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\Microsoft.WindowsAppRuntime.CBS_8wekyb3d8bbwe\AppxSignature.p7x Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:47 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\Microsoft.WindowsAppRuntime.CBS_8wekyb3d8bbwe\CoPilotLibraryBroker.exe Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:47 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\Microsoft.WindowsAppRuntime.CBS_8wekyb3d8bbwe\CoreMessagingXP.dll Handle ID: 0x1af0 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:47 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\Microsoft.WindowsAppRuntime.CBS_8wekyb3d8bbwe\dcompi.dll Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:47 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\Microsoft.WindowsAppRuntime.CBS_8wekyb3d8bbwe\DeploymentAgent.exe Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:47 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\Microsoft.WindowsAppRuntime.CBS_8wekyb3d8bbwe\dwmcorei.dll Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:47 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\Microsoft.WindowsAppRuntime.CBS_8wekyb3d8bbwe\DwmSceneI.dll Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:47 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\Microsoft.WindowsAppRuntime.CBS_8wekyb3d8bbwe\DWriteCore.dll Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:47 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\Microsoft.WindowsAppRuntime.CBS_8wekyb3d8bbwe\EventLog-Instrumentation.man Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:47 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\Microsoft.WindowsAppRuntime.CBS_8wekyb3d8bbwe\marshal.dll Handle ID: 0x1af0 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:47 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\Microsoft.WindowsAppRuntime.CBS_8wekyb3d8bbwe\Microsoft.Asg.SemanticIndex.AiFabric.Compatibility.dll Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:47 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\Microsoft.WindowsAppRuntime.CBS_8wekyb3d8bbwe\Microsoft.DirectManipulation.dll Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:47 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\Microsoft.WindowsAppRuntime.CBS_8wekyb3d8bbwe\Microsoft.Foundation.winmd Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:47 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\Microsoft.WindowsAppRuntime.CBS_8wekyb3d8bbwe\Microsoft.Graphics.Display.dll Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:47 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\Microsoft.WindowsAppRuntime.CBS_8wekyb3d8bbwe\Microsoft.Graphics.Imaging.dll Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:47 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\Microsoft.WindowsAppRuntime.CBS_8wekyb3d8bbwe\Microsoft.Graphics.Imaging.winmd Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:47 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\Microsoft.WindowsAppRuntime.CBS_8wekyb3d8bbwe\Microsoft.Graphics.ImagingInternal.winmd Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:47 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\Microsoft.WindowsAppRuntime.CBS_8wekyb3d8bbwe\Microsoft.Graphics.winmd Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:47 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\Microsoft.WindowsAppRuntime.CBS_8wekyb3d8bbwe\Microsoft.InputStateManager.dll Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:47 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\Microsoft.WindowsAppRuntime.CBS_8wekyb3d8bbwe\Microsoft.Internal.FrameworkUdk.CBS.dll Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:47 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\Microsoft.WindowsAppRuntime.CBS_8wekyb3d8bbwe\Microsoft.Internal.FrameworkUdk.dll Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:47 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\Microsoft.WindowsAppRuntime.CBS_8wekyb3d8bbwe\Microsoft.UI.Composition.OSSupport.dll Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:47 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\Microsoft.WindowsAppRuntime.CBS_8wekyb3d8bbwe\Microsoft.UI.dll Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:47 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\Microsoft.WindowsAppRuntime.CBS_8wekyb3d8bbwe\Microsoft.UI.Input.dll Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:47 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\Microsoft.WindowsAppRuntime.CBS_8wekyb3d8bbwe\Microsoft.UI.pri Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:47 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\Microsoft.WindowsAppRuntime.CBS_8wekyb3d8bbwe\Microsoft.UI.Text.winmd Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:47 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\Microsoft.WindowsAppRuntime.CBS_8wekyb3d8bbwe\Microsoft.UI.Windowing.Core.dll Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:47 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\Microsoft.WindowsAppRuntime.CBS_8wekyb3d8bbwe\Microsoft.UI.Windowing.dll Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:47 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\Microsoft.WindowsAppRuntime.CBS_8wekyb3d8bbwe\Microsoft.UI.winmd Handle ID: 0x1af0 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:47 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\Microsoft.WindowsAppRuntime.CBS_8wekyb3d8bbwe\Microsoft.UI.Xaml.Controls.dll Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:47 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\Microsoft.WindowsAppRuntime.CBS_8wekyb3d8bbwe\Microsoft.UI.Xaml.Controls.pri Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:47 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\Microsoft.WindowsAppRuntime.CBS_8wekyb3d8bbwe\Microsoft.ui.xaml.dll Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:47 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\Microsoft.WindowsAppRuntime.CBS_8wekyb3d8bbwe\Microsoft.UI.Xaml.Internal.dll Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:47 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\Microsoft.WindowsAppRuntime.CBS_8wekyb3d8bbwe\Microsoft.UI.Xaml.Phone.dll Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:47 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\Microsoft.WindowsAppRuntime.CBS_8wekyb3d8bbwe\Microsoft.ui.xaml.resources.19h1.dll Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:47 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\Microsoft.WindowsAppRuntime.CBS_8wekyb3d8bbwe\Microsoft.ui.xaml.resources.common.dll Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:47 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\Microsoft.WindowsAppRuntime.CBS_8wekyb3d8bbwe\Microsoft.UI.Xaml.winmd Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:47 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\Microsoft.WindowsAppRuntime.CBS_8wekyb3d8bbwe\Microsoft.Windows.AI.ContentModeration.dll Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:47 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\Microsoft.WindowsAppRuntime.CBS_8wekyb3d8bbwe\Microsoft.Windows.AI.ContentModeration.winmd Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:47 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\Microsoft.WindowsAppRuntime.CBS_8wekyb3d8bbwe\Microsoft.Windows.AI.ContentModerationInternal.winmd Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:47 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\Microsoft.WindowsAppRuntime.CBS_8wekyb3d8bbwe\Microsoft.Windows.AI.Generative.dll Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:47 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\Microsoft.WindowsAppRuntime.CBS_8wekyb3d8bbwe\Microsoft.Windows.AI.Generative.winmd Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:47 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\Microsoft.WindowsAppRuntime.CBS_8wekyb3d8bbwe\Microsoft.Windows.AI.GenerativeInternal.winmd Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:47 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\Microsoft.WindowsAppRuntime.CBS_8wekyb3d8bbwe\Microsoft.Windows.ApplicationModel.DynamicDependency.winmd Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:47 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\Microsoft.WindowsAppRuntime.CBS_8wekyb3d8bbwe\Microsoft.Windows.ApplicationModel.Resources.dll Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:47 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\Microsoft.WindowsAppRuntime.CBS_8wekyb3d8bbwe\Microsoft.Windows.ApplicationModel.Resources.winmd Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:47 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\Microsoft.WindowsAppRuntime.CBS_8wekyb3d8bbwe\Microsoft.Windows.ApplicationModel.WindowsAppRuntime.winmd Handle ID: 0x1af0 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:47 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\Microsoft.WindowsAppRuntime.CBS_8wekyb3d8bbwe\Microsoft.Windows.AppLifecycle.winmd Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:47 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\Microsoft.WindowsAppRuntime.CBS_8wekyb3d8bbwe\Microsoft.Windows.AppNotifications.Builder.winmd Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:47 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\Microsoft.WindowsAppRuntime.CBS_8wekyb3d8bbwe\Microsoft.Windows.AppNotifications.winmd Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:47 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\Microsoft.WindowsAppRuntime.CBS_8wekyb3d8bbwe\Microsoft.Windows.Globalization.winmd Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:47 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\Microsoft.WindowsAppRuntime.CBS_8wekyb3d8bbwe\Microsoft.Windows.ImageCreationInternal.winmd Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:47 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\Microsoft.WindowsAppRuntime.CBS_8wekyb3d8bbwe\Microsoft.Windows.Imaging.winmd Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:47 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\Microsoft.WindowsAppRuntime.CBS_8wekyb3d8bbwe\Microsoft.Windows.Internal.SessionMock.winmd Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:47 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\Microsoft.WindowsAppRuntime.CBS_8wekyb3d8bbwe\Microsoft.Windows.Management.Deployment.winmd Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:47 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\Microsoft.WindowsAppRuntime.CBS_8wekyb3d8bbwe\Microsoft.Windows.Private.CacheManagement.dll Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:47 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\Microsoft.WindowsAppRuntime.CBS_8wekyb3d8bbwe\Microsoft.Windows.Private.CacheManagement.pri Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:47 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\Microsoft.WindowsAppRuntime.CBS_8wekyb3d8bbwe\Microsoft.Windows.Private.CacheManagement.winmd Handle ID: 0x1af0 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:47 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\Microsoft.WindowsAppRuntime.CBS_8wekyb3d8bbwe\Microsoft.Windows.Private.Workloads.SessionHost.winmd Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:47 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\Microsoft.WindowsAppRuntime.CBS_8wekyb3d8bbwe\Microsoft.Windows.Private.Workloads.SessionManager.winmd Handle ID: 0x1af0 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:47 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\Microsoft.WindowsAppRuntime.CBS_8wekyb3d8bbwe\Microsoft.Windows.PrivateCommon.dll Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:47 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\Microsoft.WindowsAppRuntime.CBS_8wekyb3d8bbwe\Microsoft.Windows.PrivateCommon.winmd Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:47 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\Microsoft.WindowsAppRuntime.CBS_8wekyb3d8bbwe\Microsoft.Windows.PushNotifications.winmd Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:47 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\Microsoft.WindowsAppRuntime.CBS_8wekyb3d8bbwe\Microsoft.Windows.Security.AccessControl.winmd Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:47 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\Microsoft.WindowsAppRuntime.CBS_8wekyb3d8bbwe\Microsoft.Windows.SemanticSearch.winmd Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:47 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\Microsoft.WindowsAppRuntime.CBS_8wekyb3d8bbwe\Microsoft.Windows.SemanticSearchInternal.winmd Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:47 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\Microsoft.WindowsAppRuntime.CBS_8wekyb3d8bbwe\Microsoft.Windows.Storage.winmd Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:47 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\Microsoft.WindowsAppRuntime.CBS_8wekyb3d8bbwe\Microsoft.Windows.System.Power.winmd Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:47 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\Microsoft.WindowsAppRuntime.CBS_8wekyb3d8bbwe\Microsoft.Windows.System.winmd Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:47 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\Microsoft.WindowsAppRuntime.CBS_8wekyb3d8bbwe\Microsoft.Windows.Vision.dll Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:47 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\Microsoft.WindowsAppRuntime.CBS_8wekyb3d8bbwe\Microsoft.Windows.Vision.winmd Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:47 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\Microsoft.WindowsAppRuntime.CBS_8wekyb3d8bbwe\Microsoft.Windows.VisionInternal.winmd Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:47 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\Microsoft.WindowsAppRuntime.CBS_8wekyb3d8bbwe\Microsoft.Windows.Widgets.dll Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:47 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\Microsoft.WindowsAppRuntime.CBS_8wekyb3d8bbwe\Microsoft.Windows.Widgets.winmd Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:47 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\Microsoft.WindowsAppRuntime.CBS_8wekyb3d8bbwe\Microsoft.Windows.Workloads.dll Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:47 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\Microsoft.WindowsAppRuntime.CBS_8wekyb3d8bbwe\Microsoft.Windows.Workloads.pri Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:47 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\Microsoft.WindowsAppRuntime.CBS_8wekyb3d8bbwe\Microsoft.Windows.Workloads.Resources.dll Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:47 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\Microsoft.WindowsAppRuntime.CBS_8wekyb3d8bbwe\Microsoft.Windows.Workloads.Resources_ec.dll Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:47 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\Microsoft.WindowsAppRuntime.CBS_8wekyb3d8bbwe\Microsoft.Windows.Workloads.winmd Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:47 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\Microsoft.WindowsAppRuntime.CBS_8wekyb3d8bbwe\Microsoft.WindowsAppRuntime.dll Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:47 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\Microsoft.WindowsAppRuntime.CBS_8wekyb3d8bbwe\Microsoft.WindowsAppRuntime.Insights.Resource.dll Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:47 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\Microsoft.WindowsAppRuntime.CBS_8wekyb3d8bbwe\MRM.dll Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:47 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\Microsoft.WindowsAppRuntime.CBS_8wekyb3d8bbwe\PushNotificationsLongRunningTask.ProxyStub.dll Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:47 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\Microsoft.WindowsAppRuntime.CBS_8wekyb3d8bbwe\resources.pri Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:47 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\Microsoft.WindowsAppRuntime.CBS_8wekyb3d8bbwe\RestartAgent.exe Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:47 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\Microsoft.WindowsAppRuntime.CBS_8wekyb3d8bbwe\SemanticSearch.CBS.dll Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:47 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\Microsoft.WindowsAppRuntime.CBS_8wekyb3d8bbwe\SemanticSearch.Public.dll Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:47 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\Microsoft.WindowsAppRuntime.CBS_8wekyb3d8bbwe\SessionHandleIPCProxyStub.dll Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:47 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\Microsoft.WindowsAppRuntime.CBS_8wekyb3d8bbwe\SessionManagerBrokerProxyStub.dll Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:47 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\Microsoft.WindowsAppRuntime.CBS_8wekyb3d8bbwe\WindowsAppRuntime.DeploymentExtensions.OneCore.dll Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:47 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\Microsoft.WindowsAppRuntime.CBS_8wekyb3d8bbwe\WindowsAppRuntime.png Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:47 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\Microsoft.WindowsAppRuntime.CBS_8wekyb3d8bbwe\WindowsAppSdk.AppxDeploymentExtensions.Desktop-EventLog-Instrumentation.dll Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:47 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\Microsoft.WindowsAppRuntime.CBS_8wekyb3d8bbwe\WinUIEdit.dll Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:47 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\Microsoft.WindowsAppRuntime.CBS_8wekyb3d8bbwe\workloads.365.json Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:47 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\Microsoft.WindowsAppRuntime.CBS_8wekyb3d8bbwe\workloads.j32.json Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:47 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\Microsoft.WindowsAppRuntime.CBS_8wekyb3d8bbwe\workloads.json Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:47 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\Microsoft.WindowsAppRuntime.CBS_8wekyb3d8bbwe\workloads.lnl.json Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:47 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\Microsoft.WindowsAppRuntime.CBS_8wekyb3d8bbwe\workloads.qnn.json Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:47 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\Microsoft.WindowsAppRuntime.CBS_8wekyb3d8bbwe\workloads.stx.json Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:47 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\Microsoft.WindowsAppRuntime.CBS_8wekyb3d8bbwe\wuceffectsi.dll Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:47 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\Microsoft.WindowsAppRuntime.CBS_8wekyb3d8bbwe\AppxMetadata\CodeIntegrity.cat Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:47 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\Microsoft.WindowsAppRuntime.CBS_8wekyb3d8bbwe\en-US\Microsoft.ui.xaml.dll.mui Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:47 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\Microsoft.WindowsAppRuntime.CBS_8wekyb3d8bbwe\en-US\Microsoft.UI.Xaml.Phone.dll.mui Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:47 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\Microsoft.WindowsAppRuntime.CBS_8wekyb3d8bbwe\Microsoft.UI.Xaml\Assets\map.html Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:47 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\Microsoft.WindowsAppRuntime.CBS_8wekyb3d8bbwe\Microsoft.UI.Xaml\Assets\NoiseAsset_256x256_PNG.png Handle ID: 0x1af0 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:47 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\Microsoft.WindowsAppRuntime.CBS_8wekyb3d8bbwe\NpuDetect\NPUDetect.dll Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:47 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\Microsoft.WindowsAppRuntime.vNext.CBS_8wekyb3d8bbwe\AppxBlockMap.xml Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:47 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\Microsoft.WindowsAppRuntime.vNext.CBS_8wekyb3d8bbwe\AppxManifest.xml Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:47 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\Microsoft.WindowsAppRuntime.vNext.CBS_8wekyb3d8bbwe\AppxSignature.p7x Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:47 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\Microsoft.WindowsAppRuntime.vNext.CBS_8wekyb3d8bbwe\CoPilotLibraryBroker.exe Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:47 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\Microsoft.WindowsAppRuntime.vNext.CBS_8wekyb3d8bbwe\CoreMessagingXP.dll Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:47 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\Microsoft.WindowsAppRuntime.vNext.CBS_8wekyb3d8bbwe\dcompi.dll Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:47 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\Microsoft.WindowsAppRuntime.vNext.CBS_8wekyb3d8bbwe\DeploymentAgent.exe Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:47 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\Microsoft.WindowsAppRuntime.vNext.CBS_8wekyb3d8bbwe\DirectML.dll Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:47 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\Microsoft.WindowsAppRuntime.vNext.CBS_8wekyb3d8bbwe\dwmcorei.dll Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:47 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\Microsoft.WindowsAppRuntime.vNext.CBS_8wekyb3d8bbwe\DwmSceneI.dll Handle ID: 0x1b9c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:47 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\Microsoft.WindowsAppRuntime.vNext.CBS_8wekyb3d8bbwe\DWriteCore.dll Handle ID: 0x1b9c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:47 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\Microsoft.WindowsAppRuntime.vNext.CBS_8wekyb3d8bbwe\InternalApi.winmd Handle ID: 0x1b9c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:47 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\Microsoft.WindowsAppRuntime.vNext.CBS_8wekyb3d8bbwe\marshal.dll Handle ID: 0x1b9c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:47 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\Microsoft.WindowsAppRuntime.vNext.CBS_8wekyb3d8bbwe\Microsoft.Asg.SemanticIndex.AiFabric.Compatibility.dll Handle ID: 0x1b9c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:47 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\Microsoft.WindowsAppRuntime.vNext.CBS_8wekyb3d8bbwe\Microsoft.DirectManipulation.dll Handle ID: 0x1b9c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:47 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\Microsoft.WindowsAppRuntime.vNext.CBS_8wekyb3d8bbwe\Microsoft.Foundation.winmd Handle ID: 0x1b9c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:47 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\Microsoft.WindowsAppRuntime.vNext.CBS_8wekyb3d8bbwe\Microsoft.Graphics.Display.dll Handle ID: 0x1b9c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:47 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\Microsoft.WindowsAppRuntime.vNext.CBS_8wekyb3d8bbwe\Microsoft.Graphics.Imaging.dll Handle ID: 0x1b9c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:47 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\Microsoft.WindowsAppRuntime.vNext.CBS_8wekyb3d8bbwe\Microsoft.Graphics.Imaging.winmd Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:47 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\Microsoft.WindowsAppRuntime.vNext.CBS_8wekyb3d8bbwe\Microsoft.Graphics.ImagingInternal.ImageObjectRemover.winmd Handle ID: 0x1b9c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:47 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\Microsoft.WindowsAppRuntime.vNext.CBS_8wekyb3d8bbwe\Microsoft.Graphics.ImagingInternal.winmd Handle ID: 0x1b9c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:47 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\Microsoft.WindowsAppRuntime.vNext.CBS_8wekyb3d8bbwe\Microsoft.Graphics.Internal.Imaging.winmd Handle ID: 0x1b9c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\Microsoft.WindowsAppRuntime.vNext.CBS_8wekyb3d8bbwe\Microsoft.Graphics.winmd Handle ID: 0x1b9c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\Microsoft.WindowsAppRuntime.vNext.CBS_8wekyb3d8bbwe\Microsoft.InputStateManager.dll Handle ID: 0x1b9c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\Microsoft.WindowsAppRuntime.vNext.CBS_8wekyb3d8bbwe\Microsoft.Internal.FrameworkUdk.CBS.dll Handle ID: 0x1b9c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\Microsoft.WindowsAppRuntime.vNext.CBS_8wekyb3d8bbwe\Microsoft.Internal.FrameworkUdk.dll Handle ID: 0x1b9c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\Microsoft.WindowsAppRuntime.vNext.CBS_8wekyb3d8bbwe\Microsoft.Security.Authentication.OAuth.winmd Handle ID: 0x1b9c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\Microsoft.WindowsAppRuntime.vNext.CBS_8wekyb3d8bbwe\Microsoft.UI.Composition.OSSupport.dll Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\Microsoft.WindowsAppRuntime.vNext.CBS_8wekyb3d8bbwe\Microsoft.UI.Designer.dll Handle ID: 0x1b9c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\Microsoft.WindowsAppRuntime.vNext.CBS_8wekyb3d8bbwe\Microsoft.UI.dll Handle ID: 0x1b9c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\Microsoft.WindowsAppRuntime.vNext.CBS_8wekyb3d8bbwe\Microsoft.UI.Input.dll Handle ID: 0x1b9c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\Microsoft.WindowsAppRuntime.vNext.CBS_8wekyb3d8bbwe\Microsoft.UI.pri Handle ID: 0x1b9c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\Microsoft.WindowsAppRuntime.vNext.CBS_8wekyb3d8bbwe\Microsoft.UI.Text.winmd Handle ID: 0x1b9c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\Microsoft.WindowsAppRuntime.vNext.CBS_8wekyb3d8bbwe\Microsoft.UI.Windowing.Core.dll Handle ID: 0x1b9c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\Microsoft.WindowsAppRuntime.vNext.CBS_8wekyb3d8bbwe\Microsoft.UI.Windowing.dll Handle ID: 0x1b9c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\Microsoft.WindowsAppRuntime.vNext.CBS_8wekyb3d8bbwe\Microsoft.UI.winmd Handle ID: 0x1b9c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\Microsoft.WindowsAppRuntime.vNext.CBS_8wekyb3d8bbwe\Microsoft.UI.Xaml.Controls.dll Handle ID: 0x1b9c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\Microsoft.WindowsAppRuntime.vNext.CBS_8wekyb3d8bbwe\Microsoft.UI.Xaml.Controls.pri Handle ID: 0x1b9c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\Microsoft.WindowsAppRuntime.vNext.CBS_8wekyb3d8bbwe\Microsoft.ui.xaml.dll Handle ID: 0x1b9c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\Microsoft.WindowsAppRuntime.vNext.CBS_8wekyb3d8bbwe\Microsoft.UI.Xaml.Internal.dll Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\Microsoft.WindowsAppRuntime.vNext.CBS_8wekyb3d8bbwe\Microsoft.UI.Xaml.Phone.dll Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\Microsoft.WindowsAppRuntime.vNext.CBS_8wekyb3d8bbwe\Microsoft.ui.xaml.resources.19h1.dll Handle ID: 0x1b9c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\Microsoft.WindowsAppRuntime.vNext.CBS_8wekyb3d8bbwe\Microsoft.ui.xaml.resources.common.dll Handle ID: 0x1b9c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\Microsoft.WindowsAppRuntime.vNext.CBS_8wekyb3d8bbwe\Microsoft.UI.Xaml.winmd Handle ID: 0x1b9c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\Microsoft.WindowsAppRuntime.vNext.CBS_8wekyb3d8bbwe\Microsoft.Windows.AI.ContentModerationInternal.winmd Handle ID: 0x1b9c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\Microsoft.WindowsAppRuntime.vNext.CBS_8wekyb3d8bbwe\Microsoft.Windows.AI.ContentSafety.dll Handle ID: 0x1b9c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\Microsoft.WindowsAppRuntime.vNext.CBS_8wekyb3d8bbwe\Microsoft.Windows.AI.ContentSafety.winmd Handle ID: 0x1b9c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\Microsoft.WindowsAppRuntime.vNext.CBS_8wekyb3d8bbwe\Microsoft.Windows.AI.Foundation.winmd Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\Microsoft.WindowsAppRuntime.vNext.CBS_8wekyb3d8bbwe\Microsoft.Windows.AI.FoundationInternal.winmd Handle ID: 0x1b9c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\Microsoft.WindowsAppRuntime.vNext.CBS_8wekyb3d8bbwe\Microsoft.Windows.AI.GenerativeInternal.winmd Handle ID: 0x1b9c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\Microsoft.WindowsAppRuntime.vNext.CBS_8wekyb3d8bbwe\Microsoft.Windows.AI.Imaging.dll Handle ID: 0x1b9c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\Microsoft.WindowsAppRuntime.vNext.CBS_8wekyb3d8bbwe\Microsoft.Windows.AI.Imaging.ImageGenerator.dll Handle ID: 0x1b9c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\Microsoft.WindowsAppRuntime.vNext.CBS_8wekyb3d8bbwe\Microsoft.Windows.AI.Imaging.ImageGenerator.winmd Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\Microsoft.WindowsAppRuntime.vNext.CBS_8wekyb3d8bbwe\Microsoft.Windows.AI.Imaging.winmd Handle ID: 0x1b9c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\Microsoft.WindowsAppRuntime.vNext.CBS_8wekyb3d8bbwe\Microsoft.Windows.AI.MachineLearning.dll Handle ID: 0x1b9c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\Microsoft.WindowsAppRuntime.vNext.CBS_8wekyb3d8bbwe\Microsoft.Windows.AI.MachineLearning.winmd Handle ID: 0x1b9c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\Microsoft.WindowsAppRuntime.vNext.CBS_8wekyb3d8bbwe\Microsoft.Windows.AI.Search.Experimental.dll Handle ID: 0x1b9c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\Microsoft.WindowsAppRuntime.vNext.CBS_8wekyb3d8bbwe\Microsoft.Windows.AI.Search.Experimental.Internal.winmd Handle ID: 0x1b9c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\Microsoft.WindowsAppRuntime.vNext.CBS_8wekyb3d8bbwe\Microsoft.Windows.AI.Search.Experimental.winmd Handle ID: 0x1b9c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\Microsoft.WindowsAppRuntime.vNext.CBS_8wekyb3d8bbwe\Microsoft.Windows.AI.Text.dll Handle ID: 0x1b9c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\Microsoft.WindowsAppRuntime.vNext.CBS_8wekyb3d8bbwe\Microsoft.Windows.AI.Text.winmd Handle ID: 0x1b9c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\Microsoft.WindowsAppRuntime.vNext.CBS_8wekyb3d8bbwe\Microsoft.Windows.AI.winmd Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\Microsoft.WindowsAppRuntime.vNext.CBS_8wekyb3d8bbwe\Microsoft.Windows.ApplicationModel.Background.UniversalBGTask.winmd Handle ID: 0x1b9c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\Microsoft.WindowsAppRuntime.vNext.CBS_8wekyb3d8bbwe\Microsoft.Windows.ApplicationModel.Background.winmd Handle ID: 0x1b9c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\Microsoft.WindowsAppRuntime.vNext.CBS_8wekyb3d8bbwe\Microsoft.Windows.ApplicationModel.DynamicDependency.winmd Handle ID: 0x1b9c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\Microsoft.WindowsAppRuntime.vNext.CBS_8wekyb3d8bbwe\Microsoft.Windows.ApplicationModel.Resources.dll Handle ID: 0x1b9c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\Microsoft.WindowsAppRuntime.vNext.CBS_8wekyb3d8bbwe\Microsoft.Windows.ApplicationModel.Resources.winmd Handle ID: 0x1b9c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\Microsoft.WindowsAppRuntime.vNext.CBS_8wekyb3d8bbwe\Microsoft.Windows.ApplicationModel.WindowsAppRuntime.winmd Handle ID: 0x1b9c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\Microsoft.WindowsAppRuntime.vNext.CBS_8wekyb3d8bbwe\Microsoft.Windows.AppLifecycle.winmd Handle ID: 0x1b9c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\Microsoft.WindowsAppRuntime.vNext.CBS_8wekyb3d8bbwe\Microsoft.Windows.AppNotifications.Builder.winmd Handle ID: 0x1b9c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\Microsoft.WindowsAppRuntime.vNext.CBS_8wekyb3d8bbwe\Microsoft.Windows.AppNotifications.winmd Handle ID: 0x1b9c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\Microsoft.WindowsAppRuntime.vNext.CBS_8wekyb3d8bbwe\Microsoft.Windows.BadgeNotifications.winmd Handle ID: 0x1b9c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\Microsoft.WindowsAppRuntime.vNext.CBS_8wekyb3d8bbwe\Microsoft.Windows.Foundation.winmd Handle ID: 0x1b9c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\Microsoft.WindowsAppRuntime.vNext.CBS_8wekyb3d8bbwe\Microsoft.Windows.Globalization.winmd Handle ID: 0x1b9c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\Microsoft.WindowsAppRuntime.vNext.CBS_8wekyb3d8bbwe\Microsoft.Windows.ImageCreationInternal.winmd Handle ID: 0x1b9c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\Microsoft.WindowsAppRuntime.vNext.CBS_8wekyb3d8bbwe\Microsoft.Windows.Internal.AI.ContentModeration.winmd Handle ID: 0x1b9c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\Microsoft.WindowsAppRuntime.vNext.CBS_8wekyb3d8bbwe\Microsoft.Windows.Internal.ImageCreation.winmd Handle ID: 0x1b9c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\Microsoft.WindowsAppRuntime.vNext.CBS_8wekyb3d8bbwe\Microsoft.Windows.Internal.SessionMock.winmd Handle ID: 0x1b9c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\Microsoft.WindowsAppRuntime.vNext.CBS_8wekyb3d8bbwe\Microsoft.Windows.Internal.Vision.winmd Handle ID: 0x1b9c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\Microsoft.WindowsAppRuntime.vNext.CBS_8wekyb3d8bbwe\Microsoft.Windows.Management.Deployment.winmd Handle ID: 0x1b9c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\Microsoft.WindowsAppRuntime.vNext.CBS_8wekyb3d8bbwe\Microsoft.Windows.Media.Capture.winmd Handle ID: 0x1b9c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\Microsoft.WindowsAppRuntime.vNext.CBS_8wekyb3d8bbwe\Microsoft.Windows.Private.CacheManagement.dll Handle ID: 0x1b9c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\Microsoft.WindowsAppRuntime.vNext.CBS_8wekyb3d8bbwe\Microsoft.Windows.Private.CacheManagement.winmd Handle ID: 0x1b9c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\Microsoft.WindowsAppRuntime.vNext.CBS_8wekyb3d8bbwe\Microsoft.Windows.Private.Workloads.SessionHost.winmd Handle ID: 0x1b9c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\Microsoft.WindowsAppRuntime.vNext.CBS_8wekyb3d8bbwe\Microsoft.Windows.Private.Workloads.SessionManager.winmd Handle ID: 0x1b9c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\Microsoft.WindowsAppRuntime.vNext.CBS_8wekyb3d8bbwe\Microsoft.Windows.PrivateCommon.dll Handle ID: 0x1b9c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\Microsoft.WindowsAppRuntime.vNext.CBS_8wekyb3d8bbwe\Microsoft.Windows.PrivateCommon.winmd Handle ID: 0x1b9c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\Microsoft.WindowsAppRuntime.vNext.CBS_8wekyb3d8bbwe\Microsoft.Windows.PushNotifications.winmd Handle ID: 0x1b9c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\Microsoft.WindowsAppRuntime.vNext.CBS_8wekyb3d8bbwe\Microsoft.Windows.Security.AccessControl.winmd Handle ID: 0x1b9c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\Microsoft.WindowsAppRuntime.vNext.CBS_8wekyb3d8bbwe\Microsoft.Windows.SemanticSearch.winmd Handle ID: 0x1b9c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\Microsoft.WindowsAppRuntime.vNext.CBS_8wekyb3d8bbwe\Microsoft.Windows.SemanticSearchInternal.winmd Handle ID: 0x1b9c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\Microsoft.WindowsAppRuntime.vNext.CBS_8wekyb3d8bbwe\Microsoft.Windows.Storage.Pickers.winmd Handle ID: 0x1b9c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\Microsoft.WindowsAppRuntime.vNext.CBS_8wekyb3d8bbwe\Microsoft.Windows.Storage.winmd Handle ID: 0x1b9c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\Microsoft.WindowsAppRuntime.vNext.CBS_8wekyb3d8bbwe\Microsoft.Windows.System.Power.winmd Handle ID: 0x1b9c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\Microsoft.WindowsAppRuntime.vNext.CBS_8wekyb3d8bbwe\Microsoft.Windows.System.winmd Handle ID: 0x1b9c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\Microsoft.WindowsAppRuntime.vNext.CBS_8wekyb3d8bbwe\Microsoft.Windows.Vision.winmd Handle ID: 0x1b9c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\Microsoft.WindowsAppRuntime.vNext.CBS_8wekyb3d8bbwe\Microsoft.Windows.VisionInternal.winmd Handle ID: 0x1b9c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\Microsoft.WindowsAppRuntime.vNext.CBS_8wekyb3d8bbwe\Microsoft.Windows.Widgets.dll Handle ID: 0x1b9c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\Microsoft.WindowsAppRuntime.vNext.CBS_8wekyb3d8bbwe\Microsoft.Windows.Widgets.winmd Handle ID: 0x1b9c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\Microsoft.WindowsAppRuntime.vNext.CBS_8wekyb3d8bbwe\Microsoft.Windows.Workloads.dll Handle ID: 0x1b9c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\Microsoft.WindowsAppRuntime.vNext.CBS_8wekyb3d8bbwe\Microsoft.Windows.Workloads.pri Handle ID: 0x1b9c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\Microsoft.WindowsAppRuntime.vNext.CBS_8wekyb3d8bbwe\Microsoft.Windows.Workloads.Resources.dll Handle ID: 0x1b9c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\Microsoft.WindowsAppRuntime.vNext.CBS_8wekyb3d8bbwe\Microsoft.Windows.Workloads.Resources_ec.dll Handle ID: 0x1b9c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\Microsoft.WindowsAppRuntime.vNext.CBS_8wekyb3d8bbwe\Microsoft.Windows.Workloads.winmd Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\Microsoft.WindowsAppRuntime.vNext.CBS_8wekyb3d8bbwe\Microsoft.WindowsAppRuntime.dll Handle ID: 0x1b9c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\Microsoft.WindowsAppRuntime.vNext.CBS_8wekyb3d8bbwe\Microsoft.WindowsAppRuntime.Insights.Resource.dll Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\Microsoft.WindowsAppRuntime.vNext.CBS_8wekyb3d8bbwe\Microsoft.WindowsAppRuntime.pri Handle ID: 0x1b9c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\Microsoft.WindowsAppRuntime.vNext.CBS_8wekyb3d8bbwe\MRM.dll Handle ID: 0x1b9c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\Microsoft.WindowsAppRuntime.vNext.CBS_8wekyb3d8bbwe\onnxruntime.dll Handle ID: 0x1b9c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\Microsoft.WindowsAppRuntime.vNext.CBS_8wekyb3d8bbwe\onnxruntime_providers_shared.dll Handle ID: 0x1b9c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\Microsoft.WindowsAppRuntime.vNext.CBS_8wekyb3d8bbwe\PushNotificationsLongRunningTask.ProxyStub.dll Handle ID: 0x1b9c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\Microsoft.WindowsAppRuntime.vNext.CBS_8wekyb3d8bbwe\resources.pri Handle ID: 0x1b9c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\Microsoft.WindowsAppRuntime.vNext.CBS_8wekyb3d8bbwe\RestartAgent.exe Handle ID: 0x1b9c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\Microsoft.WindowsAppRuntime.vNext.CBS_8wekyb3d8bbwe\SessionHandleIPCProxyStub.dll Handle ID: 0x1b9c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\Microsoft.WindowsAppRuntime.vNext.CBS_8wekyb3d8bbwe\SessionManagerBrokerProxyStub.dll Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\Microsoft.WindowsAppRuntime.vNext.CBS_8wekyb3d8bbwe\WindowsAppRuntime.DeploymentExtensions.OneCore.dll Handle ID: 0x1b9c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\Microsoft.WindowsAppRuntime.vNext.CBS_8wekyb3d8bbwe\WindowsAppSdk.AppxDeploymentExtensions.Desktop-EventLog-Instrumentation.dll Handle ID: 0x1b9c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\Microsoft.WindowsAppRuntime.vNext.CBS_8wekyb3d8bbwe\WinUIEdit.dll Handle ID: 0x1b9c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\Microsoft.WindowsAppRuntime.vNext.CBS_8wekyb3d8bbwe\workloads.365.json Handle ID: 0x1b9c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\Microsoft.WindowsAppRuntime.vNext.CBS_8wekyb3d8bbwe\workloads.json Handle ID: 0x1b9c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\Microsoft.WindowsAppRuntime.vNext.CBS_8wekyb3d8bbwe\workloads.lnl.json Handle ID: 0x1b9c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\Microsoft.WindowsAppRuntime.vNext.CBS_8wekyb3d8bbwe\workloads.qnn.json Handle ID: 0x1b9c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\Microsoft.WindowsAppRuntime.vNext.CBS_8wekyb3d8bbwe\workloads.stx.json Handle ID: 0x1b9c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\Microsoft.WindowsAppRuntime.vNext.CBS_8wekyb3d8bbwe\wuceffectsi.dll Handle ID: 0x1b9c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\Microsoft.WindowsAppRuntime.vNext.CBS_8wekyb3d8bbwe\AppxMetadata\CodeIntegrity.cat Handle ID: 0x1b9c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\Microsoft.WindowsAppRuntime.vNext.CBS_8wekyb3d8bbwe\NpuDetect\NPUDetect.dll Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\AccountsService.dll Handle ID: 0x1b9c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\AccountsService.winmd Handle ID: 0x1b9c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\ActionFX.ActivatableClassesAOT.appxfragment Handle ID: 0x1b9c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\ActionFX.ActivatableClassesJIT.appxfragment Handle ID: 0x1b9c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\ActionFX.appxfragment Handle ID: 0x1b9c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\ActionFXProxyStubs.dll Handle ID: 0x1b9c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\AdaptiveCards.ObjectModel.WinUI3.dll Handle ID: 0x1b9c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\appxblockmap.xml Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\appxmanifest.xml Handle ID: 0x1b9c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\AriaSDKWrapper.dll Handle ID: 0x1b9c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\Cortana.Internal.Search.winmd Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\Cortana.Internal.winmd Handle ID: 0x1b9c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\Cortana.Search.winmd Handle ID: 0x8ac Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\Cortana.Settings.winmd Handle ID: 0x1b9c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\CrossDeviceResume.exe Handle ID: 0x73c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\CrossDeviceResumeView.dll Handle ID: 0x8ac Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\DefaultSettings.xml Handle ID: 0x73c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\DesktopSpotlight.dll Handle ID: 0x1b9c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\DesktopSpotlight.winmd Handle ID: 0x1b9c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\DesktopStickerEditor.dll Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\DragTray.dll Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\DynamicLottieUwp.dll Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\DynamicLottieWinUI3.dll Handle ID: 0x73c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\FESearchHost.exe Handle ID: 0x73c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\GetStarted.Eligibility.dll Handle ID: 0x718 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\HardwareKeyboardUX.dll Handle ID: 0x73c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp.dll Handle ID: 0x744 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\IrisService.dll Handle ID: 0x744 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\IrisService.winmd Handle ID: 0x8b4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\LayoutData.dll Handle ID: 0x718 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\LockCanvasView.dll Handle ID: 0x8b4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\PCMWinRTAdapter.dll Handle ID: 0x744 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\PCMWV2DataInterop.dll Handle ID: 0x744 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\PersonaCardManager.dll Handle ID: 0x744 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\resources.pri Handle ID: 0x744 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\RulesEngine.dll Handle ID: 0x744 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe Handle ID: 0x744 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchUx.Core.dll Handle ID: 0x744 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchUx.InternalWebApi.dll Handle ID: 0x744 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchUx.Model.dll Handle ID: 0x744 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchUx.SearchApi.winmd Handle ID: 0x744 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchUx.UI.dll Handle ID: 0x744 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchUx.WebApi.dll Handle ID: 0x744 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SemanticSearchHelper.dll Handle ID: 0x744 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SmartActionsUX.dll Handle ID: 0x744 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TableExtractorWinRT.dll Handle ID: 0x744 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TemplateExpander.dll Handle ID: 0x744 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TextInput.CarbonDictation.dll Handle ID: 0x744 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TextInput.DictationUI.dll Handle ID: 0x744 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TextInput.dll Handle ID: 0x718 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TextInputCommon.dll Handle ID: 0x744 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TextInputExtensions.dll Handle ID: 0x744 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TextInputHost.exe Handle ID: 0x744 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TextInputLayoutData.dll Handle ID: 0x744 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TouchKeyboardUX.dll Handle ID: 0x744 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\UserSetup.Eligibility.dll Handle ID: 0x744 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\VisualAssistExe.dll Handle ID: 0x744 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\VisualAssistExe.exe Handle ID: 0x744 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\WebExperienceHost.dll Handle ID: 0x744 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\WebExperienceHostApp.exe Handle ID: 0x718 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\WebHost.winmd Handle ID: 0x744 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\Widgets.dll Handle ID: 0x744 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\WidgetsUWP.dll Handle ID: 0x744 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\WindowsBackup.dll Handle ID: 0x744 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\WindowsBackupClient.exe Handle ID: 0x744 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\WindowsInternal.ComposableShell.Experiences.SuggestionUIUndocked.dll Handle ID: 0x744 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\WindowsInternal.ComposableShell.Experiences.SuggestionUIUndocked.winmd Handle ID: 0x744 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\WindowsMigration.exe Handle ID: 0x744 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\WindowsMigrationView.dll Handle ID: 0x744 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\WindowsPeopleExperience.dll Handle ID: 0x744 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\wsw.dll Handle ID: 0x744 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\wv2winrt.dll Handle ID: 0x744 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\ActionFXRuntime\Assets\WindowsMcpServerConfig.json Handle ID: 0x744 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\core\js\knockouthelpers.js Handle ID: 0x744 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\Cortana.UI\cache\SVLocal\Desktop\10.css Handle ID: 0x744 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\Cortana.UI\cache\SVLocal\Desktop\11.css Handle ID: 0x744 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\Cortana.UI\cache\SVLocal\Desktop\12.js Handle ID: 0x744 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\Cortana.UI\cache\SVLocal\Desktop\13.js Handle ID: 0x744 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\Cortana.UI\cache\SVLocal\Desktop\14.js Handle ID: 0x744 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\Cortana.UI\cache\SVLocal\Desktop\15.js Handle ID: 0x744 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\Cortana.UI\cache\SVLocal\Desktop\17.js Handle ID: 0x744 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\Cortana.UI\cache\SVLocal\Desktop\2.html Handle ID: 0x744 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\Cortana.UI\cache\SVLocal\Desktop\20.js Handle ID: 0x718 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\Cortana.UI\cache\SVLocal\Desktop\21.js Handle ID: 0x744 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\Cortana.UI\cache\SVLocal\Desktop\22.js Handle ID: 0x744 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\Cortana.UI\cache\SVLocal\Desktop\23.js Handle ID: 0x718 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\Cortana.UI\cache\SVLocal\Desktop\24.js Handle ID: 0x744 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\Cortana.UI\cache\SVLocal\Desktop\25.js Handle ID: 0x744 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\Cortana.UI\cache\SVLocal\Desktop\26.js Handle ID: 0x744 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\Cortana.UI\cache\SVLocal\Desktop\27.js Handle ID: 0x744 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\Cortana.UI\cache\SVLocal\Desktop\28.js Handle ID: 0x744 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\Cortana.UI\cache\SVLocal\Desktop\29.js Handle ID: 0x718 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\Cortana.UI\cache\SVLocal\Desktop\3.js Handle ID: 0x744 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\Cortana.UI\cache\SVLocal\Desktop\30.js Handle ID: 0x744 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\Cortana.UI\cache\SVLocal\Desktop\32.js Handle ID: 0x744 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\Cortana.UI\cache\SVLocal\Desktop\34.js Handle ID: 0x744 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\Cortana.UI\cache\SVLocal\Desktop\35.js Handle ID: 0x744 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\Cortana.UI\cache\SVLocal\Desktop\36.js Handle ID: 0x8b4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\Cortana.UI\cache\SVLocal\Desktop\37.js Handle ID: 0x744 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\Cortana.UI\cache\SVLocal\Desktop\38.js Handle ID: 0x744 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\Cortana.UI\cache\SVLocal\Desktop\39.css Handle ID: 0x744 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\Cortana.UI\cache\SVLocal\Desktop\4.css Handle ID: 0x744 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\Cortana.UI\cache\SVLocal\Desktop\40.css Handle ID: 0x744 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\Cortana.UI\cache\SVLocal\Desktop\41.js Handle ID: 0x744 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\Cortana.UI\cache\SVLocal\Desktop\5.css Handle ID: 0x744 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\Cortana.UI\cache\SVLocal\Desktop\6.css Handle ID: 0x744 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\Cortana.UI\cache\SVLocal\Desktop\7.js Handle ID: 0x744 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\Cortana.UI\cache\SVLocal\Desktop\8.css Handle ID: 0x744 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\Cortana.UI\cache\SVLocal\Desktop\9.css Handle ID: 0x744 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\Cortana.UI\cache\SVLocal\DesktopDefault\10.css Handle ID: 0x744 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\Cortana.UI\cache\SVLocal\DesktopDefault\11.css Handle ID: 0x744 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\Cortana.UI\cache\SVLocal\DesktopDefault\12.js Handle ID: 0x744 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\Cortana.UI\cache\SVLocal\DesktopDefault\13.js Handle ID: 0x744 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\Cortana.UI\cache\SVLocal\DesktopDefault\14.js Handle ID: 0x744 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\Cortana.UI\cache\SVLocal\DesktopDefault\15.js Handle ID: 0x744 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\Cortana.UI\cache\SVLocal\DesktopDefault\17.js Handle ID: 0x744 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\Cortana.UI\cache\SVLocal\DesktopDefault\18.js Handle ID: 0x744 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\Cortana.UI\cache\SVLocal\DesktopDefault\19.js Handle ID: 0x744 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\Cortana.UI\cache\SVLocal\DesktopDefault\2.html Handle ID: 0x744 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\Cortana.UI\cache\SVLocal\DesktopDefault\20.js Handle ID: 0x744 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\Cortana.UI\cache\SVLocal\DesktopDefault\21.js Handle ID: 0x744 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\Cortana.UI\cache\SVLocal\DesktopDefault\22.js Handle ID: 0x744 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\Cortana.UI\cache\SVLocal\DesktopDefault\23.js Handle ID: 0x744 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\Cortana.UI\cache\SVLocal\DesktopDefault\24.js Handle ID: 0x8b4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\Cortana.UI\cache\SVLocal\DesktopDefault\25.js Handle ID: 0x744 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\Cortana.UI\cache\SVLocal\DesktopDefault\26.js Handle ID: 0x744 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\Cortana.UI\cache\SVLocal\DesktopDefault\27.js Handle ID: 0x744 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\Cortana.UI\cache\SVLocal\DesktopDefault\28.js Handle ID: 0x744 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\Cortana.UI\cache\SVLocal\DesktopDefault\29.js Handle ID: 0x718 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\Cortana.UI\cache\SVLocal\DesktopDefault\3.js Handle ID: 0x744 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\Cortana.UI\cache\SVLocal\DesktopDefault\32.js Handle ID: 0x718 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\Cortana.UI\cache\SVLocal\DesktopDefault\33.js Handle ID: 0x744 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\Cortana.UI\cache\SVLocal\DesktopDefault\35.js Handle ID: 0x744 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\Cortana.UI\cache\SVLocal\DesktopDefault\37.js Handle ID: 0x744 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\Cortana.UI\cache\SVLocal\DesktopDefault\38.js Handle ID: 0x744 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\Cortana.UI\cache\SVLocal\DesktopDefault\39.js Handle ID: 0x744 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\Cortana.UI\cache\SVLocal\DesktopDefault\41.js Handle ID: 0x744 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\Cortana.UI\cache\SVLocal\DesktopDefault\42.css Handle ID: 0x744 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\Cortana.UI\cache\SVLocal\DesktopDefault\6.css Handle ID: 0x744 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\Cortana.UI\cache\SVLocal\DesktopDefault\7.js Handle ID: 0x744 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\Cortana.UI\cache\SVLocal\DesktopDefault\8.css Handle ID: 0x744 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\Cortana.UI\cache\SVLocal\DesktopDefault\9.css Handle ID: 0x718 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\Cortana.UI\cache\WV2Local\desktop\10.css Handle ID: 0x744 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\Cortana.UI\cache\WV2Local\desktop\11.css Handle ID: 0x744 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\Cortana.UI\cache\WV2Local\desktop\12.js Handle ID: 0x744 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\Cortana.UI\cache\WV2Local\desktop\13.js Handle ID: 0x744 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\Cortana.UI\cache\WV2Local\desktop\14.js Handle ID: 0x744 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\Cortana.UI\cache\WV2Local\desktop\15.js Handle ID: 0x744 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\Cortana.UI\cache\WV2Local\desktop\16.js Handle ID: 0x718 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\Cortana.UI\cache\WV2Local\desktop\17.js Handle ID: 0x744 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\Cortana.UI\cache\WV2Local\desktop\18.js Handle ID: 0x744 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\Cortana.UI\cache\WV2Local\desktop\19.js Handle ID: 0x744 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\Cortana.UI\cache\WV2Local\desktop\2.html Handle ID: 0x744 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\Cortana.UI\cache\WV2Local\desktop\20.js Handle ID: 0x744 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\Cortana.UI\cache\WV2Local\desktop\21.js Handle ID: 0x744 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\Cortana.UI\cache\WV2Local\desktop\22.js Handle ID: 0x744 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\Cortana.UI\cache\WV2Local\desktop\23.js Handle ID: 0x744 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\Cortana.UI\cache\WV2Local\desktop\24.js Handle ID: 0x744 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\Cortana.UI\cache\WV2Local\desktop\25.js Handle ID: 0x8b4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\Cortana.UI\cache\WV2Local\desktop\26.js Handle ID: 0x744 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\Cortana.UI\cache\WV2Local\desktop\27.js Handle ID: 0x744 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\Cortana.UI\cache\WV2Local\desktop\3.js Handle ID: 0x744 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\Cortana.UI\cache\WV2Local\desktop\30.js Handle ID: 0x744 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\Cortana.UI\cache\WV2Local\desktop\31.js Handle ID: 0x744 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\Cortana.UI\cache\WV2Local\desktop\32.js Handle ID: 0x744 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\Cortana.UI\cache\WV2Local\desktop\34.js Handle ID: 0x744 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\Cortana.UI\cache\WV2Local\desktop\35.js Handle ID: 0x744 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\Cortana.UI\cache\WV2Local\desktop\36.js Handle ID: 0x744 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\Cortana.UI\cache\WV2Local\desktop\37.js Handle ID: 0x744 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\Cortana.UI\cache\WV2Local\desktop\38.js Handle ID: 0x744 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\Cortana.UI\cache\WV2Local\desktop\39.css Handle ID: 0x744 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\Cortana.UI\cache\WV2Local\desktop\40.css Handle ID: 0x744 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\Cortana.UI\cache\WV2Local\desktop\41.js Handle ID: 0x718 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\Cortana.UI\cache\WV2Local\desktop\5.css Handle ID: 0x744 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\Cortana.UI\cache\WV2Local\desktop\6.css Handle ID: 0x744 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\Cortana.UI\cache\WV2Local\desktop\7.js Handle ID: 0x744 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\Cortana.UI\cache\WV2Local\desktop\8.css Handle ID: 0x744 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\Cortana.UI\cache\WV2Local\desktop\9.css Handle ID: 0x744 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\Cortana.UI\cache\WV2Local\desktopdefault\10.css Handle ID: 0x744 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\Cortana.UI\cache\WV2Local\desktopdefault\11.css Handle ID: 0x744 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\Cortana.UI\cache\WV2Local\desktopdefault\12.js Handle ID: 0x744 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\Cortana.UI\cache\WV2Local\desktopdefault\13.js Handle ID: 0x744 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\Cortana.UI\cache\WV2Local\desktopdefault\14.js Handle ID: 0x744 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\Cortana.UI\cache\WV2Local\desktopdefault\15.js Handle ID: 0x744 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\Cortana.UI\cache\WV2Local\desktopdefault\16.js Handle ID: 0x744 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\Cortana.UI\cache\WV2Local\desktopdefault\17.js Handle ID: 0x718 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\Cortana.UI\cache\WV2Local\desktopdefault\18.js Handle ID: 0x744 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\Cortana.UI\cache\WV2Local\desktopdefault\2.html Handle ID: 0x744 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\Cortana.UI\cache\WV2Local\desktopdefault\21.js Handle ID: 0x718 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\Cortana.UI\cache\WV2Local\desktopdefault\22.js Handle ID: 0x744 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\Cortana.UI\cache\WV2Local\desktopdefault\23.js Handle ID: 0x744 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\Cortana.UI\cache\WV2Local\desktopdefault\24.js Handle ID: 0x744 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\Cortana.UI\cache\WV2Local\desktopdefault\25.js Handle ID: 0x744 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\Cortana.UI\cache\WV2Local\desktopdefault\26.js Handle ID: 0x718 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\Cortana.UI\cache\WV2Local\desktopdefault\27.js Handle ID: 0x744 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\Cortana.UI\cache\WV2Local\desktopdefault\28.js Handle ID: 0x744 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\Cortana.UI\cache\WV2Local\desktopdefault\29.js Handle ID: 0x744 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\Cortana.UI\cache\WV2Local\desktopdefault\3.js Handle ID: 0x744 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\Cortana.UI\cache\WV2Local\desktopdefault\30.js Handle ID: 0x744 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\Cortana.UI\cache\WV2Local\desktopdefault\31.js Handle ID: 0x744 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\Cortana.UI\cache\WV2Local\desktopdefault\32.js Handle ID: 0x744 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\Cortana.UI\cache\WV2Local\desktopdefault\33.js Handle ID: 0x718 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\Cortana.UI\cache\WV2Local\desktopdefault\34.js Handle ID: 0x744 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\Cortana.UI\cache\WV2Local\desktopdefault\35.js Handle ID: 0x744 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\Cortana.UI\cache\WV2Local\desktopdefault\37.js Handle ID: 0x744 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\Cortana.UI\cache\WV2Local\desktopdefault\38.js Handle ID: 0x744 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\Cortana.UI\cache\WV2Local\desktopdefault\39.js Handle ID: 0x718 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\Cortana.UI\cache\WV2Local\desktopdefault\41.js Handle ID: 0x744 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\Cortana.UI\cache\WV2Local\desktopdefault\42.css Handle ID: 0x744 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\Cortana.UI\cache\WV2Local\desktopdefault\6.css Handle ID: 0x744 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\Cortana.UI\cache\WV2Local\desktopdefault\7.js Handle ID: 0x744 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\Cortana.UI\cache\WV2Local\desktopdefault\8.css Handle ID: 0x744 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\Cortana.UI\cache\WV2Local\desktopdefault\9.css Handle ID: 0x744 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\data\prod\uriRules.json Handle ID: 0x744 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\DesktopStickerEditorWin32Exe\DesktopStickerEditorWin32Exe.exe Handle ID: 0x744 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\DragTray\Assets\move_to_folder_icon.png Handle ID: 0x744 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\DragTray\Assets\transparent_32x32.png Handle ID: 0x744 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\FeatureDiscoverability\Assets\Magnifier_Assets\Magnifier.ico Handle ID: 0x744 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\FeatureDiscoverability\Assets\Magnifier_Assets\MagnifierStaticImage.png Handle ID: 0x744 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\webapps\inclusiveOobe\css\inclusive-common.css Handle ID: 0x744 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\webapps\inclusiveOobe\css\light-iframe-content.css Handle ID: 0x744 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\webapps\inclusiveOobe\css\oobeHello.css Handle ID: 0x744 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\webapps\inclusiveOobe\js\oobeerror-page.js Handle ID: 0x718 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\webapps\inclusiveOobe\js\oobeerror-vm.js Handle ID: 0x744 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\webapps\inclusiveOobe\js\oobehello-nth-page.js Handle ID: 0x744 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\webapps\inclusiveOobe\js\oobehello-nth-vm.js Handle ID: 0x744 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\webapps\inclusiveOobe\js\oobehello-vm.js Handle ID: 0x718 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\webapps\inclusiveOobe\js\common\oobe-toggle-vm.js Handle ID: 0x744 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\webapps\inclusiveOobe\view\oobeerror-main.html Handle ID: 0x744 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\webapps\inclusiveOobe\view\oobehello-main.html Handle ID: 0x744 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\webapps\inclusiveOobe\view\oobehello-nth-main.html Handle ID: 0x744 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\webapps\templates\js\common-button-vm.js Handle ID: 0x744 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\webapps\templates\view\common-button-template.html Handle ID: 0x744 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\webapps\templates\view\common-footer-template.html Handle ID: 0x744 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\WindowsInternal.ComposableShell.Experiences.SuggestionUIUndocked\app.appx Handle ID: 0x744 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.Core_cw5n1h2txyewy\AppListBackup.dll Handle ID: 0x744 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.Core_cw5n1h2txyewy\appxblockmap.xml Handle ID: 0x744 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.Core_cw5n1h2txyewy\appxmanifest.xml Handle ID: 0x744 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.Core_cw5n1h2txyewy\BackupBanner.dll Handle ID: 0x744 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.Core_cw5n1h2txyewy\CommandExecutor.dll Handle ID: 0x744 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.Core_cw5n1h2txyewy\CommandExecutorExtension.dll Handle ID: 0x744 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.Core_cw5n1h2txyewy\DynamicLottie.dll Handle ID: 0x744 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.Core_cw5n1h2txyewy\FREUserInterface.dll Handle ID: 0x744 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.Core_cw5n1h2txyewy\LiveCaptions.dll Handle ID: 0x718 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.Core_cw5n1h2txyewy\LiveCaptionsBackendDll.dll Handle ID: 0x744 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.Core_cw5n1h2txyewy\LiveCaptionsDesktop.dll Handle ID: 0x744 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.Core_cw5n1h2txyewy\LiveCaptionsXamlApplication.dll Handle ID: 0x744 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.Core_cw5n1h2txyewy\LogonWebHost.dll Handle ID: 0x744 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.Core_cw5n1h2txyewy\LogonWebHostProduct.exe Handle ID: 0x744 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.Core_cw5n1h2txyewy\MicrosoftGraphRecentItemsManager.dll Handle ID: 0x718 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.Core_cw5n1h2txyewy\resources.pri Handle ID: 0x744 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.Core_cw5n1h2txyewy\ScreenClipping.dll Handle ID: 0x744 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.Core_cw5n1h2txyewy\ScreenClippingHost.exe Handle ID: 0x744 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.Core_cw5n1h2txyewy\SnapLauncherProtocol.exe Handle ID: 0x744 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.Core_cw5n1h2txyewy\SnapLayout.dll Handle ID: 0x744 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.Core_cw5n1h2txyewy\SpeechRecognizer.dll Handle ID: 0x744 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.Core_cw5n1h2txyewy\SpeechRecognizerExtension.dll Handle ID: 0x744 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.Core_cw5n1h2txyewy\SpeechSynthesizerExtension.dll Handle ID: 0x744 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.Core_cw5n1h2txyewy\StartMenu.dll Handle ID: 0x744 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.Core_cw5n1h2txyewy\SystemSettingsExtensions.dll Handle ID: 0x744 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.Core_cw5n1h2txyewy\Taskbar.View.dll Handle ID: 0x718 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.Core_cw5n1h2txyewy\TwinSxS.dll Handle ID: 0x744 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.Core_cw5n1h2txyewy\VoiceAccess.dll Handle ID: 0x744 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.Core_cw5n1h2txyewy\VoiceAccessCommon.dll Handle ID: 0x744 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.Core_cw5n1h2txyewy\VoiceAccessHost.dll Handle ID: 0x744 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.Core_cw5n1h2txyewy\VoiceAccessPlugin.dll Handle ID: 0x744 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.Core_cw5n1h2txyewy\VoiceAccessUserInterface.dll Handle ID: 0x744 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.Core_cw5n1h2txyewy\FREUserInterface\Assets\Content\de-DE\CommandHelpWindowContent.json Handle ID: 0x744 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.Core_cw5n1h2txyewy\FREUserInterface\Assets\Content\en-GB\CommandHelpWindowContent.json Handle ID: 0x744 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.Core_cw5n1h2txyewy\FREUserInterface\Assets\Content\en-US\CommandHelp.json Handle ID: 0x744 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.Core_cw5n1h2txyewy\FREUserInterface\Assets\Content\en-US\CommandHelpWindowContent.json Handle ID: 0x744 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.Core_cw5n1h2txyewy\FREUserInterface\Assets\Content\es-ES\CommandHelpWindowContent.json Handle ID: 0x744 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.Core_cw5n1h2txyewy\FREUserInterface\Assets\Content\es-MX\CommandHelpWindowContent.json Handle ID: 0x744 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.Core_cw5n1h2txyewy\FREUserInterface\Assets\Content\fr-CA\CommandHelpWindowContent.json Handle ID: 0x744 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.Core_cw5n1h2txyewy\FREUserInterface\Assets\Content\fr-FR\CommandHelpWindowContent.json Handle ID: 0x744 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.Core_cw5n1h2txyewy\VoiceAccessCommon\FlexibleCommandingTrainingFile.json Handle ID: 0x744 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.Core_cw5n1h2txyewy\VoiceAccessHost\VoiceAccessSupportedLanguages.xml Handle ID: 0x744 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.Core_cw5n1h2txyewy\VoiceAccessHost\VoiceCommands.xml Handle ID: 0x744 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.CoreAI_cw5n1h2txyewy\aicontext.exe Handle ID: 0x744 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.CoreAI_cw5n1h2txyewy\AIContextProxyStub.dll Handle ID: 0x744 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.CoreAI_cw5n1h2txyewy\AIContextService.dll Handle ID: 0x744 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.CoreAI_cw5n1h2txyewy\AIXView.dll Handle ID: 0x744 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.CoreAI_cw5n1h2txyewy\appxblockmap.xml Handle ID: 0x744 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.CoreAI_cw5n1h2txyewy\appxmanifest.xml Handle ID: 0x718 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.CoreAI_cw5n1h2txyewy\ClickToDo.exe Handle ID: 0x744 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.CoreAI_cw5n1h2txyewy\CoreAI.Client.dll Handle ID: 0x744 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.CoreAI_cw5n1h2txyewy\DiscoveryOverlay.dll Handle ID: 0x744 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.CoreAI_cw5n1h2txyewy\Feedback.dll Handle ID: 0x744 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.CoreAI_cw5n1h2txyewy\resources.pri Handle ID: 0x744 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.CoreAI_cw5n1h2txyewy\WindowsInternal.AI.Context.winmd Handle ID: 0x744 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.CoreAI_cw5n1h2txyewy\DiscoveryOverlay\OutlineEffect.cso Handle ID: 0x744 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.CoreAI_cw5n1h2txyewy\DiscoveryOverlay\OutlineEffect.hlsl Handle ID: 0x744 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.CoreAI_cw5n1h2txyewy\DiscoveryOverlay\OutlineEffectShader.h Handle ID: 0x744 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.CoreAI_cw5n1h2txyewy\DiscoveryOverlay\SlimeEffect.cso Handle ID: 0x718 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.CoreAI_cw5n1h2txyewy\DiscoveryOverlay\SlimeEffect.hlsl Handle ID: 0x8b4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.CoreAI_cw5n1h2txyewy\DiscoveryOverlay\SlimeEffectShader.h Handle ID: 0x718 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.CoreAI_cw5n1h2txyewy\DiscoveryOverlay\Assets\Effects\OutlineEffect.cso Handle ID: 0x718 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.CoreAI_cw5n1h2txyewy\DiscoveryOverlay\Assets\Effects\SlimeEffect.cso Handle ID: 0x718 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.FileExp_cw5n1h2txyewy\appxblockmap.xml Handle ID: 0x718 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.FileExp_cw5n1h2txyewy\appxmanifest.xml Handle ID: 0x718 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:48 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.FileExp_cw5n1h2txyewy\FileExplorerExtensions.dll Handle ID: 0x718 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.FileExp_cw5n1h2txyewy\resources.pri Handle ID: 0x718 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.FileExp_cw5n1h2txyewy\FileExplorerExtensions\Assets\images\contrast-black\Windows.SpotlightImageLearnMore.svg Handle ID: 0x718 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.FileExp_cw5n1h2txyewy\FileExplorerExtensions\Assets\images\contrast-black\Windows.SpotlightNextImage.svg Handle ID: 0x718 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.FileExp_cw5n1h2txyewy\FileExplorerExtensions\Assets\images\contrast-standard\theme-dark\Windows.SpotlightImageLearnMore.svg Handle ID: 0x718 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.FileExp_cw5n1h2txyewy\FileExplorerExtensions\Assets\images\contrast-standard\theme-dark\Windows.SpotlightNextImage.svg Handle ID: 0x718 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.FileExp_cw5n1h2txyewy\FileExplorerExtensions\Assets\images\contrast-standard\theme-light\Windows.SpotlightImageLearnMore.svg Handle ID: 0x1b9c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.FileExp_cw5n1h2txyewy\FileExplorerExtensions\Assets\images\contrast-standard\theme-light\Windows.SpotlightNextImage.svg Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.FileExp_cw5n1h2txyewy\FileExplorerExtensions\Assets\images\contrast-white\Windows.SpotlightImageLearnMore.svg Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.FileExp_cw5n1h2txyewy\FileExplorerExtensions\Assets\images\contrast-white\Windows.SpotlightNextImage.svg Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.OOBE_cw5n1h2txyewy\appxblockmap.xml Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.OOBE_cw5n1h2txyewy\appxmanifest.xml Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.OOBE_cw5n1h2txyewy\OobeHostApp.exe Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.OOBE_cw5n1h2txyewy\resources.pri Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.OOBE_cw5n1h2txyewy\WebExperienceHost.dll Handle ID: 0x74c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.OOBE_cw5n1h2txyewy\WebHost.winmd Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.OOBE_cw5n1h2txyewy\WindowsOobeAppHost.AOT.dll Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.OOBE_cw5n1h2txyewy\WindowsOobeAppHost.AOT.exe Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.OOBE_cw5n1h2txyewy\WXHWinRTAdapter.dll Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.OOBE_cw5n1h2txyewy\Assets\WOAHLogo.png Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.OOBE_cw5n1h2txyewy\Assets\WOAHSmallLogo.png Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.OOBE_cw5n1h2txyewy\Assets\WOAHStoreLogo.png Handle ID: 0x74c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.OOBE_cw5n1h2txyewy\core\js\knockouthelpers.js Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.OOBE_cw5n1h2txyewy\css\common.css Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.OOBE_cw5n1h2txyewy\data\prod\navigation-nth.json Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.OOBE_cw5n1h2txyewy\data\prod\navigation-oobe.json Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.OOBE_cw5n1h2txyewy\data\prod\navigation-scoobe.json Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.OOBE_cw5n1h2txyewy\data\prod\uriRules.json Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.OOBE_cw5n1h2txyewy\webapps\inclusiveOobe\css\inclusive-common.css Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.OOBE_cw5n1h2txyewy\webapps\inclusiveOobe\css\light-iframe-content.css Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.OOBE_cw5n1h2txyewy\webapps\inclusiveOobe\css\oobeHello.css Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.OOBE_cw5n1h2txyewy\webapps\inclusiveOobe\js\oobeerror-page.js Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.OOBE_cw5n1h2txyewy\webapps\inclusiveOobe\js\oobeerror-vm.js Handle ID: 0x74c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.OOBE_cw5n1h2txyewy\webapps\inclusiveOobe\js\oobehello-nth-page.js Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.OOBE_cw5n1h2txyewy\webapps\inclusiveOobe\js\oobehello-nth-vm.js Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.OOBE_cw5n1h2txyewy\webapps\inclusiveOobe\js\oobehello-vm.js Handle ID: 0x74c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.OOBE_cw5n1h2txyewy\webapps\inclusiveOobe\js\oobenetworklosserror-page.js Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.OOBE_cw5n1h2txyewy\webapps\inclusiveOobe\js\oobeprivacysettings-aadc-vm.js Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.OOBE_cw5n1h2txyewy\webapps\inclusiveOobe\js\oobeprivacysettings-data.js Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.OOBE_cw5n1h2txyewy\webapps\inclusiveOobe\js\oobeprivacysettings-multipage-page.js Handle ID: 0x74c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.OOBE_cw5n1h2txyewy\webapps\inclusiveOobe\js\oobeprivacysettings-multipage-vm.js Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.OOBE_cw5n1h2txyewy\webapps\inclusiveOobe\js\oobeprivacysettings-page.js Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.OOBE_cw5n1h2txyewy\webapps\inclusiveOobe\js\oobeprivacysettings-vm.js Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.OOBE_cw5n1h2txyewy\webapps\inclusiveOobe\js\oobeupdatesettings-vm.js Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.OOBE_cw5n1h2txyewy\webapps\inclusiveOobe\js\common\oobe-toggle-vm.js Handle ID: 0x74c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.OOBE_cw5n1h2txyewy\webapps\inclusiveOobe\view\oobeerror-main.html Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.OOBE_cw5n1h2txyewy\webapps\inclusiveOobe\view\oobehello-main.html Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.OOBE_cw5n1h2txyewy\webapps\inclusiveOobe\view\oobehello-nth-main.html Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.OOBE_cw5n1h2txyewy\webapps\inclusiveOobe\view\oobeprivacysettings-aadc-main.html Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.OOBE_cw5n1h2txyewy\webapps\inclusiveOobe\view\oobeprivacysettings-main.html Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.OOBE_cw5n1h2txyewy\webapps\inclusiveOobe\view\oobeprivacysettings-multipage-main.html Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.OOBE_cw5n1h2txyewy\webapps\inclusiveOobe\view\oobeupdatesettings-main.html Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.OOBE_cw5n1h2txyewy\webapps\scoobe\js\oobeoemregistration-page.js Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.OOBE_cw5n1h2txyewy\webapps\scoobe\js\oobeoemregistration-vm.js Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.OOBE_cw5n1h2txyewy\webapps\scoobe\js\scoobeoutro-page.js Handle ID: 0x8b4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.OOBE_cw5n1h2txyewy\webapps\scoobe\js\scoobeoutro-vm.js Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.OOBE_cw5n1h2txyewy\webapps\scoobe\media\browserLottie.json Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.OOBE_cw5n1h2txyewy\webapps\scoobe\media\gamepassLottie.json Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.OOBE_cw5n1h2txyewy\webapps\scoobe\media\oneDriveLottie.json Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.OOBE_cw5n1h2txyewy\webapps\scoobe\media\phonePairingLottie.json Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.OOBE_cw5n1h2txyewy\webapps\scoobe\media\scoobe-outro.svg Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.OOBE_cw5n1h2txyewy\webapps\scoobe\media\scoobeLottie.json Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.OOBE_cw5n1h2txyewy\webapps\scoobe\media\scoobeNoEdgeLottie.json Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.OOBE_cw5n1h2txyewy\webapps\scoobe\media\userIntentLottie.json Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.OOBE_cw5n1h2txyewy\webapps\scoobe\media\wifiLottie.json Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.OOBE_cw5n1h2txyewy\webapps\scoobe\view\oobeoemregistration-main.html Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.OOBE_cw5n1h2txyewy\webapps\scoobe\view\scoobeoutro-main.html Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.OOBE_cw5n1h2txyewy\webapps\templates\js\common-button-vm.js Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.OOBE_cw5n1h2txyewy\webapps\templates\view\common-button-template.html Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.OOBE_cw5n1h2txyewy\webapps\templates\view\common-footer-template.html Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.OOBE_cw5n1h2txyewy\WindowsOobeAppHost\Microsoft.Graphics.Canvas.dll Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.OOBE_cw5n1h2txyewy\WindowsOobeAppHost\WindowsOobeAppHost.manifest Handle ID: 0x74c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.Photon_cw5n1h2txyewy\appxblockmap.xml Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.Photon_cw5n1h2txyewy\appxmanifest.xml Handle ID: 0x74c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.Photon_cw5n1h2txyewy\Clipboard.dll Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.Photon_cw5n1h2txyewy\ExperienceExtensions.dll Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.Photon_cw5n1h2txyewy\Microsoft.ReactNative.dll Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.Photon_cw5n1h2txyewy\Payments.dll Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.Photon_cw5n1h2txyewy\ReactNativeXaml.dll Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.Photon_cw5n1h2txyewy\resources.pri Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.Photon_cw5n1h2txyewy\ux-phui.dll Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.Photon_cw5n1h2txyewy\WinRTComponents.dll Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.Photon_cw5n1h2txyewy\WinRTTurboModule.dll Handle ID: 0x74c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.Photon_cw5n1h2txyewy\WsxPackManager.dll Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.Photon_cw5n1h2txyewy\WsxPackManager.winmd Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.Photon_cw5n1h2txyewy\Public\wsxpacks.json Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.Photon_cw5n1h2txyewy\Public\wsxpacks\Account\index.windows.bundle Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.Photon_cw5n1h2txyewy\Public\wsxpacks\Account\assets\assets\images\gold-vertical-logo.png Handle ID: 0x8b4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.Photon_cw5n1h2txyewy\Public\wsxpacks\Account\assets\assets\images\pc-game-pass-vertical-logo.png Handle ID: 0x8b4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.Photon_cw5n1h2txyewy\Public\wsxpacks\Account\assets\assets\images\standard-vertical-logo.png Handle ID: 0x8b4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.Photon_cw5n1h2txyewy\Public\wsxpacks\Account\assets\assets\images\ultimate-vertical-logo.png Handle ID: 0x8b4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.Photon_cw5n1h2txyewy\Public\wsxpacks\Account\assets\assets\images\upsell-app-ai-refresh.svg Handle ID: 0x74c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.Photon_cw5n1h2txyewy\Public\wsxpacks\Account\assets\assets\images\xbox-gold-horizontal.png Handle ID: 0x8b4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.Photon_cw5n1h2txyewy\Public\wsxpacks\Account\assets\assets\images\xbox-live-gold-benefit-lotus.svg Handle ID: 0x8b4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.Photon_cw5n1h2txyewy\Public\wsxpacks\Account\assets\assets\images\xbox-pc-game-pass-benefit-lotus.svg Handle ID: 0x8b4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.Photon_cw5n1h2txyewy\Public\wsxpacks\Account\assets\assets\images\xbox-pc-game-pass-horizontal.png Handle ID: 0x8b4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.Photon_cw5n1h2txyewy\Public\wsxpacks\Account\assets\assets\images\xbox-purchase-dialogue-banner-lotus.jpg Handle ID: 0x8b4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.Photon_cw5n1h2txyewy\Public\wsxpacks\Account\assets\assets\images\xbox-standard-benefit-lotus.svg Handle ID: 0x8b4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.Photon_cw5n1h2txyewy\Public\wsxpacks\Account\assets\assets\images\xbox-standard-horizontal.png Handle ID: 0x8b4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.Photon_cw5n1h2txyewy\Public\wsxpacks\Account\assets\assets\images\xbox-ultimate-benefit-lotus.svg Handle ID: 0x8b4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.Photon_cw5n1h2txyewy\Public\wsxpacks\Account\assets\assets\images\xbox-ultimate-horizontal.png Handle ID: 0x8b4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.Photon_cw5n1h2txyewy\Public\wsxpacks\Account\assets\assets\images\dark\xbox-live-gold-benefit-lotus.svg Handle ID: 0x8b4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.Photon_cw5n1h2txyewy\Public\wsxpacks\Account\assets\assets\images\dark\xbox-pc-game-pass-benefit-lotus.svg Handle ID: 0x74c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.Photon_cw5n1h2txyewy\Public\wsxpacks\Account\assets\assets\images\dark\xbox-standard-benefit-lotus.svg Handle ID: 0x8b4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.Photon_cw5n1h2txyewy\Public\wsxpacks\Account\assets\assets\images\dark\xbox-ultimate-benefit-lotus.svg Handle ID: 0x8b4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.Photon_cw5n1h2txyewy\Public\wsxpacks\Account\assets\strings\af-ZA.json Handle ID: 0x74c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.Photon_cw5n1h2txyewy\Public\wsxpacks\Account\assets\strings\am-ET.json Handle ID: 0x8b4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.Photon_cw5n1h2txyewy\Public\wsxpacks\Account\assets\strings\ar-SA.json Handle ID: 0x8b4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.Photon_cw5n1h2txyewy\Public\wsxpacks\Account\assets\strings\as-IN.json Handle ID: 0x8b4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.Photon_cw5n1h2txyewy\Public\wsxpacks\Account\assets\strings\az-Latn-AZ.json Handle ID: 0x8b4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.Photon_cw5n1h2txyewy\Public\wsxpacks\Account\assets\strings\bg-BG.json Handle ID: 0x7dc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.Photon_cw5n1h2txyewy\Public\wsxpacks\Account\assets\strings\bn-IN.json Handle ID: 0x8b4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.Photon_cw5n1h2txyewy\Public\wsxpacks\Account\assets\strings\bs-Latn-BA.json Handle ID: 0x8b4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.Photon_cw5n1h2txyewy\Public\wsxpacks\Account\assets\strings\ca-Es-VALENCIA.json Handle ID: 0x8b4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.Photon_cw5n1h2txyewy\Public\wsxpacks\Account\assets\strings\ca-ES.json Handle ID: 0x8b4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.Photon_cw5n1h2txyewy\Public\wsxpacks\Account\assets\strings\cs-CZ.json Handle ID: 0x8b4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.Photon_cw5n1h2txyewy\Public\wsxpacks\Account\assets\strings\cy-GB.json Handle ID: 0x74c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.Photon_cw5n1h2txyewy\Public\wsxpacks\Account\assets\strings\da-DK.json Handle ID: 0x8b4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.Photon_cw5n1h2txyewy\Public\wsxpacks\Account\assets\strings\de-DE.json Handle ID: 0x8b4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.Photon_cw5n1h2txyewy\Public\wsxpacks\Account\assets\strings\el-GR.json Handle ID: 0x8b4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.Photon_cw5n1h2txyewy\Public\wsxpacks\Account\assets\strings\en-GB.json Handle ID: 0x8b4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.Photon_cw5n1h2txyewy\Public\wsxpacks\Account\assets\strings\en-US.json Handle ID: 0x8b4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.Photon_cw5n1h2txyewy\Public\wsxpacks\Account\assets\strings\es-ES.json Handle ID: 0x8b4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.Photon_cw5n1h2txyewy\Public\wsxpacks\Account\assets\strings\es-MX.json Handle ID: 0x8b4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.Photon_cw5n1h2txyewy\Public\wsxpacks\Account\assets\strings\et-EE.json Handle ID: 0x8b4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.Photon_cw5n1h2txyewy\Public\wsxpacks\Account\assets\strings\eu-ES.json Handle ID: 0x8b4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.Photon_cw5n1h2txyewy\Public\wsxpacks\Account\assets\strings\fa-IR.json Handle ID: 0x8b4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.Photon_cw5n1h2txyewy\Public\wsxpacks\Account\assets\strings\fi-FI.json Handle ID: 0x8b4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.Photon_cw5n1h2txyewy\Public\wsxpacks\Account\assets\strings\fil-PH.json Handle ID: 0x8b4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.Photon_cw5n1h2txyewy\Public\wsxpacks\Account\assets\strings\fr-CA.json Handle ID: 0x8b4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.Photon_cw5n1h2txyewy\Public\wsxpacks\Account\assets\strings\fr-FR.json Handle ID: 0x8b4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.Photon_cw5n1h2txyewy\Public\wsxpacks\Account\assets\strings\ga-IE.json Handle ID: 0x8b4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.Photon_cw5n1h2txyewy\Public\wsxpacks\Account\assets\strings\gd-gb.json Handle ID: 0x74c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.Photon_cw5n1h2txyewy\Public\wsxpacks\Account\assets\strings\gl-ES.json Handle ID: 0x8b4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.Photon_cw5n1h2txyewy\Public\wsxpacks\Account\assets\strings\gu-IN.json Handle ID: 0x74c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.Photon_cw5n1h2txyewy\Public\wsxpacks\Account\assets\strings\he-IL.json Handle ID: 0x8b4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.Photon_cw5n1h2txyewy\Public\wsxpacks\Account\assets\strings\hi-IN.json Handle ID: 0x8b4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.Photon_cw5n1h2txyewy\Public\wsxpacks\Account\assets\strings\hr-HR.json Handle ID: 0x8b4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.Photon_cw5n1h2txyewy\Public\wsxpacks\Account\assets\strings\hu-HU.json Handle ID: 0x8b4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.Photon_cw5n1h2txyewy\Public\wsxpacks\Account\assets\strings\hy-AM.json Handle ID: 0x8b4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.Photon_cw5n1h2txyewy\Public\wsxpacks\Account\assets\strings\id-ID.json Handle ID: 0x8b4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.Photon_cw5n1h2txyewy\Public\wsxpacks\Account\assets\strings\is-IS.json Handle ID: 0x8b4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.Photon_cw5n1h2txyewy\Public\wsxpacks\Account\assets\strings\it-IT.json Handle ID: 0x8b4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.Photon_cw5n1h2txyewy\Public\wsxpacks\Account\assets\strings\ja-JP.json Handle ID: 0x8b4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.Photon_cw5n1h2txyewy\Public\wsxpacks\Account\assets\strings\ka-GE.json Handle ID: 0x8b4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.Photon_cw5n1h2txyewy\Public\wsxpacks\Account\assets\strings\kk-KZ.json Handle ID: 0x8b4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.Photon_cw5n1h2txyewy\Public\wsxpacks\Account\assets\strings\km-KH.json Handle ID: 0x8b4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.Photon_cw5n1h2txyewy\Public\wsxpacks\Account\assets\strings\kn-IN.json Handle ID: 0x8b4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.Photon_cw5n1h2txyewy\Public\wsxpacks\Account\assets\strings\ko-KR.json Handle ID: 0x8b4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.Photon_cw5n1h2txyewy\Public\wsxpacks\Account\assets\strings\kok-IN.json Handle ID: 0x8b4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.Photon_cw5n1h2txyewy\Public\wsxpacks\Account\assets\strings\lb-LU.json Handle ID: 0x8b4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.Photon_cw5n1h2txyewy\Public\wsxpacks\Account\assets\strings\lo-LA.json Handle ID: 0x8b4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.Photon_cw5n1h2txyewy\Public\wsxpacks\Account\assets\strings\lt-LT.json Handle ID: 0x8b4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.Photon_cw5n1h2txyewy\Public\wsxpacks\Account\assets\strings\lv-LV.json Handle ID: 0x74c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.Photon_cw5n1h2txyewy\Public\wsxpacks\Account\assets\strings\mi-NZ.json Handle ID: 0x8b4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.Photon_cw5n1h2txyewy\Public\wsxpacks\Account\assets\strings\mk-MK.json Handle ID: 0x74c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.Photon_cw5n1h2txyewy\Public\wsxpacks\Account\assets\strings\ml-IN.json Handle ID: 0x8b4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.Photon_cw5n1h2txyewy\Public\wsxpacks\Account\assets\strings\mr-IN.json Handle ID: 0x8b4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.Photon_cw5n1h2txyewy\Public\wsxpacks\Account\assets\strings\ms-MY.json Handle ID: 0x8b4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.Photon_cw5n1h2txyewy\Public\wsxpacks\Account\assets\strings\mt-MT.json Handle ID: 0x8b4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.Photon_cw5n1h2txyewy\Public\wsxpacks\Account\assets\strings\nb-NO.json Handle ID: 0x8b4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.Photon_cw5n1h2txyewy\Public\wsxpacks\Account\assets\strings\ne-NP.json Handle ID: 0x8b4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.Photon_cw5n1h2txyewy\Public\wsxpacks\Account\assets\strings\nl-NL.json Handle ID: 0x8b4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.Photon_cw5n1h2txyewy\Public\wsxpacks\Account\assets\strings\nn-NO.json Handle ID: 0x8b4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.Photon_cw5n1h2txyewy\Public\wsxpacks\Account\assets\strings\or-IN.json Handle ID: 0x8b4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.Photon_cw5n1h2txyewy\Public\wsxpacks\Account\assets\strings\pa-IN.json Handle ID: 0x8b4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.Photon_cw5n1h2txyewy\Public\wsxpacks\Account\assets\strings\pl-PL.json Handle ID: 0x8b4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.Photon_cw5n1h2txyewy\Public\wsxpacks\Account\assets\strings\pt-BR.json Handle ID: 0x8b4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.Photon_cw5n1h2txyewy\Public\wsxpacks\Account\assets\strings\pt-PT.json Handle ID: 0x74c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.Photon_cw5n1h2txyewy\Public\wsxpacks\Account\assets\strings\quz-PE.json Handle ID: 0x8b4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.Photon_cw5n1h2txyewy\Public\wsxpacks\Account\assets\strings\ro-RO.json Handle ID: 0x8b4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.Photon_cw5n1h2txyewy\Public\wsxpacks\Account\assets\strings\ru-RU.json Handle ID: 0x8b4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.Photon_cw5n1h2txyewy\Public\wsxpacks\Account\assets\strings\sk-SK.json Handle ID: 0x8b4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.Photon_cw5n1h2txyewy\Public\wsxpacks\Account\assets\strings\sl-SI.json Handle ID: 0x8b4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.Photon_cw5n1h2txyewy\Public\wsxpacks\Account\assets\strings\sq-AL.json Handle ID: 0x8b4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.Photon_cw5n1h2txyewy\Public\wsxpacks\Account\assets\strings\sr-Cyrl-BA.json Handle ID: 0x8b4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.Photon_cw5n1h2txyewy\Public\wsxpacks\Account\assets\strings\sr-Cyrl-RS.json Handle ID: 0x8b4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.Photon_cw5n1h2txyewy\Public\wsxpacks\Account\assets\strings\sr-Latn-RS.json Handle ID: 0x8b4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.Photon_cw5n1h2txyewy\Public\wsxpacks\Account\assets\strings\sv-SE.json Handle ID: 0x8b4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.Photon_cw5n1h2txyewy\Public\wsxpacks\Account\assets\strings\ta-IN.json Handle ID: 0x8b4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.Photon_cw5n1h2txyewy\Public\wsxpacks\Account\assets\strings\te-IN.json Handle ID: 0x8b4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.Photon_cw5n1h2txyewy\Public\wsxpacks\Account\assets\strings\th-TH.json Handle ID: 0x74c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.Photon_cw5n1h2txyewy\Public\wsxpacks\Account\assets\strings\tr-TR.json Handle ID: 0x8b4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.Photon_cw5n1h2txyewy\Public\wsxpacks\Account\assets\strings\tt-RU.json Handle ID: 0x74c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.Photon_cw5n1h2txyewy\Public\wsxpacks\Account\assets\strings\ug-CN.json Handle ID: 0x8b4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.Photon_cw5n1h2txyewy\Public\wsxpacks\Account\assets\strings\uk-UA.json Handle ID: 0x8b4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.Photon_cw5n1h2txyewy\Public\wsxpacks\Account\assets\strings\ur-PK.json Handle ID: 0x8b4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.Photon_cw5n1h2txyewy\Public\wsxpacks\Account\assets\strings\uz-Latn-UZ.json Handle ID: 0x8b4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.Photon_cw5n1h2txyewy\Public\wsxpacks\Account\assets\strings\vi-VN.json Handle ID: 0x8b4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.Photon_cw5n1h2txyewy\Public\wsxpacks\Account\assets\strings\zh-CN.json Handle ID: 0x8b4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.Photon_cw5n1h2txyewy\Public\wsxpacks\Account\assets\strings\zh-TW.json Handle ID: 0x8b4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.Photon_cw5n1h2txyewy\Public\wsxpacks\AccountControl\index.windows.bundle Handle ID: 0x8b4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.Photon_cw5n1h2txyewy\Public\wsxpacks\AccountControl\assets\strings\af-ZA.json Handle ID: 0x7dc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.Photon_cw5n1h2txyewy\Public\wsxpacks\AccountControl\assets\strings\am-ET.json Handle ID: 0x7dc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.Photon_cw5n1h2txyewy\Public\wsxpacks\AccountControl\assets\strings\ar-SA.json Handle ID: 0x7dc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.Photon_cw5n1h2txyewy\Public\wsxpacks\AccountControl\assets\strings\as-IN.json Handle ID: 0x7dc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.Photon_cw5n1h2txyewy\Public\wsxpacks\AccountControl\assets\strings\az-Latn-AZ.json Handle ID: 0x74c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.Photon_cw5n1h2txyewy\Public\wsxpacks\AccountControl\assets\strings\bg-BG.json Handle ID: 0x7dc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.Photon_cw5n1h2txyewy\Public\wsxpacks\AccountControl\assets\strings\bn-IN.json Handle ID: 0x7dc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.Photon_cw5n1h2txyewy\Public\wsxpacks\AccountControl\assets\strings\bs-Latn-BA.json Handle ID: 0x74c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.Photon_cw5n1h2txyewy\Public\wsxpacks\AccountControl\assets\strings\ca-Es-VALENCIA.json Handle ID: 0x7dc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.Photon_cw5n1h2txyewy\Public\wsxpacks\AccountControl\assets\strings\ca-ES.json Handle ID: 0x74c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.Photon_cw5n1h2txyewy\Public\wsxpacks\AccountControl\assets\strings\cs-CZ.json Handle ID: 0x7dc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.Photon_cw5n1h2txyewy\Public\wsxpacks\AccountControl\assets\strings\cy-GB.json Handle ID: 0x7dc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.Photon_cw5n1h2txyewy\Public\wsxpacks\AccountControl\assets\strings\da-DK.json Handle ID: 0x74c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.Photon_cw5n1h2txyewy\Public\wsxpacks\AccountControl\assets\strings\de-DE.json Handle ID: 0x7dc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.Photon_cw5n1h2txyewy\Public\wsxpacks\AccountControl\assets\strings\el-GR.json Handle ID: 0x7dc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.Photon_cw5n1h2txyewy\Public\wsxpacks\AccountControl\assets\strings\en-GB.json Handle ID: 0x7dc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.Photon_cw5n1h2txyewy\Public\wsxpacks\AccountControl\assets\strings\en-US.json Handle ID: 0x74c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.Photon_cw5n1h2txyewy\Public\wsxpacks\AccountControl\assets\strings\es-ES.json Handle ID: 0x7dc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.Photon_cw5n1h2txyewy\Public\wsxpacks\AccountControl\assets\strings\es-MX.json Handle ID: 0x74c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.Photon_cw5n1h2txyewy\Public\wsxpacks\AccountControl\assets\strings\et-EE.json Handle ID: 0x7dc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.Photon_cw5n1h2txyewy\Public\wsxpacks\AccountControl\assets\strings\eu-ES.json Handle ID: 0x7dc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.Photon_cw5n1h2txyewy\Public\wsxpacks\AccountControl\assets\strings\fa-IR.json Handle ID: 0x7dc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.Photon_cw5n1h2txyewy\Public\wsxpacks\AccountControl\assets\strings\fi-FI.json Handle ID: 0x7dc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.Photon_cw5n1h2txyewy\Public\wsxpacks\AccountControl\assets\strings\fil-PH.json Handle ID: 0x7dc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.Photon_cw5n1h2txyewy\Public\wsxpacks\AccountControl\assets\strings\fr-CA.json Handle ID: 0x7dc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.Photon_cw5n1h2txyewy\Public\wsxpacks\AccountControl\assets\strings\fr-FR.json Handle ID: 0x7dc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.Photon_cw5n1h2txyewy\Public\wsxpacks\AccountControl\assets\strings\ga-IE.json Handle ID: 0x74c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.Photon_cw5n1h2txyewy\Public\wsxpacks\AccountControl\assets\strings\gd-gb.json Handle ID: 0x7dc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.Photon_cw5n1h2txyewy\Public\wsxpacks\AccountControl\assets\strings\gl-ES.json Handle ID: 0x7dc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.Photon_cw5n1h2txyewy\Public\wsxpacks\AccountControl\assets\strings\gu-IN.json Handle ID: 0x7dc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.Photon_cw5n1h2txyewy\Public\wsxpacks\AccountControl\assets\strings\he-IL.json Handle ID: 0x1140 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.Photon_cw5n1h2txyewy\Public\wsxpacks\AccountControl\assets\strings\hi-IN.json Handle ID: 0x74c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.Photon_cw5n1h2txyewy\Public\wsxpacks\AccountControl\assets\strings\hr-HR.json Handle ID: 0x7dc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.Photon_cw5n1h2txyewy\Public\wsxpacks\AccountControl\assets\strings\hu-HU.json Handle ID: 0x7dc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.Photon_cw5n1h2txyewy\Public\wsxpacks\AccountControl\assets\strings\hy-AM.json Handle ID: 0x7dc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.Photon_cw5n1h2txyewy\Public\wsxpacks\AccountControl\assets\strings\id-ID.json Handle ID: 0x7dc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.Photon_cw5n1h2txyewy\Public\wsxpacks\AccountControl\assets\strings\is-IS.json Handle ID: 0x7dc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.Photon_cw5n1h2txyewy\Public\wsxpacks\AccountControl\assets\strings\it-IT.json Handle ID: 0x7dc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.Photon_cw5n1h2txyewy\Public\wsxpacks\AccountControl\assets\strings\ja-JP.json Handle ID: 0x7dc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.Photon_cw5n1h2txyewy\Public\wsxpacks\AccountControl\assets\strings\ka-GE.json Handle ID: 0x7dc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.Photon_cw5n1h2txyewy\Public\wsxpacks\AccountControl\assets\strings\kk-KZ.json Handle ID: 0x7dc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.Photon_cw5n1h2txyewy\Public\wsxpacks\AccountControl\assets\strings\km-KH.json Handle ID: 0x7dc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.Photon_cw5n1h2txyewy\Public\wsxpacks\AccountControl\assets\strings\kn-IN.json Handle ID: 0x7dc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.Photon_cw5n1h2txyewy\Public\wsxpacks\AccountControl\assets\strings\ko-KR.json Handle ID: 0x7dc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.Photon_cw5n1h2txyewy\Public\wsxpacks\AccountControl\assets\strings\kok-IN.json Handle ID: 0x7dc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.Photon_cw5n1h2txyewy\Public\wsxpacks\AccountControl\assets\strings\lb-LU.json Handle ID: 0x74c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.Photon_cw5n1h2txyewy\Public\wsxpacks\AccountControl\assets\strings\lo-LA.json Handle ID: 0x7dc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.Photon_cw5n1h2txyewy\Public\wsxpacks\AccountControl\assets\strings\lt-LT.json Handle ID: 0x1140 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.Photon_cw5n1h2txyewy\Public\wsxpacks\AccountControl\assets\strings\lv-LV.json Handle ID: 0x7dc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.Photon_cw5n1h2txyewy\Public\wsxpacks\AccountControl\assets\strings\mi-NZ.json Handle ID: 0x7dc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.Photon_cw5n1h2txyewy\Public\wsxpacks\AccountControl\assets\strings\mk-MK.json Handle ID: 0x7dc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.Photon_cw5n1h2txyewy\Public\wsxpacks\AccountControl\assets\strings\ml-IN.json Handle ID: 0x7dc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.Photon_cw5n1h2txyewy\Public\wsxpacks\AccountControl\assets\strings\mr-IN.json Handle ID: 0x7dc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.Photon_cw5n1h2txyewy\Public\wsxpacks\AccountControl\assets\strings\ms-MY.json Handle ID: 0x7dc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.Photon_cw5n1h2txyewy\Public\wsxpacks\AccountControl\assets\strings\mt-MT.json Handle ID: 0x7dc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.Photon_cw5n1h2txyewy\Public\wsxpacks\AccountControl\assets\strings\nb-NO.json Handle ID: 0x7dc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.Photon_cw5n1h2txyewy\Public\wsxpacks\AccountControl\assets\strings\ne-NP.json Handle ID: 0x7dc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.Photon_cw5n1h2txyewy\Public\wsxpacks\AccountControl\assets\strings\nl-NL.json Handle ID: 0x74c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.Photon_cw5n1h2txyewy\Public\wsxpacks\AccountControl\assets\strings\nn-NO.json Handle ID: 0x7dc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.Photon_cw5n1h2txyewy\Public\wsxpacks\AccountControl\assets\strings\or-IN.json Handle ID: 0x1140 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.Photon_cw5n1h2txyewy\Public\wsxpacks\AccountControl\assets\strings\pa-IN.json Handle ID: 0x7dc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.Photon_cw5n1h2txyewy\Public\wsxpacks\AccountControl\assets\strings\pl-PL.json Handle ID: 0x7dc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.Photon_cw5n1h2txyewy\Public\wsxpacks\AccountControl\assets\strings\pt-BR.json Handle ID: 0x734 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.Photon_cw5n1h2txyewy\Public\wsxpacks\AccountControl\assets\strings\pt-PT.json Handle ID: 0x7dc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.Photon_cw5n1h2txyewy\Public\wsxpacks\AccountControl\assets\strings\quz-PE.json Handle ID: 0x7dc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.Photon_cw5n1h2txyewy\Public\wsxpacks\AccountControl\assets\strings\ro-RO.json Handle ID: 0x7dc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.Photon_cw5n1h2txyewy\Public\wsxpacks\AccountControl\assets\strings\ru-RU.json Handle ID: 0x7dc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.Photon_cw5n1h2txyewy\Public\wsxpacks\AccountControl\assets\strings\sk-SK.json Handle ID: 0x7dc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.Photon_cw5n1h2txyewy\Public\wsxpacks\AccountControl\assets\strings\sl-SI.json Handle ID: 0x7dc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.Photon_cw5n1h2txyewy\Public\wsxpacks\AccountControl\assets\strings\sq-AL.json Handle ID: 0x7dc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.Photon_cw5n1h2txyewy\Public\wsxpacks\AccountControl\assets\strings\sr-Cyrl-BA.json Handle ID: 0x7dc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.Photon_cw5n1h2txyewy\Public\wsxpacks\AccountControl\assets\strings\sr-Cyrl-RS.json Handle ID: 0x7dc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.Photon_cw5n1h2txyewy\Public\wsxpacks\AccountControl\assets\strings\sr-Latn-RS.json Handle ID: 0x7dc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.Photon_cw5n1h2txyewy\Public\wsxpacks\AccountControl\assets\strings\sv-SE.json Handle ID: 0x7dc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.Photon_cw5n1h2txyewy\Public\wsxpacks\AccountControl\assets\strings\ta-IN.json Handle ID: 0x7dc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.Photon_cw5n1h2txyewy\Public\wsxpacks\AccountControl\assets\strings\te-IN.json Handle ID: 0x7dc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.Photon_cw5n1h2txyewy\Public\wsxpacks\AccountControl\assets\strings\th-TH.json Handle ID: 0x7dc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.Photon_cw5n1h2txyewy\Public\wsxpacks\AccountControl\assets\strings\tr-TR.json Handle ID: 0x7dc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.Photon_cw5n1h2txyewy\Public\wsxpacks\AccountControl\assets\strings\tt-RU.json Handle ID: 0x7dc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.Photon_cw5n1h2txyewy\Public\wsxpacks\AccountControl\assets\strings\ug-CN.json Handle ID: 0x7dc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.Photon_cw5n1h2txyewy\Public\wsxpacks\AccountControl\assets\strings\uk-UA.json Handle ID: 0x7dc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.Photon_cw5n1h2txyewy\Public\wsxpacks\AccountControl\assets\strings\ur-PK.json Handle ID: 0x7dc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.Photon_cw5n1h2txyewy\Public\wsxpacks\AccountControl\assets\strings\uz-Latn-UZ.json Handle ID: 0x7dc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.Photon_cw5n1h2txyewy\Public\wsxpacks\AccountControl\assets\strings\vi-VN.json Handle ID: 0x7dc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.Photon_cw5n1h2txyewy\Public\wsxpacks\AccountControl\assets\strings\zh-CN.json Handle ID: 0x7dc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.Photon_cw5n1h2txyewy\Public\wsxpacks\AccountControl\assets\strings\zh-TW.json Handle ID: 0x7dc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.Client.Photon_cw5n1h2txyewy\Public\wsxpacks\StartMenu\index.windows.bundle Handle ID: 0x7dc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\MicrosoftWindows.UndockedDevKit_cw5n1h2txyewy\windowsudk.winmd Handle ID: 0x7dc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\ParentalControls_cw5n1h2txyewy\resources.pri Handle ID: 0x7dc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\ParentalControls_cw5n1h2txyewy\WpcUapApp.exe Handle ID: 0x74c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\Shared\AllAppCategoryMappings\AD5F74EF4F881C8414B1341CA4A5A04CA9A1610F1613BEFEC72A3BA1912E07DD\AllAppCategoryMappings Handle ID: 0x7dc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\Shared\AOT\AccountDialog.AOT.dll Handle ID: 0x7dc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\Shared\AOT\ActionUI.AOT.dll Handle ID: 0x7dc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\Shared\AOT\AppActions.dll Handle ID: 0x8ac Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\Shared\AOT\AppActions.exe Handle ID: 0x8ac Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\Shared\AOT\FeatureDiscoverability.AOT.dll Handle ID: 0x1140 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\Shared\AOT\FileExplorerManaged.dll Handle ID: 0x1140 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\Shared\AOT\OSClient.NET.dll Handle ID: 0x1140 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\Shared\AOT\OSClient.UWP.dll Handle ID: 0x1140 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\Shared\AOT\SettingsModelService.AOT.dll Handle ID: 0x1140 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\Shared\AOT\StartMenu.NET.dll Handle ID: 0x7dc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\Shared\AOT\WindowsPersonaCard.dll Handle ID: 0x7dc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\Shared\FPIEProcessor\3CB6B3391B58582237A3A5C640CED0440CF26E35A610CB8BF633B13A06890EFD\FPIEProcessor.dll Handle ID: 0x1140 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\Shared\FPIEProcessor\6425904D6F9F95F674A3693E677A787C6C22846488DBB132CF5433D606332BAD\FPIEProcessor.dll Handle ID: 0x8ac Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\Shared\Microsoft.CognitiveServices.Speech.core\A77D5587A6604373F1508028836082E1E2763F86B8A7D562BEB54F0D6DCE8AE4\Microsoft.CognitiveServices.Speech.core.dll Handle ID: 0x7dc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\Shared\Microsoft.CognitiveServices.Speech.extension.audio.sys\D21A2A332654B34B49895C7DF035F828EA3B46E50374ACECA8F67AEFBE0F173C\Microsoft.CognitiveServices.Speech.extension.audio.sys.dll Handle ID: 0x7dc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\Shared\Microsoft.CognitiveServices.Speech.extension.embedded.sr\1B8F305A7D0EA6462C5A874EA606D76ECC5B589A7D23AC6BC12AA9CA134A324F\Microsoft.CognitiveServices.Speech.extension.embedded.sr.dll Handle ID: 0x7dc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\Shared\Microsoft.CognitiveServices.Speech.extension.embedded.sr\38C64DB7A9A9545D5594269F50F6FF9219969F049E1AFC73EAB1E807F1888E2C\Microsoft.CognitiveServices.Speech.extension.embedded.sr.dll Handle ID: 0x7dc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\Shared\Microsoft.CognitiveServices.Speech.extension.embedded.sr.runtime\B807524322D4AABF256C765FE34258DD51E9B8210FA14520A2D09F4B48CAEA10\Microsoft.CognitiveServices.Speech.extension.embedded.sr.runtime.dll Handle ID: 0x7dc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\Shared\Microsoft.CognitiveServices.Speech.extension.embedded.tts\F0341EB0B18FBE7BDB8544CE12A34C04E090CF68AF0F056DC51AE3DFA605F209\Microsoft.CognitiveServices.Speech.extension.embedded.tts.dll Handle ID: 0x7dc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\Shared\Microsoft.CognitiveServices.Speech.extension.lu\E05CE80209D30490B43788E51252653815403F5AF678BAB2056B198E2BD037FF\Microsoft.CognitiveServices.Speech.extension.lu.dll Handle ID: 0x8b4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\Shared\Microsoft.CognitiveServices.Speech.extension.mas\88A921F04841C5A133CBE2940D0CFCA6195C0C81A6044C2AA47F0D2AF7427AA0\Microsoft.CognitiveServices.Speech.extension.mas.dll Handle ID: 0x8b4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\Shared\Microsoft.CognitiveServices.Speech.extension.mas\A95069BC34B7DEBA398EE56177C11FE6BA55CCB27A6C91229444CE042A8241F9\Microsoft.CognitiveServices.Speech.extension.mas.dll Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\Shared\Microsoft.CognitiveServices.Speech.extension.onnxruntime\D279E440EFA1FFB1BD06AF6F5ED1B27BC7DCB993D63532AE8727FF78B020291E\Microsoft.CognitiveServices.Speech.extension.onnxruntime.dll Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\Shared\Microsoft.CognitiveServices.Speech.extension.telemetry\9194DBA0DC90151BDE9C57E541896E98AFDC2442EE06C0B6560C92E702322226\Microsoft.CognitiveServices.Speech.extension.telemetry.dll Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\Shared\WebView2SDK\webview2standalone.dll Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\AppxManifest.xml Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\AppxSignature.p7x Handle ID: 0x8b4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\BatteryFlyoutExperience.dll Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ClockFlyoutExperience.dll Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\DevicesFlowUI.dll Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ImeStatusNotification.dll Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\Insights.dll Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\MtcUvc.dll Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\PenWorkspace.dll Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\QuickConnectUI.dll Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\SharePickerUI.dll Handle ID: 0x8b4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\VirtualTouchpadUI.dll Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\Windows.UI.ActionCenter.dll Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\Windows.UI.QuickActions.dll Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\Windows.UI.SoftLanding.dll Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\SxS\MicrosoftWindows.54792954.Filons_cw5n1h2txyewy\appxblockmap.xml Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\SxS\MicrosoftWindows.54792954.Filons_cw5n1h2txyewy\appxmanifest.xml Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\SxS\MicrosoftWindows.54792954.Filons_cw5n1h2txyewy\FileExplorerExtensions.dll Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\SxS\MicrosoftWindows.54792954.Filons_cw5n1h2txyewy\FileExplorerManaged.dll Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\SxS\MicrosoftWindows.54792954.Filons_cw5n1h2txyewy\resources.pri Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\SxS\MicrosoftWindows.54792954.Filons_cw5n1h2txyewy\FileExplorerExtensions\Assets\images\contrast-black\Windows.SpotlightImageLearnMore.svg Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\SxS\MicrosoftWindows.54792954.Filons_cw5n1h2txyewy\FileExplorerExtensions\Assets\images\contrast-black\Windows.SpotlightNextImage.svg Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\SxS\MicrosoftWindows.54792954.Filons_cw5n1h2txyewy\FileExplorerExtensions\Assets\images\contrast-standard\theme-dark\Windows.SpotlightImageLearnMore.svg Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\SxS\MicrosoftWindows.54792954.Filons_cw5n1h2txyewy\FileExplorerExtensions\Assets\images\contrast-standard\theme-dark\Windows.SpotlightNextImage.svg Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\SxS\MicrosoftWindows.54792954.Filons_cw5n1h2txyewy\FileExplorerExtensions\Assets\images\contrast-standard\theme-light\Windows.SpotlightImageLearnMore.svg Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\SxS\MicrosoftWindows.54792954.Filons_cw5n1h2txyewy\FileExplorerExtensions\Assets\images\contrast-standard\theme-light\Windows.SpotlightNextImage.svg Handle ID: 0x8b4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\SxS\MicrosoftWindows.54792954.Filons_cw5n1h2txyewy\FileExplorerExtensions\Assets\images\contrast-white\Windows.SpotlightImageLearnMore.svg Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\SxS\MicrosoftWindows.54792954.Filons_cw5n1h2txyewy\FileExplorerExtensions\Assets\images\contrast-white\Windows.SpotlightNextImage.svg Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\SxS\MicrosoftWindows.58680125.Speion_cw5n1h2txyewy\appxblockmap.xml Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\SxS\MicrosoftWindows.58680125.Speion_cw5n1h2txyewy\appxmanifest.xml Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\SxS\MicrosoftWindows.58680125.Speion_cw5n1h2txyewy\appxsignature.p7x Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\SxS\MicrosoftWindows.58680125.Speion_cw5n1h2txyewy\resources.pri Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\SxS\MicrosoftWindows.58680125.Speion_cw5n1h2txyewy\SpeechSynthesizerExtension.dll Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\SxS\MicrosoftWindows.58680125.Speion_cw5n1h2txyewy\Assets\LockScreenLogo.scale-200.png Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\SxS\MicrosoftWindows.58680125.Speion_cw5n1h2txyewy\Assets\SplashScreen.scale-200.png Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\SxS\MicrosoftWindows.58680125.Speion_cw5n1h2txyewy\Assets\Square150x150Logo.scale-200.png Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\SxS\MicrosoftWindows.58680125.Speion_cw5n1h2txyewy\Assets\Square44x44Logo.scale-200.png Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\SxS\MicrosoftWindows.58680125.Speion_cw5n1h2txyewy\Assets\StoreLogo.png Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\SxS\MicrosoftWindows.58680125.Speion_cw5n1h2txyewy\Assets\StoreLogo.scale-100.png Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\SxS\MicrosoftWindows.58680125.Speion_cw5n1h2txyewy\SpeechSynthesizer\SpeechSynthesizer.manifest Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\SxS\MicrosoftWindows.58681517.Voiess_cw5n1h2txyewy\appxblockmap.xml Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\SxS\MicrosoftWindows.58681517.Voiess_cw5n1h2txyewy\appxmanifest.xml Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\SxS\MicrosoftWindows.58681517.Voiess_cw5n1h2txyewy\appxsignature.p7x Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\SxS\MicrosoftWindows.58681517.Voiess_cw5n1h2txyewy\CommandExecutor.dll Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\SxS\MicrosoftWindows.58681517.Voiess_cw5n1h2txyewy\CommandExecutorExtension.dll Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\SxS\MicrosoftWindows.58681517.Voiess_cw5n1h2txyewy\FREUserInterface.dll Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\SxS\MicrosoftWindows.58681517.Voiess_cw5n1h2txyewy\resources.pri Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\SxS\MicrosoftWindows.58681517.Voiess_cw5n1h2txyewy\SpeechRecognizer.dll Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\SxS\MicrosoftWindows.58681517.Voiess_cw5n1h2txyewy\SpeechRecognizerExtension.dll Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\SxS\MicrosoftWindows.58681517.Voiess_cw5n1h2txyewy\VoiceAccess.dll Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\SxS\MicrosoftWindows.58681517.Voiess_cw5n1h2txyewy\VoiceAccessCommon.dll Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\SxS\MicrosoftWindows.58681517.Voiess_cw5n1h2txyewy\VoiceAccessHost.dll Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\SxS\MicrosoftWindows.58681517.Voiess_cw5n1h2txyewy\VoiceAccessPlugin.dll Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\SxS\MicrosoftWindows.58681517.Voiess_cw5n1h2txyewy\VoiceAccessUserInterface.dll Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\SxS\MicrosoftWindows.58681517.Voiess_cw5n1h2txyewy\Assets\LockScreenLogo.scale-200.png Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\SxS\MicrosoftWindows.58681517.Voiess_cw5n1h2txyewy\Assets\SplashScreen.scale-200.png Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\SxS\MicrosoftWindows.58681517.Voiess_cw5n1h2txyewy\Assets\Square150x150Logo.scale-200.png Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\SxS\MicrosoftWindows.58681517.Voiess_cw5n1h2txyewy\Assets\Square44x44Logo.scale-200.png Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\SxS\MicrosoftWindows.58681517.Voiess_cw5n1h2txyewy\Assets\StoreLogo.png Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\SxS\MicrosoftWindows.58681517.Voiess_cw5n1h2txyewy\Assets\StoreLogo.scale-100.png Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\SxS\MicrosoftWindows.58681517.Voiess_cw5n1h2txyewy\FREUserInterface\Assets\Backpack.png Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\SxS\MicrosoftWindows.58681517.Voiess_cw5n1h2txyewy\FREUserInterface\Assets\Bike.png Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\SxS\MicrosoftWindows.58681517.Voiess_cw5n1h2txyewy\FREUserInterface\Assets\Box.png Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\SxS\MicrosoftWindows.58681517.Voiess_cw5n1h2txyewy\FREUserInterface\Assets\Cactus.png Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\SxS\MicrosoftWindows.58681517.Voiess_cw5n1h2txyewy\FREUserInterface\Assets\calendar.png Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\SxS\MicrosoftWindows.58681517.Voiess_cw5n1h2txyewy\FREUserInterface\Assets\Cat.png Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\SxS\MicrosoftWindows.58681517.Voiess_cw5n1h2txyewy\FREUserInterface\Assets\Dog.png Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\SxS\MicrosoftWindows.58681517.Voiess_cw5n1h2txyewy\FREUserInterface\Assets\MicrophonePage.png Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\SxS\MicrosoftWindows.58681517.Voiess_cw5n1h2txyewy\FREUserInterface\Assets\Shadow.png Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\SxS\MicrosoftWindows.58681517.Voiess_cw5n1h2txyewy\FREUserInterface\Assets\Shelf.png Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\SxS\MicrosoftWindows.58681517.Voiess_cw5n1h2txyewy\FREUserInterface\Assets\WelcomePage.png Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\SxS\MicrosoftWindows.58681517.Voiess_cw5n1h2txyewy\FREUserInterface\Assets\Content\de-DE\CommandHelpWindowContent.json Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\SxS\MicrosoftWindows.58681517.Voiess_cw5n1h2txyewy\FREUserInterface\Assets\Content\en-GB\CommandHelpWindowContent.json Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\SxS\MicrosoftWindows.58681517.Voiess_cw5n1h2txyewy\FREUserInterface\Assets\Content\en-US\CommandHelp.json Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\SxS\MicrosoftWindows.58681517.Voiess_cw5n1h2txyewy\FREUserInterface\Assets\Content\en-US\CommandHelpWindowContent.json Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\SxS\MicrosoftWindows.58681517.Voiess_cw5n1h2txyewy\FREUserInterface\Assets\Content\en-US\Content.localized.json Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\SxS\MicrosoftWindows.58681517.Voiess_cw5n1h2txyewy\FREUserInterface\Assets\Content\es-ES\CommandHelpWindowContent.json Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\SxS\MicrosoftWindows.58681517.Voiess_cw5n1h2txyewy\FREUserInterface\Assets\Content\es-MX\CommandHelpWindowContent.json Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\SxS\MicrosoftWindows.58681517.Voiess_cw5n1h2txyewy\FREUserInterface\Assets\Content\fr-CA\CommandHelpWindowContent.json Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\SxS\MicrosoftWindows.58681517.Voiess_cw5n1h2txyewy\FREUserInterface\Assets\Content\fr-FR\CommandHelpWindowContent.json Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\SxS\MicrosoftWindows.58681517.Voiess_cw5n1h2txyewy\FREUserInterface\Assets\Content\hi-IN\CommandHelpWindowContent.json Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\SxS\MicrosoftWindows.58681517.Voiess_cw5n1h2txyewy\FREUserInterface\Assets\Content\ja-JP\CommandHelpWindowContent.json Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\SxS\MicrosoftWindows.58681517.Voiess_cw5n1h2txyewy\FREUserInterface\Assets\Content\zh-CN\CommandHelpWindowContent.json Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\SxS\MicrosoftWindows.58681517.Voiess_cw5n1h2txyewy\FREUserInterface\Assets\Content\zh-HK\CommandHelpWindowContent.json Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\SxS\MicrosoftWindows.58681517.Voiess_cw5n1h2txyewy\FREUserInterface\Assets\Content\zh-TW\CommandHelpWindowContent.json Handle ID: 0x8b4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\SxS\MicrosoftWindows.58681517.Voiess_cw5n1h2txyewy\IntentDefinitions\Strings\de-DE\IntentMapping.json Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\SxS\MicrosoftWindows.58681517.Voiess_cw5n1h2txyewy\IntentDefinitions\Strings\en-GB\IntentMapping.json Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\SxS\MicrosoftWindows.58681517.Voiess_cw5n1h2txyewy\IntentDefinitions\Strings\en-US\IntentMapping.json Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\SxS\MicrosoftWindows.58681517.Voiess_cw5n1h2txyewy\IntentDefinitions\Strings\es-ES\IntentMapping.json Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\SxS\MicrosoftWindows.58681517.Voiess_cw5n1h2txyewy\IntentDefinitions\Strings\es-MX\IntentMapping.json Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\SxS\MicrosoftWindows.58681517.Voiess_cw5n1h2txyewy\IntentDefinitions\Strings\fr-CA\IntentMapping.json Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\SxS\MicrosoftWindows.58681517.Voiess_cw5n1h2txyewy\IntentDefinitions\Strings\fr-FR\IntentMapping.json Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\SxS\MicrosoftWindows.58681517.Voiess_cw5n1h2txyewy\IntentDefinitions\Strings\hi-IN\IntentMapping.json Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\SxS\MicrosoftWindows.58681517.Voiess_cw5n1h2txyewy\VoiceAccess\VoiceAccess.manifest Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\SxS\MicrosoftWindows.58681517.Voiess_cw5n1h2txyewy\VoiceAccessCommon\FlexibleCommandingTrainingFile.json Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\SxS\MicrosoftWindows.58681517.Voiess_cw5n1h2txyewy\VoiceAccessCommon\Homophones.json Handle ID: 0x8b4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\SxS\MicrosoftWindows.58681517.Voiess_cw5n1h2txyewy\VoiceAccessCommon\IntentEntityMap.json Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\SxS\MicrosoftWindows.58681517.Voiess_cw5n1h2txyewy\VoiceAccessHost\UIElementNames.xml Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\SxS\MicrosoftWindows.58681517.Voiess_cw5n1h2txyewy\VoiceAccessHost\VoiceAccessSupportedLanguages.xml Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\SxS\MicrosoftWindows.58681517.Voiess_cw5n1h2txyewy\VoiceAccessHost\VoiceCommands.xml Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\SxS\MicrosoftWindows.58681517.Voiess_cw5n1h2txyewy\VoiceAccessHost\Strings\de-DE\UIElementNames.xml Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\SxS\MicrosoftWindows.58681517.Voiess_cw5n1h2txyewy\VoiceAccessHost\Strings\en-US\UIElementNames.xml Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\SxS\MicrosoftWindows.58681517.Voiess_cw5n1h2txyewy\VoiceAccessHost\Strings\es-ES\UIElementNames.xml Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\SxS\MicrosoftWindows.58681517.Voiess_cw5n1h2txyewy\VoiceAccessHost\Strings\es-MX\UIElementNames.xml Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\SxS\MicrosoftWindows.58681517.Voiess_cw5n1h2txyewy\VoiceAccessHost\Strings\fr-CA\UIElementNames.xml Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\SxS\MicrosoftWindows.58681517.Voiess_cw5n1h2txyewy\VoiceAccessHost\Strings\fr-FR\UIElementNames.xml Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\SxS\MicrosoftWindows.58681517.Voiess_cw5n1h2txyewy\VoiceAccessHost\Strings\zh-HK\UIElementNames.xml Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\SxS\MicrosoftWindows.58681560.Livtop_cw5n1h2txyewy\appxblockmap.xml Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\SxS\MicrosoftWindows.58681560.Livtop_cw5n1h2txyewy\appxmanifest.xml Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\SxS\MicrosoftWindows.58681560.Livtop_cw5n1h2txyewy\appxsignature.p7x Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\SxS\MicrosoftWindows.58681560.Livtop_cw5n1h2txyewy\LiveCaptions.dll Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\SxS\MicrosoftWindows.58681560.Livtop_cw5n1h2txyewy\LiveCaptionsBackendDll.dll Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\SxS\MicrosoftWindows.58681560.Livtop_cw5n1h2txyewy\LiveCaptionsDesktop.dll Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\SxS\MicrosoftWindows.58681560.Livtop_cw5n1h2txyewy\LiveCaptionsXamlApplication.dll Handle ID: 0x8b4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\SxS\MicrosoftWindows.58681560.Livtop_cw5n1h2txyewy\resources.pri Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\SxS\MicrosoftWindows.58681560.Livtop_cw5n1h2txyewy\Assets\LockScreenLogo.scale-200.png Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\SxS\MicrosoftWindows.58681560.Livtop_cw5n1h2txyewy\Assets\SplashScreen.scale-200.png Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\SxS\MicrosoftWindows.58681560.Livtop_cw5n1h2txyewy\Assets\Square150x150Logo.scale-200.png Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\SxS\MicrosoftWindows.58681560.Livtop_cw5n1h2txyewy\Assets\Square44x44Logo.scale-200.png Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\SxS\MicrosoftWindows.58681560.Livtop_cw5n1h2txyewy\Assets\StoreLogo.png Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\SxS\MicrosoftWindows.58681560.Livtop_cw5n1h2txyewy\Assets\StoreLogo.scale-100.png Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\SxS\MicrosoftWindows.58681560.Livtop_cw5n1h2txyewy\LiveCaptions\LiveCaptions.manifest Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\SxS\MicrosoftWindows.58683691.InpApp_cw5n1h2txyewy\appxblockmap.xml Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\SxS\MicrosoftWindows.58683691.InpApp_cw5n1h2txyewy\appxmanifest.xml Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\SxS\MicrosoftWindows.58683691.InpApp_cw5n1h2txyewy\appxsignature.p7x Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\SxS\MicrosoftWindows.58683691.InpApp_cw5n1h2txyewy\HardwareKeyboardUX.dll Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\SxS\MicrosoftWindows.58683691.InpApp_cw5n1h2txyewy\InputApp.dll Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\SxS\MicrosoftWindows.58683691.InpApp_cw5n1h2txyewy\LayoutData.dll Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\SxS\MicrosoftWindows.58683691.InpApp_cw5n1h2txyewy\resources.pri Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\SxS\MicrosoftWindows.58683691.InpApp_cw5n1h2txyewy\SmartActionsUX.dll Handle ID: 0x8b4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\SxS\MicrosoftWindows.58683691.InpApp_cw5n1h2txyewy\TextInput.CarbonDictation.dll Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\SxS\MicrosoftWindows.58683691.InpApp_cw5n1h2txyewy\TextInput.DictationUI.dll Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\SxS\MicrosoftWindows.58683691.InpApp_cw5n1h2txyewy\TextInput.dll Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\SxS\MicrosoftWindows.58683691.InpApp_cw5n1h2txyewy\TextInputCommon.dll Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\SxS\MicrosoftWindows.58683691.InpApp_cw5n1h2txyewy\TextInputExtensions.dll Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\SxS\MicrosoftWindows.58683691.InpApp_cw5n1h2txyewy\TextInputHost.exe Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\SxS\MicrosoftWindows.58683691.InpApp_cw5n1h2txyewy\TextInputLayoutData.dll Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\SxS\MicrosoftWindows.58683691.InpApp_cw5n1h2txyewy\TouchKeyboardUX.dll Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\SxS\MicrosoftWindows.58683691.InpApp_cw5n1h2txyewy\WindowsInternal.ComposableShell.Experiences.SuggestionUIUndocked.dll Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\SxS\MicrosoftWindows.58683691.InpApp_cw5n1h2txyewy\WindowsInternal.ComposableShell.Experiences.SuggestionUIUndocked.winmd Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\SxS\MicrosoftWindows.58683691.InpApp_cw5n1h2txyewy\Assets\LockScreenLogo.scale-200.png Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\SxS\MicrosoftWindows.58683691.InpApp_cw5n1h2txyewy\Assets\SplashScreen.scale-200.png Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\SxS\MicrosoftWindows.58683691.InpApp_cw5n1h2txyewy\Assets\Square150x150Logo.scale-200.png Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\SxS\MicrosoftWindows.58683691.InpApp_cw5n1h2txyewy\Assets\Square44x44Logo.scale-200.png Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\SxS\MicrosoftWindows.58683691.InpApp_cw5n1h2txyewy\Assets\StoreLogo.png Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\SxS\MicrosoftWindows.58683691.InpApp_cw5n1h2txyewy\Assets\StoreLogo.scale-100.png Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\SxS\MicrosoftWindows.58683691.InpApp_cw5n1h2txyewy\InputApp\Assets\BadgeLogo.scale-100.png Handle ID: 0x8b4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\SxS\MicrosoftWindows.58683691.InpApp_cw5n1h2txyewy\InputApp\Assets\BadgeLogo.scale-125.png Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\SxS\MicrosoftWindows.58683691.InpApp_cw5n1h2txyewy\InputApp\Assets\BadgeLogo.scale-150.png Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\SxS\MicrosoftWindows.58683691.InpApp_cw5n1h2txyewy\InputApp\Assets\BadgeLogo.scale-200.png Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\SxS\MicrosoftWindows.58683691.InpApp_cw5n1h2txyewy\InputApp\Assets\BadgeLogo.scale-400.png Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\SxS\MicrosoftWindows.58683691.InpApp_cw5n1h2txyewy\InputApp\Assets\KbdAccentPicker.wav Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\SxS\MicrosoftWindows.58683691.InpApp_cw5n1h2txyewy\InputApp\Assets\KbdFunction.wav Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\SxS\MicrosoftWindows.58683691.InpApp_cw5n1h2txyewy\InputApp\Assets\KbdFunctionModernUX.wav Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\SxS\MicrosoftWindows.58683691.InpApp_cw5n1h2txyewy\InputApp\Assets\KbdKeyTap.wav Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\SxS\MicrosoftWindows.58683691.InpApp_cw5n1h2txyewy\InputApp\Assets\KbdKeyTapModernUX.wav Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\SxS\MicrosoftWindows.58683691.InpApp_cw5n1h2txyewy\InputApp\Assets\KbdSpacebar.wav Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\SxS\MicrosoftWindows.58683691.InpApp_cw5n1h2txyewy\InputApp\Assets\KbdSpaceBarModernUX.wav Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\SxS\MicrosoftWindows.58683691.InpApp_cw5n1h2txyewy\InputApp\Assets\KbdSwipeGesture.wav Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\SxS\MicrosoftWindows.58683691.InpApp_cw5n1h2txyewy\InputApp\Assets\SplashScreen.scale-100.png Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\SxS\MicrosoftWindows.58683691.InpApp_cw5n1h2txyewy\InputApp\Assets\SplashScreen.scale-125.png Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\SxS\MicrosoftWindows.58683691.InpApp_cw5n1h2txyewy\InputApp\Assets\SplashScreen.scale-150.png Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\SxS\MicrosoftWindows.58683691.InpApp_cw5n1h2txyewy\InputApp\Assets\SplashScreen.scale-200.png Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\SxS\MicrosoftWindows.58683691.InpApp_cw5n1h2txyewy\InputApp\Assets\SplashScreen.scale-400.png Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\SxS\MicrosoftWindows.58683691.InpApp_cw5n1h2txyewy\InputApp\Assets\SquareLogo150x150.scale-100.png Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\SxS\MicrosoftWindows.58683691.InpApp_cw5n1h2txyewy\InputApp\Assets\SquareLogo150x150.scale-200.png Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\SxS\MicrosoftWindows.58683691.InpApp_cw5n1h2txyewy\InputApp\Assets\SquareLogo150x150.scale-400.png Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\SxS\MicrosoftWindows.58683691.InpApp_cw5n1h2txyewy\InputApp\Assets\SquareLogo310x310.scale-100.png Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\SxS\MicrosoftWindows.58683691.InpApp_cw5n1h2txyewy\InputApp\Assets\SquareLogo310x310.scale-200.png Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\SxS\MicrosoftWindows.58683691.InpApp_cw5n1h2txyewy\InputApp\Assets\SquareLogo310x310.scale-400.png Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\SxS\MicrosoftWindows.58683691.InpApp_cw5n1h2txyewy\InputApp\Assets\SquareLogo44x44.scale-100.png Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\SxS\MicrosoftWindows.58683691.InpApp_cw5n1h2txyewy\InputApp\Assets\SquareLogo44x44.scale-200.png Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\SxS\MicrosoftWindows.58683691.InpApp_cw5n1h2txyewy\InputApp\Assets\SquareLogo44x44.scale-400.png Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\SxS\MicrosoftWindows.58683691.InpApp_cw5n1h2txyewy\InputApp\Assets\SquareLogo71x71.scale-100.png Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\SxS\MicrosoftWindows.58683691.InpApp_cw5n1h2txyewy\InputApp\Assets\SquareLogo71x71.scale-200.png Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\SxS\MicrosoftWindows.58683691.InpApp_cw5n1h2txyewy\InputApp\Assets\SquareLogo71x71.scale-400.png Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\SxS\MicrosoftWindows.58683691.InpApp_cw5n1h2txyewy\InputApp\Assets\StoreLogo.scale-100.png Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\SxS\MicrosoftWindows.58683691.InpApp_cw5n1h2txyewy\InputApp\Assets\StoreLogo.scale-125.png Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\SxS\MicrosoftWindows.58683691.InpApp_cw5n1h2txyewy\InputApp\Assets\StoreLogo.scale-150.png Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:49 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\SxS\MicrosoftWindows.58683691.InpApp_cw5n1h2txyewy\InputApp\Assets\StoreLogo.scale-200.png Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\SxS\MicrosoftWindows.58683691.InpApp_cw5n1h2txyewy\InputApp\Assets\StoreLogo.scale-400.png Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\SxS\MicrosoftWindows.58683691.InpApp_cw5n1h2txyewy\InputApp\Assets\WideLogo310x150.scale-100.png Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\SxS\MicrosoftWindows.58683691.InpApp_cw5n1h2txyewy\InputApp\Assets\WideLogo310x150.scale-200.png Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\SxS\MicrosoftWindows.58683691.InpApp_cw5n1h2txyewy\InputApp\Assets\WideLogo310x150.scale-400.png Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\SxS\MicrosoftWindows.58683691.InpApp_cw5n1h2txyewy\InputApp\Assets\Dictation\Access.svg Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\SxS\MicrosoftWindows.58683691.InpApp_cw5n1h2txyewy\InputApp\Assets\Dictation\BasicCancelledEarcon.wav Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\SxS\MicrosoftWindows.58683691.InpApp_cw5n1h2txyewy\InputApp\Assets\Dictation\BasicDoneListeningEarcon.wav Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\SxS\MicrosoftWindows.58683691.InpApp_cw5n1h2txyewy\InputApp\Assets\Dictation\BasicListeningEarcon.wav Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\SxS\MicrosoftWindows.58683691.InpApp_cw5n1h2txyewy\InputApp\Assets\Dictation\Choice.svg Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\SxS\MicrosoftWindows.58683691.InpApp_cw5n1h2txyewy\InputApp\Assets\Dictation\De-ID.svg Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\SxS\MicrosoftWindows.58683691.InpApp_cw5n1h2txyewy\InputApp\Assets\Dictation\PrivacyProtection.svg Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\SxS\MicrosoftWindows.58683691.InpApp_cw5n1h2txyewy\InputApp\Assets\Dictation\PrivacyProtectionWhite.svg Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\SxS\MicrosoftWindows.58683691.InpApp_cw5n1h2txyewy\InputApp\Assets\Dictation\ThankYou.svg Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\SxS\MicrosoftWindows.58683691.InpApp_cw5n1h2txyewy\InputApp\Assets\Fonts\AXPIcons.ttf Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\SxS\MicrosoftWindows.58683691.InpApp_cw5n1h2txyewy\InputApp\Assets\Fonts\CloudAnimation.ttf Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\SxS\MicrosoftWindows.58683691.InpApp_cw5n1h2txyewy\InputApp\Assets\Fonts\ECMDL2.ttf Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\SxS\MicrosoftWindows.58683691.InpApp_cw5n1h2txyewy\InputApp\Assets\Fonts\EmojiSIPIcons.ttf Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\SxS\MicrosoftWindows.58683691.InpApp_cw5n1h2txyewy\InputApp\Assets\Fonts\GetSMDL.ttf Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\SxS\MicrosoftWindows.58683691.InpApp_cw5n1h2txyewy\InputApp\Assets\Fonts\HandwritingMixedInput.ttf Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\SxS\MicrosoftWindows.58683691.InpApp_cw5n1h2txyewy\InputApp\Assets\Fonts\XboxFluent2.ttf Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\SxS\MicrosoftWindows.58683691.InpApp_cw5n1h2txyewy\InputApp\Assets\SmartActions\appicondefault-ecaa-32-invert.png Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\SxS\MicrosoftWindows.58683691.InpApp_cw5n1h2txyewy\InputApp\Assets\SmartActions\appicondefault-ecaa-32.png Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\SxS\MicrosoftWindows.58683691.InpApp_cw5n1h2txyewy\InputApp\Assets\SmartActions\lightning-icon.png Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\SxS\MicrosoftWindows.58683691.InpApp_cw5n1h2txyewy\InputApp\Assets\SmartActions\lightning-icon.svg Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\SxS\MicrosoftWindows.58683691.InpApp_cw5n1h2txyewy\TextInput\TextInput.manifest Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\SxS\MicrosoftWindows.58683691.InpApp_cw5n1h2txyewy\WindowsInternal.ComposableShell.Experiences.SuggestionUIUndocked\app.appx Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\SxS\MicrosoftWindows.59336768.Speion_cw5n1h2txyewy\appxblockmap.xml Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\SxS\MicrosoftWindows.59336768.Speion_cw5n1h2txyewy\appxmanifest.xml Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\SxS\MicrosoftWindows.59336768.Speion_cw5n1h2txyewy\appxsignature.p7x Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\SxS\MicrosoftWindows.59336768.Speion_cw5n1h2txyewy\resources.pri Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\SxS\MicrosoftWindows.59336768.Speion_cw5n1h2txyewy\SpeechSynthesizerExtension.dll Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\SxS\MicrosoftWindows.59336768.Speion_cw5n1h2txyewy\Assets\LockScreenLogo.scale-200.png Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\SxS\MicrosoftWindows.59336768.Speion_cw5n1h2txyewy\Assets\SplashScreen.scale-200.png Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\SxS\MicrosoftWindows.59336768.Speion_cw5n1h2txyewy\Assets\Square150x150Logo.scale-200.png Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\SxS\MicrosoftWindows.59336768.Speion_cw5n1h2txyewy\Assets\Square44x44Logo.scale-200.png Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\SxS\MicrosoftWindows.59336768.Speion_cw5n1h2txyewy\Assets\StoreLogo.png Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\SxS\MicrosoftWindows.59336768.Speion_cw5n1h2txyewy\Assets\StoreLogo.scale-100.png Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\SxS\MicrosoftWindows.59336768.Speion_cw5n1h2txyewy\SpeechSynthesizer\SpeechSynthesizer.manifest Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\SxS\MicrosoftWindows.59337133.Voiess_cw5n1h2txyewy\appxblockmap.xml Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\SxS\MicrosoftWindows.59337133.Voiess_cw5n1h2txyewy\appxmanifest.xml Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\SxS\MicrosoftWindows.59337133.Voiess_cw5n1h2txyewy\appxsignature.p7x Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\SxS\MicrosoftWindows.59337133.Voiess_cw5n1h2txyewy\CommandExecutor.dll Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\SxS\MicrosoftWindows.59337133.Voiess_cw5n1h2txyewy\CommandExecutorExtension.dll Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\SxS\MicrosoftWindows.59337133.Voiess_cw5n1h2txyewy\FREUserInterface.dll Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\SxS\MicrosoftWindows.59337133.Voiess_cw5n1h2txyewy\resources.pri Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\SxS\MicrosoftWindows.59337133.Voiess_cw5n1h2txyewy\SpeechRecognizer.dll Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\SxS\MicrosoftWindows.59337133.Voiess_cw5n1h2txyewy\SpeechRecognizerExtension.dll Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\SxS\MicrosoftWindows.59337133.Voiess_cw5n1h2txyewy\VoiceAccess.dll Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\SxS\MicrosoftWindows.59337133.Voiess_cw5n1h2txyewy\VoiceAccessCommon.dll Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\SxS\MicrosoftWindows.59337133.Voiess_cw5n1h2txyewy\VoiceAccessHost.dll Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\SxS\MicrosoftWindows.59337133.Voiess_cw5n1h2txyewy\VoiceAccessPlugin.dll Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\SxS\MicrosoftWindows.59337133.Voiess_cw5n1h2txyewy\VoiceAccessUserInterface.dll Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\SxS\MicrosoftWindows.59337133.Voiess_cw5n1h2txyewy\Assets\LockScreenLogo.scale-200.png Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\SxS\MicrosoftWindows.59337133.Voiess_cw5n1h2txyewy\Assets\SplashScreen.scale-200.png Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\SxS\MicrosoftWindows.59337133.Voiess_cw5n1h2txyewy\Assets\Square150x150Logo.scale-200.png Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\SxS\MicrosoftWindows.59337133.Voiess_cw5n1h2txyewy\Assets\Square44x44Logo.scale-200.png Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\SxS\MicrosoftWindows.59337133.Voiess_cw5n1h2txyewy\Assets\StoreLogo.png Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\SxS\MicrosoftWindows.59337133.Voiess_cw5n1h2txyewy\Assets\StoreLogo.scale-100.png Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\SxS\MicrosoftWindows.59337133.Voiess_cw5n1h2txyewy\FREUserInterface\Assets\Backpack.png Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\SxS\MicrosoftWindows.59337133.Voiess_cw5n1h2txyewy\FREUserInterface\Assets\Bike.png Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\SxS\MicrosoftWindows.59337133.Voiess_cw5n1h2txyewy\FREUserInterface\Assets\Box.png Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\SxS\MicrosoftWindows.59337133.Voiess_cw5n1h2txyewy\FREUserInterface\Assets\Cactus.png Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\SxS\MicrosoftWindows.59337133.Voiess_cw5n1h2txyewy\FREUserInterface\Assets\calendar.png Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\SxS\MicrosoftWindows.59337133.Voiess_cw5n1h2txyewy\FREUserInterface\Assets\Cat.png Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\SxS\MicrosoftWindows.59337133.Voiess_cw5n1h2txyewy\FREUserInterface\Assets\Dog.png Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\SxS\MicrosoftWindows.59337133.Voiess_cw5n1h2txyewy\FREUserInterface\Assets\MicrophonePage.png Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\SxS\MicrosoftWindows.59337133.Voiess_cw5n1h2txyewy\FREUserInterface\Assets\Shadow.png Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\SxS\MicrosoftWindows.59337133.Voiess_cw5n1h2txyewy\FREUserInterface\Assets\Shelf.png Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\SxS\MicrosoftWindows.59337133.Voiess_cw5n1h2txyewy\FREUserInterface\Assets\WelcomePage.png Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\SxS\MicrosoftWindows.59337133.Voiess_cw5n1h2txyewy\FREUserInterface\Assets\Content\de-DE\CommandHelpWindowContent.json Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\SxS\MicrosoftWindows.59337133.Voiess_cw5n1h2txyewy\FREUserInterface\Assets\Content\en-GB\CommandHelpWindowContent.json Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\SxS\MicrosoftWindows.59337133.Voiess_cw5n1h2txyewy\FREUserInterface\Assets\Content\en-US\CommandHelp.json Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\SxS\MicrosoftWindows.59337133.Voiess_cw5n1h2txyewy\FREUserInterface\Assets\Content\en-US\CommandHelpWindowContent.json Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\SxS\MicrosoftWindows.59337133.Voiess_cw5n1h2txyewy\FREUserInterface\Assets\Content\en-US\Content.localized.json Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\SxS\MicrosoftWindows.59337133.Voiess_cw5n1h2txyewy\FREUserInterface\Assets\Content\es-ES\CommandHelpWindowContent.json Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\SxS\MicrosoftWindows.59337133.Voiess_cw5n1h2txyewy\FREUserInterface\Assets\Content\es-MX\CommandHelpWindowContent.json Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\SxS\MicrosoftWindows.59337133.Voiess_cw5n1h2txyewy\FREUserInterface\Assets\Content\fr-CA\CommandHelpWindowContent.json Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\SxS\MicrosoftWindows.59337133.Voiess_cw5n1h2txyewy\FREUserInterface\Assets\Content\fr-FR\CommandHelpWindowContent.json Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\SxS\MicrosoftWindows.59337133.Voiess_cw5n1h2txyewy\FREUserInterface\Assets\Content\hi-IN\CommandHelpWindowContent.json Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\SxS\MicrosoftWindows.59337133.Voiess_cw5n1h2txyewy\FREUserInterface\Assets\Content\ja-JP\CommandHelpWindowContent.json Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\SxS\MicrosoftWindows.59337133.Voiess_cw5n1h2txyewy\FREUserInterface\Assets\Content\zh-CN\CommandHelpWindowContent.json Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\SxS\MicrosoftWindows.59337133.Voiess_cw5n1h2txyewy\FREUserInterface\Assets\Content\zh-HK\CommandHelpWindowContent.json Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\SxS\MicrosoftWindows.59337133.Voiess_cw5n1h2txyewy\FREUserInterface\Assets\Content\zh-TW\CommandHelpWindowContent.json Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\SxS\MicrosoftWindows.59337133.Voiess_cw5n1h2txyewy\IntentDefinitions\Strings\de-DE\IntentMapping.json Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\SxS\MicrosoftWindows.59337133.Voiess_cw5n1h2txyewy\IntentDefinitions\Strings\en-GB\IntentMapping.json Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\SxS\MicrosoftWindows.59337133.Voiess_cw5n1h2txyewy\IntentDefinitions\Strings\en-US\IntentMapping.json Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\SxS\MicrosoftWindows.59337133.Voiess_cw5n1h2txyewy\IntentDefinitions\Strings\es-ES\IntentMapping.json Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\SxS\MicrosoftWindows.59337133.Voiess_cw5n1h2txyewy\IntentDefinitions\Strings\es-MX\IntentMapping.json Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\SxS\MicrosoftWindows.59337133.Voiess_cw5n1h2txyewy\IntentDefinitions\Strings\fr-CA\IntentMapping.json Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\SxS\MicrosoftWindows.59337133.Voiess_cw5n1h2txyewy\IntentDefinitions\Strings\fr-FR\IntentMapping.json Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\SxS\MicrosoftWindows.59337133.Voiess_cw5n1h2txyewy\IntentDefinitions\Strings\hi-IN\IntentMapping.json Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\SxS\MicrosoftWindows.59337133.Voiess_cw5n1h2txyewy\VoiceAccess\VoiceAccess.manifest Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\SxS\MicrosoftWindows.59337133.Voiess_cw5n1h2txyewy\VoiceAccessCommon\FlexibleCommandingTrainingFile.json Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\SxS\MicrosoftWindows.59337133.Voiess_cw5n1h2txyewy\VoiceAccessCommon\Homophones.json Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\SxS\MicrosoftWindows.59337133.Voiess_cw5n1h2txyewy\VoiceAccessCommon\IntentEntityMap.json Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\SxS\MicrosoftWindows.59337133.Voiess_cw5n1h2txyewy\VoiceAccessHost\UIElementNames.xml Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\SxS\MicrosoftWindows.59337133.Voiess_cw5n1h2txyewy\VoiceAccessHost\VoiceAccessSupportedLanguages.xml Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\SxS\MicrosoftWindows.59337133.Voiess_cw5n1h2txyewy\VoiceAccessHost\VoiceCommands.xml Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\SxS\MicrosoftWindows.59337133.Voiess_cw5n1h2txyewy\VoiceAccessHost\Strings\de-DE\UIElementNames.xml Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\SxS\MicrosoftWindows.59337133.Voiess_cw5n1h2txyewy\VoiceAccessHost\Strings\en-US\UIElementNames.xml Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\SxS\MicrosoftWindows.59337133.Voiess_cw5n1h2txyewy\VoiceAccessHost\Strings\es-ES\UIElementNames.xml Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\SxS\MicrosoftWindows.59337133.Voiess_cw5n1h2txyewy\VoiceAccessHost\Strings\es-MX\UIElementNames.xml Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\SxS\MicrosoftWindows.59337133.Voiess_cw5n1h2txyewy\VoiceAccessHost\Strings\fr-CA\UIElementNames.xml Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\SxS\MicrosoftWindows.59337133.Voiess_cw5n1h2txyewy\VoiceAccessHost\Strings\fr-FR\UIElementNames.xml Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\SxS\MicrosoftWindows.59337133.Voiess_cw5n1h2txyewy\VoiceAccessHost\Strings\zh-HK\UIElementNames.xml Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\SxS\MicrosoftWindows.59379618.InpApp_cw5n1h2txyewy\appxblockmap.xml Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\SxS\MicrosoftWindows.59379618.InpApp_cw5n1h2txyewy\appxmanifest.xml Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\SxS\MicrosoftWindows.59379618.InpApp_cw5n1h2txyewy\appxsignature.p7x Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\SxS\MicrosoftWindows.59379618.InpApp_cw5n1h2txyewy\HardwareKeyboardUX.dll Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\SxS\MicrosoftWindows.59379618.InpApp_cw5n1h2txyewy\InputApp.dll Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\SxS\MicrosoftWindows.59379618.InpApp_cw5n1h2txyewy\LayoutData.dll Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\SxS\MicrosoftWindows.59379618.InpApp_cw5n1h2txyewy\resources.pri Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\SxS\MicrosoftWindows.59379618.InpApp_cw5n1h2txyewy\SmartActionsUX.dll Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\SxS\MicrosoftWindows.59379618.InpApp_cw5n1h2txyewy\TextInput.CarbonDictation.dll Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\SxS\MicrosoftWindows.59379618.InpApp_cw5n1h2txyewy\TextInput.DictationUI.dll Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\SxS\MicrosoftWindows.59379618.InpApp_cw5n1h2txyewy\TextInput.dll Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\SxS\MicrosoftWindows.59379618.InpApp_cw5n1h2txyewy\TextInputCommon.dll Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\SxS\MicrosoftWindows.59379618.InpApp_cw5n1h2txyewy\TextInputExtensions.dll Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\SxS\MicrosoftWindows.59379618.InpApp_cw5n1h2txyewy\TextInputHost.exe Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\SxS\MicrosoftWindows.59379618.InpApp_cw5n1h2txyewy\TextInputLayoutData.dll Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\SxS\MicrosoftWindows.59379618.InpApp_cw5n1h2txyewy\TouchKeyboardUX.dll Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\SxS\MicrosoftWindows.59379618.InpApp_cw5n1h2txyewy\WindowsInternal.ComposableShell.Experiences.SuggestionUIUndocked.dll Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\SxS\MicrosoftWindows.59379618.InpApp_cw5n1h2txyewy\WindowsInternal.ComposableShell.Experiences.SuggestionUIUndocked.winmd Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\SxS\MicrosoftWindows.59379618.InpApp_cw5n1h2txyewy\Assets\LockScreenLogo.scale-200.png Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\SxS\MicrosoftWindows.59379618.InpApp_cw5n1h2txyewy\Assets\SplashScreen.scale-200.png Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\SxS\MicrosoftWindows.59379618.InpApp_cw5n1h2txyewy\Assets\Square150x150Logo.scale-200.png Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\SxS\MicrosoftWindows.59379618.InpApp_cw5n1h2txyewy\Assets\Square44x44Logo.scale-200.png Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\SxS\MicrosoftWindows.59379618.InpApp_cw5n1h2txyewy\Assets\StoreLogo.png Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\SxS\MicrosoftWindows.59379618.InpApp_cw5n1h2txyewy\Assets\StoreLogo.scale-100.png Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\SxS\MicrosoftWindows.59379618.InpApp_cw5n1h2txyewy\InputApp\Assets\BadgeLogo.scale-100.png Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\SxS\MicrosoftWindows.59379618.InpApp_cw5n1h2txyewy\InputApp\Assets\BadgeLogo.scale-125.png Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\SxS\MicrosoftWindows.59379618.InpApp_cw5n1h2txyewy\InputApp\Assets\BadgeLogo.scale-150.png Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\SxS\MicrosoftWindows.59379618.InpApp_cw5n1h2txyewy\InputApp\Assets\BadgeLogo.scale-200.png Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\SxS\MicrosoftWindows.59379618.InpApp_cw5n1h2txyewy\InputApp\Assets\BadgeLogo.scale-400.png Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\SxS\MicrosoftWindows.59379618.InpApp_cw5n1h2txyewy\InputApp\Assets\KbdAccentPicker.wav Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\SxS\MicrosoftWindows.59379618.InpApp_cw5n1h2txyewy\InputApp\Assets\KbdFunction.wav Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\SxS\MicrosoftWindows.59379618.InpApp_cw5n1h2txyewy\InputApp\Assets\KbdFunctionModernUX.wav Handle ID: 0x8b4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\SxS\MicrosoftWindows.59379618.InpApp_cw5n1h2txyewy\InputApp\Assets\KbdKeyTap.wav Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\SxS\MicrosoftWindows.59379618.InpApp_cw5n1h2txyewy\InputApp\Assets\KbdKeyTapModernUX.wav Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\SxS\MicrosoftWindows.59379618.InpApp_cw5n1h2txyewy\InputApp\Assets\KbdSpacebar.wav Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\SxS\MicrosoftWindows.59379618.InpApp_cw5n1h2txyewy\InputApp\Assets\KbdSpaceBarModernUX.wav Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\SxS\MicrosoftWindows.59379618.InpApp_cw5n1h2txyewy\InputApp\Assets\KbdSwipeGesture.wav Handle ID: 0x8c4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\SxS\MicrosoftWindows.59379618.InpApp_cw5n1h2txyewy\InputApp\Assets\SplashScreen.scale-100.png Handle ID: 0x7dc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\SxS\MicrosoftWindows.59379618.InpApp_cw5n1h2txyewy\InputApp\Assets\SplashScreen.scale-125.png Handle ID: 0x7dc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\SxS\MicrosoftWindows.59379618.InpApp_cw5n1h2txyewy\InputApp\Assets\SplashScreen.scale-150.png Handle ID: 0x7dc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\SxS\MicrosoftWindows.59379618.InpApp_cw5n1h2txyewy\InputApp\Assets\SplashScreen.scale-200.png Handle ID: 0x7dc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\SxS\MicrosoftWindows.59379618.InpApp_cw5n1h2txyewy\InputApp\Assets\SplashScreen.scale-400.png Handle ID: 0x7dc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\SxS\MicrosoftWindows.59379618.InpApp_cw5n1h2txyewy\InputApp\Assets\SquareLogo150x150.scale-100.png Handle ID: 0x7dc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\SxS\MicrosoftWindows.59379618.InpApp_cw5n1h2txyewy\InputApp\Assets\SquareLogo150x150.scale-200.png Handle ID: 0x7dc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\SxS\MicrosoftWindows.59379618.InpApp_cw5n1h2txyewy\InputApp\Assets\SquareLogo150x150.scale-400.png Handle ID: 0x7dc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\SxS\MicrosoftWindows.59379618.InpApp_cw5n1h2txyewy\InputApp\Assets\SquareLogo310x310.scale-100.png Handle ID: 0x7dc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\SxS\MicrosoftWindows.59379618.InpApp_cw5n1h2txyewy\InputApp\Assets\SquareLogo310x310.scale-200.png Handle ID: 0x7dc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\SxS\MicrosoftWindows.59379618.InpApp_cw5n1h2txyewy\InputApp\Assets\SquareLogo310x310.scale-400.png Handle ID: 0x7dc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\SxS\MicrosoftWindows.59379618.InpApp_cw5n1h2txyewy\InputApp\Assets\SquareLogo44x44.scale-100.png Handle ID: 0x7dc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\SxS\MicrosoftWindows.59379618.InpApp_cw5n1h2txyewy\InputApp\Assets\SquareLogo44x44.scale-200.png Handle ID: 0x10f4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\SxS\MicrosoftWindows.59379618.InpApp_cw5n1h2txyewy\InputApp\Assets\SquareLogo44x44.scale-400.png Handle ID: 0x7dc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\SxS\MicrosoftWindows.59379618.InpApp_cw5n1h2txyewy\InputApp\Assets\SquareLogo71x71.scale-100.png Handle ID: 0x7dc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\SxS\MicrosoftWindows.59379618.InpApp_cw5n1h2txyewy\InputApp\Assets\SquareLogo71x71.scale-200.png Handle ID: 0x7dc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\SxS\MicrosoftWindows.59379618.InpApp_cw5n1h2txyewy\InputApp\Assets\SquareLogo71x71.scale-400.png Handle ID: 0x7dc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\SxS\MicrosoftWindows.59379618.InpApp_cw5n1h2txyewy\InputApp\Assets\StoreLogo.scale-100.png Handle ID: 0x7dc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\SxS\MicrosoftWindows.59379618.InpApp_cw5n1h2txyewy\InputApp\Assets\StoreLogo.scale-125.png Handle ID: 0x7dc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\SxS\MicrosoftWindows.59379618.InpApp_cw5n1h2txyewy\InputApp\Assets\StoreLogo.scale-150.png Handle ID: 0x7dc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\SxS\MicrosoftWindows.59379618.InpApp_cw5n1h2txyewy\InputApp\Assets\StoreLogo.scale-200.png Handle ID: 0x7dc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\SxS\MicrosoftWindows.59379618.InpApp_cw5n1h2txyewy\InputApp\Assets\StoreLogo.scale-400.png Handle ID: 0x7dc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\SxS\MicrosoftWindows.59379618.InpApp_cw5n1h2txyewy\InputApp\Assets\WideLogo310x150.scale-100.png Handle ID: 0x7dc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\SxS\MicrosoftWindows.59379618.InpApp_cw5n1h2txyewy\InputApp\Assets\WideLogo310x150.scale-200.png Handle ID: 0x7dc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\SxS\MicrosoftWindows.59379618.InpApp_cw5n1h2txyewy\InputApp\Assets\WideLogo310x150.scale-400.png Handle ID: 0x7dc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\SxS\MicrosoftWindows.59379618.InpApp_cw5n1h2txyewy\InputApp\Assets\Dictation\Access.svg Handle ID: 0x7dc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\SxS\MicrosoftWindows.59379618.InpApp_cw5n1h2txyewy\InputApp\Assets\Dictation\BasicCancelledEarcon.wav Handle ID: 0x7dc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\SxS\MicrosoftWindows.59379618.InpApp_cw5n1h2txyewy\InputApp\Assets\Dictation\BasicDoneListeningEarcon.wav Handle ID: 0x7dc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\SxS\MicrosoftWindows.59379618.InpApp_cw5n1h2txyewy\InputApp\Assets\Dictation\BasicListeningEarcon.wav Handle ID: 0x7dc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\SxS\MicrosoftWindows.59379618.InpApp_cw5n1h2txyewy\InputApp\Assets\Dictation\Choice.svg Handle ID: 0x7dc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\SxS\MicrosoftWindows.59379618.InpApp_cw5n1h2txyewy\InputApp\Assets\Dictation\De-ID.svg Handle ID: 0x7dc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\SxS\MicrosoftWindows.59379618.InpApp_cw5n1h2txyewy\InputApp\Assets\Dictation\PrivacyProtection.svg Handle ID: 0x7dc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\SxS\MicrosoftWindows.59379618.InpApp_cw5n1h2txyewy\InputApp\Assets\Dictation\PrivacyProtectionWhite.svg Handle ID: 0x7dc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\SxS\MicrosoftWindows.59379618.InpApp_cw5n1h2txyewy\InputApp\Assets\Dictation\ThankYou.svg Handle ID: 0x7dc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\SxS\MicrosoftWindows.59379618.InpApp_cw5n1h2txyewy\InputApp\Assets\Fonts\AXPIcons.ttf Handle ID: 0x7dc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\SxS\MicrosoftWindows.59379618.InpApp_cw5n1h2txyewy\InputApp\Assets\Fonts\CloudAnimation.ttf Handle ID: 0x7dc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\SxS\MicrosoftWindows.59379618.InpApp_cw5n1h2txyewy\InputApp\Assets\Fonts\ECMDL2.ttf Handle ID: 0x7dc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\SxS\MicrosoftWindows.59379618.InpApp_cw5n1h2txyewy\InputApp\Assets\Fonts\EmojiSIPIcons.ttf Handle ID: 0x7dc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\SxS\MicrosoftWindows.59379618.InpApp_cw5n1h2txyewy\InputApp\Assets\Fonts\GetSMDL.ttf Handle ID: 0x7dc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\SxS\MicrosoftWindows.59379618.InpApp_cw5n1h2txyewy\InputApp\Assets\Fonts\HandwritingMixedInput.ttf Handle ID: 0x7dc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\SxS\MicrosoftWindows.59379618.InpApp_cw5n1h2txyewy\InputApp\Assets\Fonts\XboxFluent2.ttf Handle ID: 0x7dc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\SxS\MicrosoftWindows.59379618.InpApp_cw5n1h2txyewy\InputApp\Assets\SmartActions\appicondefault-ecaa-32-invert.png Handle ID: 0x7dc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\SxS\MicrosoftWindows.59379618.InpApp_cw5n1h2txyewy\InputApp\Assets\SmartActions\appicondefault-ecaa-32.png Handle ID: 0x7dc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\SxS\MicrosoftWindows.59379618.InpApp_cw5n1h2txyewy\InputApp\Assets\SmartActions\lightning-icon.png Handle ID: 0x7dc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\SxS\MicrosoftWindows.59379618.InpApp_cw5n1h2txyewy\InputApp\Assets\SmartActions\lightning-icon.svg Handle ID: 0x8b4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\SxS\MicrosoftWindows.59379618.InpApp_cw5n1h2txyewy\TextInput\TextInput.manifest Handle ID: 0x8b4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\SxS\MicrosoftWindows.59379618.InpApp_cw5n1h2txyewy\WindowsInternal.ComposableShell.Experiences.SuggestionUIUndocked\app.appx Handle ID: 0x8b4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\Windows.PrintDialog_cw5n1h2txyewy\PrintDialog.exe Handle ID: 0x8b4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemApps\Windows.PrintDialog_cw5n1h2txyewy\resources.pri Handle ID: 0x8b4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemResources\accessibilitycpl.dll.mun Handle ID: 0x8b4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemResources\DataExchange.dll.mun Handle ID: 0x8ac Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemResources\dfrgui.exe.mun Handle ID: 0x8b4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemResources\dwmcore.dll.mun Handle ID: 0x8b4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemResources\ExplorerFrame.dll.mun Handle ID: 0x8b4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemResources\fdprint.dll.mun Handle ID: 0x8b4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemResources\ieframe.dll.mun Handle ID: 0x8b4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemResources\iscsicpl.exe.mun Handle ID: 0x8b4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemResources\LaunchTM.exe.mun Handle ID: 0x8b4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemResources\Magnify.exe.mun Handle ID: 0x8b4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemResources\mssvp.dll.mun Handle ID: 0x8b4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemResources\mstsc.exe.mun Handle ID: 0x8b4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemResources\mstscax.dll.mun Handle ID: 0x8b4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemResources\mycomput.dll.mun Handle ID: 0x8b4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemResources\printui.dll.mun Handle ID: 0x8b4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemResources\psr.exe.mun Handle ID: 0x8b4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemResources\raschapext.dll.mun Handle ID: 0x8b4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemResources\rasdlg.dll.mun Handle ID: 0x8b4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemResources\rasgcw.dll.mun Handle ID: 0x8b4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemResources\rasplap.dll.mun Handle ID: 0x8b4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemResources\rastls.dll.mun Handle ID: 0x8b4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemResources\rastlsext.dll.mun Handle ID: 0x8b4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemResources\SearchIndexer.exe.mun Handle ID: 0x8ac Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemResources\shell32.dll.mun Handle ID: 0x8ac Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemResources\shsvcs.dll.mun Handle ID: 0x8b4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemResources\sppcomapi.dll.mun Handle ID: 0x8b4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemResources\sysmon.ocx.mun Handle ID: 0x8ac Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemResources\Taskmgr.exe.mun Handle ID: 0x8b4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemResources\tquery.dll.mun Handle ID: 0x8b4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemResources\twinui.dll.mun Handle ID: 0x8b4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemResources\wdc.dll.mun Handle ID: 0x8b4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemResources\Windows.UI.Immersive.dll.mun Handle ID: 0x8b4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemResources\wininet.dll.mun Handle ID: 0x8b4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemResources\zipfldr.dll.mun Handle ID: 0x8b4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemResources\ShellComponents.Switcher\ShellComponents.Switcher.pri Handle ID: 0x8b4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemResources\ShellComponents.Switcher\pris\ShellComponents.Switcher.en-US.pri Handle ID: 0x8b4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemResources\Windows.UI.ControlCenter\Windows.UI.ControlCenter.pri Handle ID: 0x8b4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemResources\Windows.UI.ControlCenter\pris\Windows.UI.ControlCenter.en-US.pri Handle ID: 0x8b4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemResources\Windows.UI.Cred\Windows.UI.Cred.pri Handle ID: 0x8b4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemResources\Windows.UI.Logon\Windows.UI.Logon.pri Handle ID: 0x8b4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemResources\Windows.UI.PCShell\Windows.UI.PCShell.pri Handle ID: 0x8b4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemResources\Windows.UI.PCShell\pris\Windows.UI.PCShell.en-US.pri Handle ID: 0x8b4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemResources\Windows.UI.SettingsAdminFlowUIThreshold\Windows.UI.SettingsAdminFlowUIThreshold.pri Handle ID: 0x8b4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemResources\Windows.UI.SettingsAdminFlowUIThreshold\pris\Windows.UI.SettingsAdminFlowUIThreshold.en-US.pri Handle ID: 0x8b4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemResources\Windows.UI.SettingsAppThreshold\Windows.UI.SettingsAppThreshold.pri Handle ID: 0x8b4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemResources\Windows.UI.SettingsAppThreshold\pris\Windows.UI.SettingsAppThreshold.en-US.pri Handle ID: 0x8b4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemResources\Windows.UI.SettingsAppThreshold\SystemSettings\Assets\Fonts\SettingsIcons.ttf Handle ID: 0x8b4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemResources\Windows.UI.SettingsHandlers-nt\Windows.UI.SettingsHandlers-nt.pri Handle ID: 0x8b4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemResources\Windows.UI.SettingsHandlers-nt\pris\Windows.UI.SettingsHandlers-nt.en-US.pri Handle ID: 0x8b4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemResources\Windows.UI.Shell\Windows.UI.Shell.pri Handle ID: 0x8ac Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemResources\Windows.UI.ShellCommon\Windows.UI.ShellCommon.pri Handle ID: 0x8ac Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemResources\Windows.UI.ShellCommon\pris\Windows.UI.ShellCommon.en-US.pri Handle ID: 0x8b4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemResources\Windows.UI.TaskManager\Windows.UI.TaskManager.pri Handle ID: 0x8b4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SystemResources\Windows.UI.TaskManager\pris\Windows.UI.TaskManager.en-US.pri Handle ID: 0x8b4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\3bc29097-7317-41d3-93b9-38a48f99d48a_mssrch.dll Handle ID: 0x8b4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\aadauthhelper.dll Handle ID: 0x8b4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\aadtb.dll Handle ID: 0x8b4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\aadWamExtension.dll Handle ID: 0x8b4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\AarSvc.dll Handle ID: 0x8b4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\AboveLockAppHost.dll Handle ID: 0x8ac Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\accessibilitycpl.dll Handle ID: 0x8b4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\AcGenral.dll Handle ID: 0x8b4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\AcLayers.dll Handle ID: 0x8b4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\aclui.dll Handle ID: 0x8b4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\acppage.dll Handle ID: 0x8b4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\AcSpecfc.dll Handle ID: 0x8b4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\ActivationManager.dll Handle ID: 0x8b4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\activeds.dll Handle ID: 0x8b4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\actxprxy.dll Handle ID: 0x8b4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\AdmTmpl.dll Handle ID: 0x8b4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\adprovider.dll Handle ID: 0x8b4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\adsldp.dll Handle ID: 0x8b4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\adsnt.dll Handle ID: 0x8b4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\adtschema.dll Handle ID: 0x8b4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\advapi32.dll Handle ID: 0x8b4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\aepic.dll Handle ID: 0x8b4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\agentactivationruntime.dll Handle ID: 0x8b4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\agentactivationruntimewindows.dll Handle ID: 0x8b4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\ApiSetHost.AppExecutionAlias.dll Handle ID: 0x8b4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\AppContracts.dll Handle ID: 0x8b4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\AppExtension.dll Handle ID: 0x8b4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\apphelp.dll Handle ID: 0x8ac Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\AppLockerCSP.dll Handle ID: 0x8b4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\appmgmts.dll Handle ID: 0x8b4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\AppResolver.dll Handle ID: 0x8b4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\AppVClientPS.dll Handle ID: 0x8b4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\AppVDllSurrogate.exe Handle ID: 0x8b4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\AppVEntSubsystems32.dll Handle ID: 0x8b4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\AppVSentinel.dll Handle ID: 0x8b4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\AppVTerminator.dll Handle ID: 0x8b4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\appwiz.cpl Handle ID: 0x8b4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\AppxAllUserStore.dll Handle ID: 0x8b4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\AppxApplicabilityEngine.dll Handle ID: 0x8b4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\AppXDeploymentClient.dll Handle ID: 0x8b4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\AppxPackaging.dll Handle ID: 0x8b4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\AppxProvisioning.xml Handle ID: 0x8b4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\AppxSip.dll Handle ID: 0x8b4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\archiveint.dll Handle ID: 0x8b4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\AssignedAccessRuntime.dll Handle ID: 0x8b4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\AtBroker.exe Handle ID: 0x8b4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\atmlib.dll Handle ID: 0x8b4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\AudioEng.dll Handle ID: 0x8b4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\AUDIOKSE.dll Handle ID: 0x8b4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\AudioSes.dll Handle ID: 0x8b4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\AuthBroker.dll Handle ID: 0x8b4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\AuthExt.dll Handle ID: 0x8b4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\authfwcfg.dll Handle ID: 0x8b4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\AuthFWSnapin.dll Handle ID: 0x8b4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\authui.dll Handle ID: 0x8b4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\authz.dll Handle ID: 0x8b4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\autopilot.dll Handle ID: 0x8b4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\batmeter.dll Handle ID: 0x8b4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\BCP47Langs.dll Handle ID: 0x8b4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\BCP47mrm.dll Handle ID: 0x8b4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\bcrypt.dll Handle ID: 0x8b4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\bcryptprimitives.dll Handle ID: 0x8b4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\bidispl.dll Handle ID: 0x8b4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\BingMaps.dll Handle ID: 0x10f4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\BioCredProv.dll Handle ID: 0x10f4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\BitLockerCsp.dll Handle ID: 0x10f4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\bitsadmin.exe Handle ID: 0x10f4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\biwinrt.dll Handle ID: 0x10f4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\BluetoothApis.dll Handle ID: 0x10f4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\BluetoothOppPushClient.dll Handle ID: 0x10f4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\BTAGService.dll Handle ID: 0x10f4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\BthRadioMedia.dll Handle ID: 0x10f4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\BthTelemetry.dll Handle ID: 0x10f4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\bthudtask.exe Handle ID: 0x10f4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\cabapi.dll Handle ID: 0x10f4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\cabview.dll Handle ID: 0x10f4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\camext.dll Handle ID: 0x10f4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\CapabilityAccessManagerClient.dll Handle ID: 0x10f4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\capauthz.dll Handle ID: 0x10f4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\capiprovider.dll Handle ID: 0x10f4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\cdp.dll Handle ID: 0x10f4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\cdprt.dll Handle ID: 0x10f4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\certca.dll Handle ID: 0x10f4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\certcli.dll Handle ID: 0x10f4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\CertEnroll.dll Handle ID: 0x10f4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\CertEnrollCtrl.exe Handle ID: 0x10f4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\CertEnrollUI.dll Handle ID: 0x10f4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\CertPKICmdlet.dll Handle ID: 0x10f4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\CertPolEng.dll Handle ID: 0x10f4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\certreq.exe Handle ID: 0x10f4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\certutil.exe Handle ID: 0x10f4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\cewmdm.dll Handle ID: 0x10f4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\cfgmgr32.dll Handle ID: 0x10f4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\Chakra.dll Handle ID: 0x10f4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\Chakradiag.dll Handle ID: 0x10f4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\charmap.exe Handle ID: 0x10f4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\clbcatq.dll Handle ID: 0x10f4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\cldapi.dll Handle ID: 0x10f4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\clfsw32.dll Handle ID: 0x10f4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\ClipboardServer.dll Handle ID: 0x10f4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\CloudExperienceHostCommon.dll Handle ID: 0x10f4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\CloudExperienceHostUser.dll Handle ID: 0x10f4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\CloudNotifications.exe Handle ID: 0x10f4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\clusapi.dll Handle ID: 0x10f4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\cmd.exe Handle ID: 0x10f4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\cmdext.dll Handle ID: 0x10f4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\cmdkey.exe Handle ID: 0x10f4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\cmifw.dll Handle ID: 0x10f4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\cmintegrator.dll Handle ID: 0x10f4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\cmmon32.exe Handle ID: 0x10f4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\cngcredui.dll Handle ID: 0x10f4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\cngprovider.dll Handle ID: 0x10f4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\COLORCNV.DLL Handle ID: 0x10f4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\colorui.dll Handle ID: 0x10f4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\combase.dll Handle ID: 0x10f4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\comdlg32.dll Handle ID: 0x10f4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\coml2.dll Handle ID: 0x10f4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\CompPkgSup.dll Handle ID: 0x10f4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\comsvcs.dll Handle ID: 0x10f4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\ConfigureExpandedStorage.dll Handle ID: 0x10f4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\ConsoleLogon.dll Handle ID: 0x10f4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\ContactActivation.dll Handle ID: 0x10f4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\ContentDeliveryManager.Utilities.dll Handle ID: 0x10f4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\coreglobconfig.dll Handle ID: 0x10f4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\CoreMessaging.dll Handle ID: 0x10f4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\CoreShellAPI.dll Handle ID: 0x10f4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\CoreUIComponents.dll Handle ID: 0x10f4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\correngine.dll Handle ID: 0x10f4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\CPFilters.dll Handle ID: 0x10f4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\CredentialUIBroker.exe Handle ID: 0x10f4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\CredProv2faHelper.dll Handle ID: 0x10f4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\CredProvCommonCore.dll Handle ID: 0x10f4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\CredProvDataModel.dll Handle ID: 0x10f4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\CredProvHelper.dll Handle ID: 0x10f4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\credprovhost.dll Handle ID: 0x10f4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\credprovs.dll Handle ID: 0x10f4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\credprovslegacy.dll Handle ID: 0x10f4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\credui.dll Handle ID: 0x10f4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\crypt32.dll Handle ID: 0x10f4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\cryptbase.dll Handle ID: 0x10f4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\cryptnet.dll Handle ID: 0x10f4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\cryptngc.dll Handle ID: 0x10f4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\cryptoss.dll Handle ID: 0x10f4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\CryptoWinRT.dll Handle ID: 0x10f4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\cryptsp.dll Handle ID: 0x10f4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\cryptui.dll Handle ID: 0x10f4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\cryptxml.dll Handle ID: 0x10f4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\cscript.exe Handle ID: 0x10f4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\ctac.json Handle ID: 0x10f4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\ctfmon.exe Handle ID: 0x10f4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\curl.exe Handle ID: 0x10f4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\d2d1.dll Handle ID: 0x10f4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\d3d10level9.dll Handle ID: 0x10f4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\d3d10warp.dll Handle ID: 0x8ac Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\d3d11.dll Handle ID: 0x10f4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\d3d11on12.dll Handle ID: 0x10f4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\D3D12.dll Handle ID: 0x10f4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\D3D12Core.dll Handle ID: 0x8ac Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\d3d8.dll Handle ID: 0x1138 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\d3d9.dll Handle ID: 0x8ac Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\d3d9on12.dll Handle ID: 0x1138 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\D3DCompiler_47.dll Handle ID: 0x1138 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\D3DSCache.dll Handle ID: 0x1138 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\DataExchange.dll Handle ID: 0x1138 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\daxexec.dll Handle ID: 0x1138 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\dbgcore.dll Handle ID: 0x1138 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\dccw.exe Handle ID: 0x1138 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\dcomp.dll Handle ID: 0x1138 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\ddisplay.dll Handle ID: 0x1138 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\ddraw.dll Handle ID: 0x1138 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\desk.cpl Handle ID: 0x1138 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\DevDispItemProvider.dll Handle ID: 0x1138 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\devenum.dll Handle ID: 0x1138 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\deviceaccess.dll Handle ID: 0x1138 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\deviceassociation.dll Handle ID: 0x1138 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\DeviceCenter.dll Handle ID: 0x1138 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\DeviceFlows.DataModel.dll Handle ID: 0x1138 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\devicengccredprov.dll Handle ID: 0x1138 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\DevicePairingFolder.dll Handle ID: 0x1138 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\DeviceReactivation.dll Handle ID: 0x1138 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\DeviceSetupStatusProvider.dll Handle ID: 0x1138 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\devmgr.dll Handle ID: 0x1138 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\dhcpcmonitor.dll Handle ID: 0x1138 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\dhcpcore.dll Handle ID: 0x1138 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\dhcpcore6.dll Handle ID: 0x1138 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\dhcpcsvc.dll Handle ID: 0x1138 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\dhcpcsvc6.dll Handle ID: 0x1138 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\DiagnosticDataSettings.dll Handle ID: 0x1138 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\dialclient.dll Handle ID: 0x1138 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\dimsjob.dll Handle ID: 0x8ac Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\dimsroam.dll Handle ID: 0x1138 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\directmanipulation.dll Handle ID: 0x1138 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\directsr.dll Handle ID: 0x1138 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\directxdatabasehelper.dll Handle ID: 0x1138 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\diskusage.exe Handle ID: 0x1138 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\DismApi.dll Handle ID: 0x1138 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\DispBroker.dll Handle ID: 0x1138 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\DisplayManager.dll Handle ID: 0x1138 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\dlnashext.dll Handle ID: 0x1138 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\DMAlertListener.ProxyStub.dll Handle ID: 0x1138 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\DmApiSetExtImplDesktop.dll Handle ID: 0x1138 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\dmband.dll Handle ID: 0x1138 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\dmcmnutils.dll Handle ID: 0x1138 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\dmenrollengine.dll Handle ID: 0x1138 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\dmime.dll Handle ID: 0x1138 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\dmloader.dll Handle ID: 0x1138 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\dmscript.dll Handle ID: 0x1138 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\dmusic.dll Handle ID: 0x1138 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\dmxmlhelputils.dll Handle ID: 0x1138 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\dnsapi.dll Handle ID: 0x1138 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\dnscmmc.dll Handle ID: 0x1138 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\dot3gpclnt.dll Handle ID: 0x1138 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\dot3gpui.dll Handle ID: 0x1138 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\dpapiprovider.dll Handle ID: 0x1138 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\drvsetup.dll Handle ID: 0x1138 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\drvstore.dll Handle ID: 0x8ac Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\dsclient.dll Handle ID: 0x1138 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\dsound.dll Handle ID: 0x1138 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\dsreg.dll Handle ID: 0x1138 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\dswave.dll Handle ID: 0x1138 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\dtdump.exe Handle ID: 0x8ac Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\dtsh.dll Handle ID: 0x74c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\dui70.dll Handle ID: 0x738 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\duser.dll Handle ID: 0x1f8c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\dwmapi.dll Handle ID: 0x74c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\DWrite.dll Handle ID: 0x74c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\DWWIN.EXE Handle ID: 0x74c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\DXCore.dll Handle ID: 0x1f8c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\dxdiag.exe Handle ID: 0x1af0 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\dxdiagn.dll Handle ID: 0x1f8c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:50 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\dxgi.dll Handle ID: 0x1f8c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:51 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\dxva2.dll Handle ID: 0x1f8c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:51 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\eapp3hst.dll Handle ID: 0x1af0 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:51 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\eappcfg.dll Handle ID: 0x1f8c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:51 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\eapphost.dll Handle ID: 0x74c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:51 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\eapprovp.dll Handle ID: 0x10f4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:51 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\eapputil.dll Handle ID: 0x10f4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:51 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\eapsimextdesktop.dll Handle ID: 0x10f4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:51 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\EapTeapConfig.dll Handle ID: 0x10f4 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:51 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\EaseOfAccessDialog.exe Handle ID: 0x7dc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:51 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\easwrt.dll Handle ID: 0x7dc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:51 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\edgehtml.dll Handle ID: 0x1f8c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:51 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\edgeIso.dll Handle ID: 0x8f0 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:51 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\EditBufferTestHook.dll Handle ID: 0x8f0 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:51 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\EditionUpgradeHelper.dll Handle ID: 0x8f0 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:51 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\EditionUpgradeManagerObj.dll Handle ID: 0x8f0 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:51 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\edpnotify.exe Handle ID: 0x8f0 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:51 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\edputil.dll Handle ID: 0x8f0 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:51 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\efsadu.dll Handle ID: 0x718 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:51 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\efsext.dll Handle ID: 0x718 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:51 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\efswrt.dll Handle ID: 0x718 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:51 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\embeddedmodesvcapi.dll Handle ID: 0x98c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:51 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\enrollmentapi.dll Handle ID: 0x98c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:51 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\enterpriseresourcemanager.dll Handle ID: 0x98c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:51 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\es.dll Handle ID: 0x16c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:51 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\EsdSip.dll Handle ID: 0x16c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:51 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\esent.dll Handle ID: 0x16c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:51 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\EtwRundown.dll Handle ID: 0x16c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:51 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\evr.dll Handle ID: 0x16c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:51 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\ExecModelClient.dll Handle ID: 0x16c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:51 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\explorer.exe Handle ID: 0x744 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:51 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\ExplorerFrame.dll Handle ID: 0x73c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:51 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\Faultrep.dll Handle ID: 0x73c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:51 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\fcon.dll Handle ID: 0x73c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:51 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\fdBth.dll Handle ID: 0x73c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:51 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\fdSSDP.dll Handle ID: 0x73c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:51 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\fdWSD.dll Handle ID: 0x73c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:51 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\feclient.dll Handle ID: 0x72c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:51 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\ffbroker.dll Handle ID: 0x73c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:51 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\fidocredprov.dll Handle ID: 0x73c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:51 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\findstr.exe Handle ID: 0x73c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:51 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\fingerprintcredential.dll Handle ID: 0x73c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:51 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\FirewallAPI.dll Handle ID: 0x4fc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:51 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\FlightSettings.dll Handle ID: 0x4fc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:51 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\fontext.dll Handle ID: 0x4fc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:51 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\framedyn.dll Handle ID: 0x4fc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:51 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\framedynos.dll Handle ID: 0x4fc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:51 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\FrameServerClient.dll Handle ID: 0x4fc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:51 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\FrameServerMonitorClient.dll Handle ID: 0x4fc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:51 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\fsquirt.exe Handle ID: 0x4fc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:51 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\fsutil.exe Handle ID: 0x4fc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:51 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\fundisc.dll Handle ID: 0x4fc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:51 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\fveapi.dll Handle ID: 0x4fc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:51 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\fveapibase.dll Handle ID: 0x4fc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:51 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\fvecerts.dll Handle ID: 0x4fc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:51 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\fwbase.dll Handle ID: 0x4fc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:51 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\fwpolicyiomgr.dll Handle ID: 0x4fc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:51 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\FWPUCLNT.DLL Handle ID: 0x4fc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:51 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\GameChatTranscription.dll Handle ID: 0x4fc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:51 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\GameInput.dll Handle ID: 0x4fc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:51 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\gamemode.dll Handle ID: 0x73c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:51 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\gdi32.dll Handle ID: 0x4fc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:51 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\gdi32full.dll Handle ID: 0x4fc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:51 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\GdiPlus.dll Handle ID: 0x4fc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:51 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\genpix.dll Handle ID: 0x4fc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:51 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\Geolocation.dll Handle ID: 0x4fc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:51 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\globinputhost.dll Handle ID: 0x4fc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:51 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\gmsaclient.dll Handle ID: 0x4fc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:51 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\gpapi.dll Handle ID: 0x4fc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:51 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\gpedit.dll Handle ID: 0x4fc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:51 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\gpprefcl.dll Handle ID: 0x4fc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:51 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\gpresult.exe Handle ID: 0x4fc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:51 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\gpscript.dll Handle ID: 0x4fc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:51 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\gpscript.exe Handle ID: 0x4fc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:51 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\gpupdate.exe Handle ID: 0x4fc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:51 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\GraphicsCapture.dll Handle ID: 0x4fc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:51 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\HeatCore.dll Handle ID: 0x4fc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:51 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\hgcpl.dll Handle ID: 0x4fc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:51 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\hhctrl.ocx Handle ID: 0x4fc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:51 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\hlink.dll Handle ID: 0x4fc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:51 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\hmkd.dll Handle ID: 0x4fc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:51 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\HrtfApo.dll Handle ID: 0x4fc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:51 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\httpapi.dll Handle ID: 0x4fc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:51 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\HvsiManagementApi.dll Handle ID: 0x4fc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:51 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\iasacct.dll Handle ID: 0x4fc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:51 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\icu.dll Handle ID: 0x4fc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:51 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\IdCtrls.dll Handle ID: 0x4fc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:51 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\IDStore.dll Handle ID: 0x4fc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:51 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\ieapfltr.dll Handle ID: 0x4fc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:51 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\ieframe.dll Handle ID: 0x4fc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:51 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\iemigplugin.dll Handle ID: 0x98c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:51 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\iertutil.dll Handle ID: 0x4fc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:51 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\ieui.dll Handle ID: 0x4fc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:51 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\iexpress.exe Handle ID: 0x4fc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:51 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\ifsutil.dll Handle ID: 0x4fc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:51 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\ime_textinputhelpers.dll Handle ID: 0x4fc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:51 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\imm32.dll Handle ID: 0x4fc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:51 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\IndexedDbLegacy.dll Handle ID: 0x4fc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:51 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\inetcomm.dll Handle ID: 0x4fc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:51 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\inetcpl.cpl Handle ID: 0x4fc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:51 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\INETRES.dll Handle ID: 0x4fc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:51 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\input.dll Handle ID: 0x4fc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:51 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\InputHost.dll Handle ID: 0x4fc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:51 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\InputInjectionBroker.dll Handle ID: 0x4fc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:51 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\InputSwitch.dll Handle ID: 0x4fc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:51 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\InputSwitchToastHandler.exe Handle ID: 0x4fc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:51 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\InstallService.dll Handle ID: 0x4fc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:51 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\InstallServiceTasks.dll Handle ID: 0x4fc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:51 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\IntegratedServicesRegionPolicySet.json Handle ID: 0x4fc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:51 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\intl.cpl Handle ID: 0x4fc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:51 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\ipconfig.exe Handle ID: 0x4fc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:51 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\IPHLPAPI.DLL Handle ID: 0x4fc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:51 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\IppCommon.dll Handle ID: 0x4fc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:51 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\iprtprio.dll Handle ID: 0x4fc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:51 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\iprtrmgr.dll Handle ID: 0x4fc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:51 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\iscsicli.exe Handle ID: 0x4fc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:51 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\itss.dll Handle ID: 0x4fc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:51 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\joinproviderol.dll Handle ID: 0x4fc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:51 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\JpMapControl.dll Handle ID: 0x4fc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:51 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\jscript.dll Handle ID: 0x4fc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:51 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\jscript9.dll Handle ID: 0x4fc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:51 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\jscript9diag.dll Handle ID: 0x4fc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:51 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\jscript9Legacy.dll Handle ID: 0x4fc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:51 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\jsproxy.dll Handle ID: 0x4fc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:51 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\kerb3961.dll Handle ID: 0x4fc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:51 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\kerberos.dll Handle ID: 0x4fc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:51 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\kernel.appcore.dll Handle ID: 0x4fc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:51 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\kernel32.dll Handle ID: 0x4fc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:51 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\KernelBase.dll Handle ID: 0x4fc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:51 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\keyiso.dll Handle ID: 0x4fc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:51 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\LampArray.dll Handle ID: 0x4fc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:51 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\LanguageOverlayUtil.dll Handle ID: 0x4fc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:51 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\LaunchTM.exe Handle ID: 0x4fc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:51 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\LaunchWinApp.exe Handle ID: 0x4fc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:51 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\LicenseManager.dll Handle ID: 0x4fc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:51 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\LicenseManagerApi.dll Handle ID: 0x4fc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:51 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\LicensingDiagSpp.dll Handle ID: 0x4fc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:51 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\LicensingWinRT.dll Handle ID: 0x4fc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:51 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\LocationApi.dll Handle ID: 0x4fc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:51 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\LocationFrameworkInternalPS.dll Handle ID: 0x4fc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:51 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\LocationFrameworkPS.dll Handle ID: 0x4fc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:51 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\LockAppBroker.dll Handle ID: 0x4fc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:51 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\LockScreenData.dll Handle ID: 0x4fc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:51 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\logoncli.dll Handle ID: 0x4fc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:51 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\luiapi.dll Handle ID: 0x4fc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:51 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\Magnify.exe Handle ID: 0x4fc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:51 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\MapGeocoder.dll Handle ID: 0x4fc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:51 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\mapi32.dll Handle ID: 0x4fc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:51 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\mapistub.dll Handle ID: 0x4fc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:51 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\MapRouter.dll Handle ID: 0x4fc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:51 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\mavinject.exe Handle ID: 0x4fc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:51 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\MbaeApi.dll Handle ID: 0x4fc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:51 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\MbaeApiPublic.dll Handle ID: 0x4fc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:51 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\mbsmsapi.dll Handle ID: 0x4fc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:51 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\MCCSEngineShared.dll Handle ID: 0x4fc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:51 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\MCRecvSrc.dll Handle ID: 0x4fc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:51 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\mdmregistration.dll Handle ID: 0x4fc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:51 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\mf.dll Handle ID: 0x4fc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:51 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\mf3216.dll Handle ID: 0x4fc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:51 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\mfasfsrcsnk.dll Handle ID: 0x4fc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:51 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\mfaudiocnv.dll Handle ID: 0x4fc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:51 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\MFCaptureEngine.dll Handle ID: 0x4fc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:51 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\mfcore.dll Handle ID: 0x4fc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:51 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\mfh264enc.dll Handle ID: 0x4fc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:51 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\mfksproxy.dll Handle ID: 0x73c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:51 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\MFMediaEngine.dll Handle ID: 0x4fc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:51 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\mfmjpegdec.dll Handle ID: 0x4fc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:51 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\mfmkvsrcsnk.dll Handle ID: 0x4fc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:51 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\mfmp4srcsnk.dll Handle ID: 0x4fc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:51 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\mfmpeg2srcsnk.dll Handle ID: 0x4fc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:51 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\mfplat.dll Handle ID: 0x4fc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:51 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\MFPlay.dll Handle ID: 0x4fc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:51 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\mfpmp.exe Handle ID: 0x4fc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:51 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\mfreadwrite.dll Handle ID: 0x4fc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:51 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\mfsensorgroup.dll Handle ID: 0x4fc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:51 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\mfsrcsnk.dll Handle ID: 0x4fc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:51 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\mfsvr.dll Handle ID: 0x4fc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:51 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\Microsoft.Bluetooth.Proxy.dll Handle ID: 0x4fc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:51 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\Microsoft.Internal.FrameworkUdk.System.dll Handle ID: 0x4fc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:51 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\Microsoft.Uev.AppAgent.dll Handle ID: 0x4fc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:51 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\Microsoft.Uev.Office2013CustomActions.dll Handle ID: 0x73c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:51 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\MicrosoftAccountTokenProvider.dll Handle ID: 0x4fc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:51 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\MicrosoftAccountWAMExtension.dll Handle ID: 0x4fc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:51 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\mimefilt.dll Handle ID: 0x4fc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:51 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\MiracastReceiver.dll Handle ID: 0x4fc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:51 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\MiracastReceiverExt.dll Handle ID: 0x4fc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:51 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\mispace.dll Handle ID: 0x4fc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:51 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\MitigationConfiguration.dll Handle ID: 0x4fc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:51 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\mlang.dll Handle ID: 0x4fc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:51 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\mmc.exe Handle ID: 0x4fc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:51 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\mmcndmgr.dll Handle ID: 0x4fc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:51 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\MMDevAPI.dll Handle ID: 0x4fc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:51 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\mmsys.cpl Handle ID: 0x4fc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:51 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\MosStorage.dll Handle ID: 0x4fc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:51 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\MP4SDECD.DLL Handle ID: 0x4fc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:51 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\mpr.dll Handle ID: 0x4fc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:51 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\mprapi.dll Handle ID: 0x4fc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:51 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\mprddm.dll Handle ID: 0x4fc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:51 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\mprdim.dll Handle ID: 0x4fc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:51 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\MrmCoreR.dll Handle ID: 0x4fc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:51 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\MrmDeploy.dll Handle ID: 0x4fc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:51 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\MrmIndexer.dll Handle ID: 0x4fc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:51 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\msacm32.dll Handle ID: 0x4fc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:51 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\msasn1.dll Handle ID: 0x4fc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:51 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\MSAudDecMFT.dll Handle ID: 0x4fc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:51 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\msaudite.dll Handle ID: 0x4fc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:51 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\mscandui.dll Handle ID: 0x4fc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:51 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\mscms.dll Handle ID: 0x4fc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:51 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\msctf.dll Handle ID: 0x4fc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:51 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\MsCtfMonitor.dll Handle ID: 0x4fc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:51 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\msctfui.dll Handle ID: 0x4fc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:51 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\msctfuimanager.dll Handle ID: 0x4fc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:51 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\msdt.exe Handle ID: 0x4fc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:51 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\msdtcprx.dll Handle ID: 0x4fc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:51 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\msdtcuiu.dll Handle ID: 0x4fc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:51 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\MSFlacDecoder.dll Handle ID: 0x4fc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:51 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\MSFlacEncoder.dll Handle ID: 0x4fc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:51 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\msftedit.dll Handle ID: 0x4fc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:51 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\mshtml.dll Handle ID: 0x4fc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:51 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\msi.dll Handle ID: 0x4fc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:51 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\msieftp.dll Handle ID: 0x4fc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:51 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\msihnd.dll Handle ID: 0x4fc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:51 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\msimsg.dll Handle ID: 0x4fc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:51 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\msinfo32.exe Handle ID: 0x4fc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:51 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\msisip.dll Handle ID: 0x4fc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:51 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\msIso.dll Handle ID: 0x4fc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:51 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\msjtes40.dll Handle ID: 0x4fc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:51 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\mskeyprotcli.dll Handle ID: 0x4fc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:51 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\mskeyprotect.dll Handle ID: 0x4fc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:51 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\msmpeg2adec.dll Handle ID: 0x4fc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:51 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\MSMPEG2ENC.DLL Handle ID: 0x4fc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:51 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\msmpeg2vdec.dll Handle ID: 0x4fc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:51 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\msobjs.dll Handle ID: 0x4fc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:51 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\msoert2.dll Handle ID: 0x4fc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:51 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\MSPhotography.dll Handle ID: 0x4fc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:51 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\msscntrs.dll Handle ID: 0x4fc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:51 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\mssign32.dll Handle ID: 0x4fc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:51 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\mssitlb.dll Handle ID: 0x4fc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:51 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\MsSpellCheckingFacility.dll Handle ID: 0x4fc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:51 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\mssph.dll Handle ID: 0x4fc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:51 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\mssprxy.dll Handle ID: 0x4fc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:51 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\mssrch.dll Handle ID: 0x73c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:51 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\mssvp.dll Handle ID: 0x4fc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:51 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\mstsc.exe Handle ID: 0x4fc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:51 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\mstscax.dll Handle ID: 0x4fc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:51 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\msutb.dll Handle ID: 0x4fc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:51 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\msv1_0.dll Handle ID: 0x4fc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:51 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\msvcp110_win.dll Handle ID: 0x4fc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:51 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\msvcp_win.dll Handle ID: 0x4fc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:51 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\msvcrt.dll Handle ID: 0x4fc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:51 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\msvproc.dll Handle ID: 0x4fc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:51 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\MSWB7.dll Handle ID: 0x4fc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:51 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\mswsock.dll Handle ID: 0x4fc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:51 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\msxml3.dll Handle ID: 0x4fc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:51 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\msxml6.dll Handle ID: 0x4fc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:51 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\MTF.dll Handle ID: 0x4fc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:51 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\mtxclu.dll Handle ID: 0x4fc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:51 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\mtxoci.dll Handle ID: 0x4fc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:51 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\MuiUnattend.exe Handle ID: 0x4fc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:51 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\NAPCRYPT.DLL Handle ID: 0x4fc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:51 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\NaturalLanguage6.dll Handle ID: 0x4fc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:51 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\ncobjapi.dll Handle ID: 0x4fc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:51 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\ncrypt.dll Handle ID: 0x4fc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:51 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\ncryptprov.dll Handle ID: 0x4fc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:51 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\ndfapi.dll Handle ID: 0x4fc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:51 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\negoexts.dll Handle ID: 0x4fc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:51 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\net.exe Handle ID: 0x4fc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:51 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\net1.exe Handle ID: 0x4fc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:51 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\netapi32.dll Handle ID: 0x4fc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:51 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\netid.dll Handle ID: 0x73c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:51 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\netiohlp.dll Handle ID: 0x4fc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:51 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\netlogon.dll Handle ID: 0x4fc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:51 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\netplwiz.dll Handle ID: 0x4fc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:51 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\netprofm.dll Handle ID: 0x4fc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:51 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\NetSetupApi.dll Handle ID: 0x4fc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:51 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\NetSetupEngine.dll Handle ID: 0x4fc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:51 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\netsh.exe Handle ID: 0x4fc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:51 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\netshell.dll Handle ID: 0x4fc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:51 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\nettrace.dll Handle ID: 0x4fc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:51 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\nettracehelper.dll Handle ID: 0x4fc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:51 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\newdev.dll Handle ID: 0x4fc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:51 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\ngccredprov.dll Handle ID: 0x4fc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:51 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\ngckeyenum.dll Handle ID: 0x4fc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:51 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\ngcksp.dll Handle ID: 0x4fc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:51 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\ngcutils.dll Handle ID: 0x4fc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:51 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\ninput.dll Handle ID: 0x4fc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:51 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\nlaapi.dll Handle ID: 0x4fc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:51 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\nlansp_c.dll Handle ID: 0x4fc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:51 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\nlhtml.dll Handle ID: 0x4fc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:51 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\nlmproxy.dll Handle ID: 0x4fc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:51 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\nlmsprep.dll Handle ID: 0x4fc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:51 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\NmaDirect.dll Handle ID: 0x4fc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:51 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\noise.dll Handle ID: 0x4fc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:51 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\NPSM.dll Handle ID: 0x4fc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:51 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\NPSMDesktopProvider.dll Handle ID: 0x4fc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:51 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\nshdnsclient.dll Handle ID: 0x4fc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:51 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\nshwfp.dll Handle ID: 0x4fc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:51 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\nslookup.exe Handle ID: 0x4fc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:51 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\ntlanman.dll Handle ID: 0x4fc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:51 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\ntmarta.dll Handle ID: 0x4fc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:51 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\ntshrui.dll Handle ID: 0x4fc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:51 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\ocsetapi.dll Handle ID: 0x4fc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:51 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\odbc32.dll Handle ID: 0x4fc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:51 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\odbcad32.exe Handle ID: 0x4fc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:51 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\offfilt.dll Handle ID: 0x4fc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:51 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\offreg.dll Handle ID: 0x4fc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:51 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\ole32.dll Handle ID: 0x4fc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:51 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\oleacc.dll Handle ID: 0x4fc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:51 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\oleaut32.dll Handle ID: 0x4fc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:51 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\olecli32.dll Handle ID: 0x4fc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:51 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\oleprn.dll Handle ID: 0x4fc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:51 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\olepro32.dll Handle ID: 0x4fc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:51 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\olesvr32.dll Handle ID: 0x4fc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:51 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\omadmapi.dll Handle ID: 0x4fc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:51 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\OnDemandConnRouteHelper.dll Handle ID: 0x4fc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:51 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\OneCoreCommonProxyStub.dll Handle ID: 0x4fc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:51 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\OneCoreUAPCommonProxyStub.dll Handle ID: 0x4fc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:51 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\onex.dll Handle ID: 0x4fc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:51 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\OpcServices.dll Handle ID: 0x4fc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:51 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\opengl32.dll Handle ID: 0x4fc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:51 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\OpenWith.exe Handle ID: 0x4fc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:51 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\PasswordOnWakeSettingFlyout.exe Handle ID: 0x4fc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:51 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\PATHPING.EXE Handle ID: 0x4fc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:51 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\pcacli.dll Handle ID: 0x4fc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:51 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\pcaui.dll Handle ID: 0x4fc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:51 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\pcaui.exe Handle ID: 0x4fc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:51 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\PCPKsp.dll Handle ID: 0x4fc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:51 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\pcrpf.dll Handle ID: 0x4fc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:51 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\pdh.dll Handle ID: 0x4fc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:51 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\pdhui.dll Handle ID: 0x4fc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:51 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\PeerDistSh.dll Handle ID: 0x4fc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:51 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\PeopleAPIs.dll Handle ID: 0x4fc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:51 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\perfdisk.dll Handle ID: 0x4fc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:51 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\perfnet.dll Handle ID: 0x4fc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:51 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\perfos.dll Handle ID: 0x4fc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:51 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\perfproc.dll Handle ID: 0x4fc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:51 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\PhoneOm.dll Handle ID: 0x4fc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:51 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\PhonePlatformAbstraction.dll Handle ID: 0x4fc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:51 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\Phoneutil.dll Handle ID: 0x4fc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:51 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\PhotoMetadataHandler.dll Handle ID: 0x4fc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:51 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\PickerHost.exe Handle ID: 0x4fc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:51 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\PickerPlatform.dll Handle ID: 0x4fc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:51 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\pidgenx.dll Handle ID: 0x4fc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:51 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\Pimstore.dll Handle ID: 0x4fc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:51 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\PkgMgr.exe Handle ID: 0x4fc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:51 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\pku2u.dll Handle ID: 0x73c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:51 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\pla.dll Handle ID: 0x4fc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:51 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\PlaySndSrv.dll Handle ID: 0x4fc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:51 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\PlayToDevice.dll Handle ID: 0x4fc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:51 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\PlayToReceiver.dll Handle ID: 0x4fc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:51 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\policymanager.dll Handle ID: 0x4fc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:51 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\PortableDeviceSyncProvider.dll Handle ID: 0x4fc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:51 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\PortableDeviceWiaCompat.dll Handle ID: 0x4fc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:51 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\powercfg.cpl Handle ID: 0x4fc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:51 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\powercfg.exe Handle ID: 0x4fc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:51 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\Print.PrintSupport.Source.dll Handle ID: 0x4fc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:51 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\Print.Workflow.Source.dll Handle ID: 0x4fc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:51 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\PrintRenderAPIHost.DLL Handle ID: 0x4fc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:51 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\printui.dll Handle ID: 0x4fc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:51 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\PrintWorkflowService.dll Handle ID: 0x4fc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:51 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\PrintWSDAHost.dll Handle ID: 0x4fc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:51 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\prnfldr.dll Handle ID: 0x4fc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:51 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\prnntfy.dll Handle ID: 0x4fc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:51 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\prntvpt.dll Handle ID: 0x4fc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:51 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\profapi.dll Handle ID: 0x4fc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:51 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\profext.dll Handle ID: 0x4fc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:51 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\propsys.dll Handle ID: 0x4fc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:51 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\provcore.dll Handle ID: 0x4fc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:51 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\provmigrate.dll Handle ID: 0x4fc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:51 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\provplatformdesktop.dll Handle ID: 0x4fc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:51 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\prxyqry.dll Handle ID: 0x4fc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:51 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\psr.exe Handle ID: 0x4fc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:51 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\puiapi.dll Handle ID: 0x4fc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:51 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\qdvd.dll Handle ID: 0x4fc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:51 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\quartz.dll Handle ID: 0x4fc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:51 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\Query.dll Handle ID: 0x4fc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:51 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\qwave.dll Handle ID: 0x4fc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:51 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\rasapi32.dll Handle ID: 0x4fc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:51 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\raschap.dll Handle ID: 0x4fc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:51 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\raschapext.dll Handle ID: 0x4fc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:51 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\rasdial.exe Handle ID: 0x4fc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:51 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\rasdlg.dll Handle ID: 0x4fc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:51 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\rasgcw.dll Handle ID: 0x4fc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:51 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\rasman.dll Handle ID: 0x4fc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:51 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\rasmontr.dll Handle ID: 0x4fc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:51 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\rasphone.exe Handle ID: 0x4fc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:51 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\rasplap.dll Handle ID: 0x4fc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:51 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\rasppp.dll Handle ID: 0x4fc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:51 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\rastls.dll Handle ID: 0x4fc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:51 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\rastlsext.dll Handle ID: 0x4fc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:51 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\rdpbase.dll Handle ID: 0x4fc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:51 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\RdpSaUacHelper.exe Handle ID: 0x4fc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:51 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\rdpserverbase.dll Handle ID: 0x4fc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:51 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\rdpsharercom.dll Handle ID: 0x4fc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:51 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\rdpviewerax.dll Handle ID: 0x4fc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:51 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\rdrleakdiag.exe Handle ID: 0x4fc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:51 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\rdvvmtransport.dll Handle ID: 0x4fc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:51 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\ReAgent.dll Handle ID: 0x734 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:51 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\ReAgentc.exe Handle ID: 0x734 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:51 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\regedit.exe Handle ID: 0x734 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:51 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\regsvr32.exe Handle ID: 0x734 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:51 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\ReInfo.dll Handle ID: 0x734 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:51 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\RESAMPLEDMO.DLL Handle ID: 0x734 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:51 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\resutils.dll Handle ID: 0x734 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:51 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\rmclient.dll Handle ID: 0x734 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:51 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\Robocopy.exe Handle ID: 0x734 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:52 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\rometadata.dll Handle ID: 0x734 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:52 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\rpcnsh.dll Handle ID: 0x734 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:52 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\rpcrt4.dll Handle ID: 0x734 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:52 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\RpcRtRemote.dll Handle ID: 0x734 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:52 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\rsaenh.dll Handle ID: 0x734 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:52 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\RstrtMgr.dll Handle ID: 0x734 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:52 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\rtffilt.dll Handle ID: 0x734 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:52 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\rtm.dll Handle ID: 0x734 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:52 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\RTWorkQ.dll Handle ID: 0x734 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:52 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\rundll32.exe Handle ID: 0x734 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:52 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\runonce.exe Handle ID: 0x734 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:52 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\samcli.dll Handle ID: 0x98c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:52 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\samlib.dll Handle ID: 0x98c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:52 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\scecli.dll Handle ID: 0x98c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:52 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\scesrv.dll Handle ID: 0x98c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:52 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\schannel.dll Handle ID: 0x98c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:52 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\schtasks.exe Handle ID: 0x98c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:52 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\scksp.dll Handle ID: 0x98c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:52 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\scrptadm.dll Handle ID: 0x98c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:52 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\scrrun.dll Handle ID: 0x98c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:52 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\sdbinst.exe Handle ID: 0x73c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:52 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\sdchange.exe Handle ID: 0x98c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:52 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\sdiageng.dll Handle ID: 0x98c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:52 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\Search.ProtocolHandler.MAPI2.dll Handle ID: 0x98c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:52 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\SearchFilterHost.exe Handle ID: 0x73c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:52 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\SearchFolder.dll Handle ID: 0x98c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:52 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\SearchIndexer.exe Handle ID: 0x98c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:52 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\SearchIndexerCore.dll Handle ID: 0x98c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:52 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\SearchProtocolHost.exe Handle ID: 0x98c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:52 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\SecEdit.exe Handle ID: 0x734 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:52 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\sechost.dll Handle ID: 0x734 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:52 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\sendmail.dll Handle ID: 0x734 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:52 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\SensorsApi.dll Handle ID: 0x734 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:52 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\SensorsNativeApi.dll Handle ID: 0x734 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:52 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\SensorsNativeApi.V2.dll Handle ID: 0x734 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:52 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\SensorsUtilsV2.dll Handle ID: 0x734 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:52 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\ServicingCommon.dll Handle ID: 0x734 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:52 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\SessEnv.dll Handle ID: 0x734 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:52 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\sethc.exe Handle ID: 0x734 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:52 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\setupapi.dll Handle ID: 0x734 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:52 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\setupugc.exe Handle ID: 0x734 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:52 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\sfc.exe Handle ID: 0x734 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:52 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\ShareHost.dll Handle ID: 0x734 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:52 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\SHCore.dll Handle ID: 0x734 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:52 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\shdocvw.dll Handle ID: 0x734 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:52 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\shell32.dll Handle ID: 0x734 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:52 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\ShellCommonCommonProxyStub.dll Handle ID: 0x734 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:52 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\shlwapi.dll Handle ID: 0x734 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:52 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\shsetup.dll Handle ID: 0x734 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:52 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\shsvcs.dll Handle ID: 0x734 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:52 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\shutdown.exe Handle ID: 0x734 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:52 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\shwebsvc.dll Handle ID: 0x734 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:52 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\SimAuth.dll Handle ID: 0x734 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:52 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\SimCfg.dll Handle ID: 0x734 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:52 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\SmartcardCredentialProvider.dll Handle ID: 0x734 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:52 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\smphost.dll Handle ID: 0x734 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:52 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\SndVolSSO.dll Handle ID: 0x734 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:52 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\softkbd.dll Handle ID: 0x734 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:52 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\SpatialAudioLicenseSrv.exe Handle ID: 0x734 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:52 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\sppc.dll Handle ID: 0x734 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:52 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\sppcext.dll Handle ID: 0x734 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:52 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\sppcomapi.dll Handle ID: 0x734 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:52 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\spwizeng.dll Handle ID: 0x734 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:52 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\sqmapi.dll Handle ID: 0x734 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:52 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\srchadmin.dll Handle ID: 0x734 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:52 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\srpapi.dll Handle ID: 0x734 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:52 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\srumsvc.dll Handle ID: 0x734 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:52 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\sscore.dll Handle ID: 0x734 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:52 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\ssdm.dll Handle ID: 0x734 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:52 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\sspicli.dll Handle ID: 0x734 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:52 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\StateRepository.Core.dll Handle ID: 0x734 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:52 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\stdole32.tlb Handle ID: 0x734 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:52 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\stobject.dll Handle ID: 0x734 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:52 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\storagewmi.dll Handle ID: 0x734 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:52 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\stordiag.exe Handle ID: 0x734 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:52 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\StructuredQuery.dll Handle ID: 0x734 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:52 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\sud.dll Handle ID: 0x734 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:52 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\SyncCenter.dll Handle ID: 0x734 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:52 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\SyncController.dll Handle ID: 0x734 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:52 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\SyncSettings.dll Handle ID: 0x734 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:52 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\sysmon.ocx Handle ID: 0x734 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:52 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\SystemSettings.DataModel.dll Handle ID: 0x734 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:52 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\SystemUWPLauncher.exe Handle ID: 0x734 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:52 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\tapisrv.dll Handle ID: 0x734 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:52 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\tar.exe Handle ID: 0x734 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:52 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\TaskManagerDataLayer.dll Handle ID: 0x734 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:52 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\Taskmgr.exe Handle ID: 0x734 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:52 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\tbauth.dll Handle ID: 0x734 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:52 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\tbs.dll Handle ID: 0x734 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:52 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\tcpipcfg.dll Handle ID: 0x734 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:52 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\tcpmonui.dll Handle ID: 0x734 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:52 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\tdh.dll Handle ID: 0x98c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:52 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\tdhres.dll Handle ID: 0x734 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:52 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\TextInputFramework.dll Handle ID: 0x734 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:52 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\TextInputMethodFormatter.dll Handle ID: 0x734 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:52 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\TextShaping.dll Handle ID: 0x734 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:52 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\themecpl.dll Handle ID: 0x734 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:52 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\themeui.dll Handle ID: 0x734 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:52 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\thumbcache.dll Handle ID: 0x734 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:52 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\TileDataRepository.dll Handle ID: 0x734 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:52 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\timedate.cpl Handle ID: 0x734 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:52 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\TokenBroker.dll Handle ID: 0x734 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:52 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\TokenBrokerUI.dll Handle ID: 0x734 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:52 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\TpmCertResources.dll Handle ID: 0x734 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:52 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\TpmCoreProvisioning.dll Handle ID: 0x98c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:52 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\TpmTool.exe Handle ID: 0x734 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:52 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\tquery.dll Handle ID: 0x734 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:52 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\TrustedSignalCredProv.dll Handle ID: 0x734 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:52 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\tsgqec.dll Handle ID: 0x734 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:52 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\tsmf.dll Handle ID: 0x734 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:52 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\TSpkg.dll Handle ID: 0x734 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:52 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\TtlsAuth.dll Handle ID: 0x734 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:52 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\TtlsCfg.dll Handle ID: 0x734 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:52 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\twext.dll Handle ID: 0x734 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:52 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\twinapi.appcore.dll Handle ID: 0x734 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:52 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\twinapi.dll Handle ID: 0x98c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:52 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\twinui.appcore.dll Handle ID: 0x98c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:52 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\twinui.dll Handle ID: 0x98c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:52 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\tzautoupdate.dll Handle ID: 0x98c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:52 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\ucrtbase.dll Handle ID: 0x98c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:52 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\UiaManager.dll Handle ID: 0x98c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:52 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\UIAnimation.dll Handle ID: 0x98c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:52 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\UIAutomationCore.dll Handle ID: 0x98c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:52 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\uireng.dll Handle ID: 0x98c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:52 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\ulib.dll Handle ID: 0x98c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:52 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\umpdc.dll Handle ID: 0x98c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:52 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\unenrollhook.dll Handle ID: 0x98c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:52 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\Unistore.dll Handle ID: 0x73c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:52 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\UpdateCompression.dll Handle ID: 0x73c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:52 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\upnp.dll Handle ID: 0x73c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:52 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\upnphost.dll Handle ID: 0x72c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:52 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\uReFS.dll Handle ID: 0x73c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:52 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\urlmon.dll Handle ID: 0x73c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:52 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\usbceip.dll Handle ID: 0x73c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:52 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\user32.dll Handle ID: 0x73c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:52 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\UserAccountControlSettings.dll Handle ID: 0x73c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:52 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\UserAccountControlSettings.exe Handle ID: 0x73c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:52 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\useractivitybroker.dll Handle ID: 0x73c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:52 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\usercpl.dll Handle ID: 0x73c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:52 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\UserDataPlatformHelperUtil.dll Handle ID: 0x73c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:52 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\UserDeviceRegistration.dll Handle ID: 0x73c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:52 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\UserDeviceRegistration.Ngc.dll Handle ID: 0x73c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:52 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\userenv.dll Handle ID: 0x73c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:52 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\userinit.exe Handle ID: 0x72c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:52 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\UserLanguageProfileCallback.dll Handle ID: 0x73c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:52 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\usermgrcli.dll Handle ID: 0x73c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:52 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\UserMgrProxy.dll Handle ID: 0x73c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:52 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\usoapi.dll Handle ID: 0x73c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:52 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\utcapi.dll Handle ID: 0x73c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:52 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\Utilman.exe Handle ID: 0x73c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:52 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\UXInit.dll Handle ID: 0x4fc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:52 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\uxtheme.dll Handle ID: 0x4fc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:52 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\vbscript.dll Handle ID: 0x4fc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:52 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\VIDRESZR.DLL Handle ID: 0x4fc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:52 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\VirtualSurroundApo.dll Handle ID: 0x4fc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:52 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\vssapi.dll Handle ID: 0x4fc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:52 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\w32tm.exe Handle ID: 0x4fc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:52 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\WalletBackgroundServiceProxy.dll Handle ID: 0x4fc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:52 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\wbemcomn.dll Handle ID: 0x4fc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:52 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\wcmapi.dll Handle ID: 0x4fc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:52 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\wcnwiz.dll Handle ID: 0x4fc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:52 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\wdc.dll Handle ID: 0x4fc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:52 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\wdi.dll Handle ID: 0x4fc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:52 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\wdigest.dll Handle ID: 0x4fc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:52 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\wdmaud2.drv Handle ID: 0x1f8c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:52 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\webauthn.dll Handle ID: 0x1f8c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:52 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\WebcamUi.dll Handle ID: 0x1f8c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:52 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\webio.dll Handle ID: 0x1f8c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:52 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\webplatstorageserver.dll Handle ID: 0x1f8c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:52 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\webservices.dll Handle ID: 0x1f8c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:52 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\wer.dll Handle ID: 0x1f8c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:52 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\werdiagcontroller.dll Handle ID: 0x1f8c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:52 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\WerEnc.dll Handle ID: 0x1f8c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:52 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\weretw.dll Handle ID: 0x1f8c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:52 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\WerFault.exe Handle ID: 0x1f8c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:52 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\WerFaultSecure.exe Handle ID: 0x1f8c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:52 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\wermgr.exe Handle ID: 0x1134 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:52 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\werui.dll Handle ID: 0x1134 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:52 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\wevtapi.dll Handle ID: 0x1134 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:52 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\wevtutil.exe Handle ID: 0x1134 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:52 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\wextract.exe Handle ID: 0x1134 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:52 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\wfapigp.dll Handle ID: 0x1134 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:52 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\WiFiDisplay.dll Handle ID: 0x1134 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:52 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\wimgapi.dll Handle ID: 0x1134 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:52 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\win32u.dll Handle ID: 0x1134 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:52 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\winbio.dll Handle ID: 0x1134 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:52 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\winbioext.dll Handle ID: 0x4fc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:52 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\winbrand.dll Handle ID: 0x4fc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:52 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\wincorlib.dll Handle ID: 0x1134 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:52 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\wincredprovider.dll Handle ID: 0x4fc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:52 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\wincredui.dll Handle ID: 0x108c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:52 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\WindowManagementAPI.dll Handle ID: 0x108c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:52 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\Windows.AccountsControl.dll Handle ID: 0x108c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:52 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\Windows.ApplicationModel.ConversationalAgent.dll Handle ID: 0x108c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:52 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\Windows.ApplicationModel.Core.dll Handle ID: 0x108c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:52 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\windows.applicationmodel.datatransfer.dll Handle ID: 0x108c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:52 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\Windows.ApplicationModel.dll Handle ID: 0x98c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:52 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\Windows.ApplicationModel.LockScreen.dll Handle ID: 0x108c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:52 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\Windows.ApplicationModel.Store.dll Handle ID: 0x108c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:52 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\Windows.ApplicationModel.Store.TestingFramework.dll Handle ID: 0x4fc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:52 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\Windows.Data.Pdf.dll Handle ID: 0x738 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:52 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\Windows.Devices.Background.dll Handle ID: 0x738 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:52 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\Windows.Devices.Bluetooth.dll Handle ID: 0x738 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:52 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\Windows.Devices.Custom.dll Handle ID: 0x4fc Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:52 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\Windows.Devices.Enumeration.dll Handle ID: 0x738 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:52 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\Windows.Devices.HumanInterfaceDevice.dll Handle ID: 0x738 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:52 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\Windows.Devices.Lights.dll Handle ID: 0x738 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:52 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\Windows.Devices.Midi.dll Handle ID: 0x108c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:52 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\Windows.Devices.Perception.dll Handle ID: 0x108c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:52 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\Windows.Devices.Picker.dll Handle ID: 0xbd0 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:52 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\Windows.Devices.PointOfService.dll Handle ID: 0xbd0 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:52 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\Windows.Devices.Portable.dll Handle ID: 0x780 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:52 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\Windows.Devices.Sensors.dll Handle ID: 0x780 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:52 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\Windows.Devices.SmartCards.dll Handle ID: 0x780 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:52 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\Windows.Devices.SmartCards.Phone.dll Handle ID: 0x780 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:52 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\Windows.Devices.Usb.dll Handle ID: 0x780 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:52 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\Windows.Devices.WiFiDirect.dll Handle ID: 0xe9c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:52 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\Windows.Energy.dll Handle ID: 0x8b8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:52 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\Windows.FileExplorer.Common.dll Handle ID: 0x8b8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:52 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\Windows.Gaming.Input.dll Handle ID: 0x8b8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:52 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\Windows.Gaming.Preview.dll Handle ID: 0x8b8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:52 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\Windows.Gaming.UI.GameBar.dll Handle ID: 0x8b8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:52 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\Windows.Globalization.dll Handle ID: 0x8b8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:52 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\Windows.Graphics.Display.BrightnessOverride.dll Handle ID: 0x8b8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:52 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\Windows.Graphics.Display.DisplayEnhancementOverride.dll Handle ID: 0x8b8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:52 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\Windows.Graphics.dll Handle ID: 0x8b8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:52 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\Windows.Graphics.Printing.dll Handle ID: 0x8b8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:52 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\Windows.Graphics.Printing.ProtectedPrint.dll Handle ID: 0x8b8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:52 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\Windows.Graphics.Printing.Workflow.dll Handle ID: 0x8b8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:52 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\Windows.Graphics.Printing.Workflow.Native.dll Handle ID: 0x8b8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:52 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\Windows.Internal.Devices.Bluetooth.dll Handle ID: 0x8b8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:52 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\Windows.Internal.Devices.Sensors.dll Handle ID: 0x8b8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:52 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\Windows.Internal.Graphics.Display.DisplayColorManagement.dll Handle ID: 0x8b8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:52 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\Windows.Internal.Management.dll Handle ID: 0x8b8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:52 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\windows.internal.shellcommon.AccountsControlExperience.dll Handle ID: 0x8b8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:52 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\windows.internal.shellcommon.AppResolverModal.dll Handle ID: 0x8b8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:52 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\Windows.Internal.UI.Dialogs.dll Handle ID: 0x8b8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:52 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\Windows.Internal.UI.Shell.WindowTabManager.dll Handle ID: 0xe9c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:52 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\Windows.Management.EnrollmentStatusTracking.ConfigProvider.dll Handle ID: 0x8b8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:52 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\Windows.Management.InprocObjects.dll Handle ID: 0x8b8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:52 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\Windows.Management.ModernDeployment.ConfigProviders.dll Handle ID: 0x8b8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:52 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\Windows.Management.Service.dll Handle ID: 0x8b8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:52 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\Windows.Management.Update.dll Handle ID: 0x8b8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:52 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\Windows.Management.Workplace.dll Handle ID: 0x8b8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:52 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\Windows.Media.Audio.dll Handle ID: 0x8b8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:52 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\Windows.Media.BackgroundMediaPlayback.dll Handle ID: 0x8b8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:52 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\Windows.Media.Devices.dll Handle ID: 0x8b8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:52 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\Windows.Media.dll Handle ID: 0x8b8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:52 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\Windows.Media.Import.dll Handle ID: 0x780 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:52 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\Windows.Media.MediaControl.dll Handle ID: 0x780 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:52 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\Windows.Media.Playback.BackgroundMediaPlayer.dll Handle ID: 0x8b8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:52 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\Windows.Media.Playback.MediaPlayer.dll Handle ID: 0x8b8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:52 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\Windows.Media.Protection.PlayReady.dll Handle ID: 0x8b8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:52 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\Windows.Media.Speech.dll Handle ID: 0x8b8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:52 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\Windows.Media.Streaming.dll Handle ID: 0x8b8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:52 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\Windows.Networking.BackgroundTransfer.dll Handle ID: 0x8b8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:52 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\Windows.Networking.Connectivity.dll Handle ID: 0x780 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:52 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\Windows.Networking.dll Handle ID: 0x8b8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:52 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\Windows.Networking.HostName.dll Handle ID: 0x8b8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:52 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\Windows.Networking.NetworkOperators.ESim.dll Handle ID: 0x8b8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:52 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\Windows.Networking.NetworkOperators.HotspotAuthentication.dll Handle ID: 0x780 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:52 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\Windows.Networking.Proximity.dll Handle ID: 0x8b8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:52 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\Windows.Networking.Sockets.PushEnabledApplication.dll Handle ID: 0x780 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:52 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\Windows.Networking.Vpn.dll Handle ID: 0x780 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:52 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\Windows.Payments.dll Handle ID: 0x780 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:52 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\Windows.Security.Authentication.OnlineId.dll Handle ID: 0x780 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:52 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\Windows.Security.Authentication.Web.Core.dll Handle ID: 0x780 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:52 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\Windows.Security.Credentials.UI.UserConsentVerifier.dll Handle ID: 0x780 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:52 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\Windows.Services.TargetedContent.dll Handle ID: 0x780 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:52 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\Windows.StateRepository.dll Handle ID: 0x780 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:52 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\Windows.StateRepositoryBroker.dll Handle ID: 0x780 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:52 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\Windows.StateRepositoryClient.dll Handle ID: 0x780 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:52 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\Windows.StateRepositoryCore.dll Handle ID: 0x780 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:52 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\Windows.StateRepositoryPS.dll Handle ID: 0x780 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:52 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\Windows.StateRepositoryUpgrade.dll Handle ID: 0xe9c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:52 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\Windows.Storage.ApplicationData.dll Handle ID: 0x780 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:52 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\windows.storage.dll Handle ID: 0x780 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:52 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\Windows.Storage.OneCore.dll Handle ID: 0x780 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:52 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\Windows.Storage.Search.dll Handle ID: 0x780 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:52 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\Windows.System.Diagnostics.dll Handle ID: 0x780 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:52 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\Windows.System.Launcher.dll Handle ID: 0x780 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:52 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\Windows.System.Profile.HardwareId.dll Handle ID: 0x8b8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:52 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\Windows.System.Profile.SystemId.dll Handle ID: 0x8b8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:52 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\Windows.System.Profile.SystemManufacturers.dll Handle ID: 0x8b8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:52 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\Windows.System.RemoteDesktop.dll Handle ID: 0x780 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:52 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\Windows.System.SystemManagement.dll Handle ID: 0x8b8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:52 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\Windows.System.UserProfile.DiagnosticsSettings.dll Handle ID: 0x8b8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:52 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\Windows.UI.Accessibility.dll Handle ID: 0x8b8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:52 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\Windows.UI.Core.TextInput.dll Handle ID: 0x8b8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:52 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\Windows.UI.Cred.dll Handle ID: 0x8b8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:52 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\Windows.UI.CredDialogController.dll Handle ID: 0x8b8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:52 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\Windows.UI.dll Handle ID: 0x8b8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:52 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\Windows.UI.FileExplorer.dll Handle ID: 0x8b8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:52 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\Windows.UI.Immersive.dll Handle ID: 0x8b8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:52 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\Windows.UI.Input.Inking.dll Handle ID: 0x728 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:52 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\Windows.UI.Search.dll Handle ID: 0x728 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:52 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\Windows.UI.Xaml.Controls.dll Handle ID: 0x728 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:52 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\Windows.UI.Xaml.dll Handle ID: 0x8b8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:52 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\Windows.UI.Xaml.Maps.dll Handle ID: 0x728 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:52 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\Windows.UI.Xaml.Phone.dll Handle ID: 0x728 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:52 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\Windows.UI.XamlHost.dll Handle ID: 0x728 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:52 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\Windows.WARP.JITService.exe Handle ID: 0x728 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:52 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\Windows.Web.Http.dll Handle ID: 0x728 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:52 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\WindowsCodecs.dll Handle ID: 0x728 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:52 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\WindowsCodecsExt.dll Handle ID: 0x728 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:52 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\WindowsDefaultHeatProcessor.dll Handle ID: 0x728 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:52 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\windowsdefenderapplicationguardcsp.dll Handle ID: 0x728 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:52 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\windowslivelogin.dll Handle ID: 0x728 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:52 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\windowsperformancerecordercontrol.dll Handle ID: 0x728 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:52 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\windowsudk.shellcommon.dll Handle ID: 0x728 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:52 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\winhttp.dll Handle ID: 0x728 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:52 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\winhttpcom.dll Handle ID: 0x728 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:52 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\wininet.dll Handle ID: 0x728 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:52 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\wininitext.dll Handle ID: 0x8b8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:52 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\Winlangdb.dll Handle ID: 0x8b8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:52 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\winmm.dll Handle ID: 0x728 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:52 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\winmmbase.dll Handle ID: 0x728 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:52 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\winrs.exe Handle ID: 0x728 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:52 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\winrscmd.dll Handle ID: 0x728 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:52 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\winrshost.exe Handle ID: 0x728 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:52 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\winrsmgr.dll Handle ID: 0x728 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:52 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\winrssrv.dll Handle ID: 0x728 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:52 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\WinSATAPI.dll Handle ID: 0x728 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:52 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\winsku.dll Handle ID: 0x728 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:52 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\winspool.drv Handle ID: 0x728 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:52 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\winsta.dll Handle ID: 0x728 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:52 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\wintrust.dll Handle ID: 0x728 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:52 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\WinTypes.dll Handle ID: 0x728 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:52 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\WinUICohabitation.dll Handle ID: 0x728 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:52 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\wisp.dll Handle ID: 0x728 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:52 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\wkscli.dll Handle ID: 0x728 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:52 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\wlanapi.dll Handle ID: 0x728 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:52 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\wlancfg.dll Handle ID: 0x728 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:52 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\wlanext.exe Handle ID: 0x728 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:52 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\wlangpui.dll Handle ID: 0x728 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:52 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\wlanhlp.dll Handle ID: 0x728 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:52 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\wlanui.dll Handle ID: 0x8b8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:52 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\Wldap32.dll Handle ID: 0x728 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:52 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\wldp.dll Handle ID: 0x728 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:52 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\wlgpclnt.dll Handle ID: 0x728 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:52 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\wlidcli.dll Handle ID: 0x728 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:52 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\wlidcredprov.dll Handle ID: 0x728 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:52 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\wlidfdp.dll Handle ID: 0x728 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:52 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\wlidnsp.dll Handle ID: 0x728 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:52 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\wlidprov.dll Handle ID: 0x728 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:52 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\WMADMOD.DLL Handle ID: 0x728 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:52 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\WMADMOE.DLL Handle ID: 0x8b8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:52 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\WMNetMgr.dll Handle ID: 0x728 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:52 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\wmp.dll Handle ID: 0x728 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:52 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\WMPhoto.dll Handle ID: 0x728 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:52 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\WMSPDMOD.DLL Handle ID: 0x728 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:52 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\WMSPDMOE.DLL Handle ID: 0x728 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:52 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\WMVDECOD.DLL Handle ID: 0x728 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:52 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\WMVENCOD.DLL Handle ID: 0x728 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:52 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\WMVSDECD.DLL Handle ID: 0x8b8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:52 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\WMVSENCD.DLL Handle ID: 0x8b8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:52 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\WMVXENCD.DLL Handle ID: 0x728 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:52 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\WordBreakers.dll Handle ID: 0x728 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:52 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\Wpc.dll Handle ID: 0x728 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:52 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\WpcWebFilter.dll Handle ID: 0x728 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:52 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\wpdshext.dll Handle ID: 0x728 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:52 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\wpnapps.dll Handle ID: 0x728 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:52 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\wpnclient.dll Handle ID: 0x728 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:52 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\ws2_32.dll Handle ID: 0x728 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:52 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\wscapi.dll Handle ID: 0x728 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:52 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\wscript.exe Handle ID: 0x728 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:52 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\WSDApi.dll Handle ID: 0x728 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:52 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\wsdchngr.dll Handle ID: 0x728 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:52 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\wsecedit.dll Handle ID: 0x728 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:52 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\wsmprovhost.exe Handle ID: 0x728 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:52 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\WsmSvc.dll Handle ID: 0x728 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:52 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\wsp_fs.dll Handle ID: 0x728 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:52 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\wsp_health.dll Handle ID: 0x728 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:52 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\wtsapi32.dll Handle ID: 0x8b8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:52 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\wuapi.dll Handle ID: 0x728 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:52 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\wuceffects.dll Handle ID: 0x728 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:52 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\wusa.exe Handle ID: 0x728 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:52 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\wusys.dll Handle ID: 0x728 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:52 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\WWAHost.exe Handle ID: 0x728 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:52 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\WWanAPI.dll Handle ID: 0x728 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:52 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\wwancfg.dll Handle ID: 0x728 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:52 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\WwanPrfl.dll Handle ID: 0x728 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:52 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\wwapi.dll Handle ID: 0x728 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:52 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\XAudio2_9.dll Handle ID: 0x8b8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:52 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\XblAuthManagerProxy.dll Handle ID: 0x728 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:52 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\XblAuthTokenBrokerExt.dll Handle ID: 0x728 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:52 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\XInput1_4.dll Handle ID: 0x728 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:52 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\XInputUap.dll Handle ID: 0x728 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:52 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\xmlfilter.dll Handle ID: 0x728 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:52 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\xmllite.dll Handle ID: 0x728 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:52 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\xolehlp.dll Handle ID: 0x728 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:52 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\XpsDocumentTargetPrint.dll Handle ID: 0x728 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:52 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\XpsPrint.dll Handle ID: 0x728 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:52 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\xpsservices.dll Handle ID: 0x728 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:52 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\XpsToPclmConverter.dll Handle ID: 0x728 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:52 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\XpsToPwgrConverter.dll Handle ID: 0x728 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:52 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\XpsToTiffConverter.dll Handle ID: 0x728 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:52 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\zipcontainer.dll Handle ID: 0x728 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:52 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\zipfldr.dll Handle ID: 0x728 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:52 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\Dism\AppxProvider.dll Handle ID: 0x728 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:52 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\Dism\CbsProvider.dll Handle ID: 0x8b8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:52 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\Dism\DismCore.dll Handle ID: 0x728 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:52 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\Dism\DismCorePS.dll Handle ID: 0x728 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:52 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\Dism\DismProv.dll Handle ID: 0x728 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:52 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\Dism\DmiProvider.dll Handle ID: 0xe9c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:52 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\Dism\FolderProvider.dll Handle ID: 0x728 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:52 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\Dism\GenericProvider.dll Handle ID: 0x728 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:52 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\Dism\IntlProvider.dll Handle ID: 0x728 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:52 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\Dism\LogProvider.dll Handle ID: 0x728 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:52 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\Dism\MsuProvider.dll Handle ID: 0x728 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:52 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\Dism\OfflineSetupProvider.dll Handle ID: 0x728 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:52 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\Dism\OSProvider.dll Handle ID: 0x8b8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:52 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\Dism\ProvProvider.dll Handle ID: 0x728 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:52 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\Dism\SmiProvider.dll Handle ID: 0x728 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:52 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\Dism\TransmogProvider.dll Handle ID: 0x728 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:52 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\Dism\UnattendProvider.dll Handle ID: 0x728 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:52 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\Drivers\afunix.sys Handle ID: 0x728 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:52 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\en\AuthFWSnapIn.Resources.dll Handle ID: 0x728 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:52 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\en\AuthFWWizFwk.Resources.dll Handle ID: 0x728 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:52 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\en-US\ntdll.dll.mui Handle ID: 0x728 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:53 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\IME\IMEJP\IMJPAPI.DLL Handle ID: 0x728 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:53 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\IME\IMEJP\IMJPCD.DLL Handle ID: 0x728 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:53 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\IME\IMEJP\IMJPCMLD.DLL Handle ID: 0x728 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:53 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\IME\IMEJP\imjpcus.dll Handle ID: 0x728 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:53 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\IME\IMEJP\IMJPDAPI.DLL Handle ID: 0x8b8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:53 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\IME\IMEJP\IMJPDCT.EXE Handle ID: 0x728 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:53 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\IME\IMEJP\IMJPDCTP.DLL Handle ID: 0x728 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:53 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\IME\IMEJP\IMJPLMP.DLL Handle ID: 0x728 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:53 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\IME\IMEJP\IMJPPRED.DLL Handle ID: 0x728 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:53 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\IME\IMEJP\IMJPSET.EXE Handle ID: 0x728 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:53 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\IME\IMEJP\IMJPTIP.DLL Handle ID: 0x728 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:53 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\IME\IMEJP\IMJPUEX.EXE Handle ID: 0x728 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:53 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\IME\IMEJP\imjpuexc.exe Handle ID: 0x728 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:53 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\IME\IMEJP\imjputyc.dll Handle ID: 0x8b8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:53 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\IME\IMEJP\APPLETS\IMJPCAC.DLL Handle ID: 0x728 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:53 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\IME\IMEJP\APPLETS\IMJPCLST.DLL Handle ID: 0x728 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:53 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\IME\IMEJP\APPLETS\IMJPKDIC.DLL Handle ID: 0x728 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:53 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\IME\IMEJP\APPLETS\imjpskey.DLL Handle ID: 0x728 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:53 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\IME\IMEJP\APPLETS\IMJPSKF.DLL Handle ID: 0x728 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:53 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\IME\IMEKR\imkrapi.dll Handle ID: 0x728 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:53 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\IME\IMEKR\imkrotip.dll Handle ID: 0x728 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:53 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\IME\IMEKR\imkrtip.dll Handle ID: 0x728 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:53 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\IME\IMEKR\imkrudt.dll Handle ID: 0x728 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:53 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\IME\IMEKR\APPLETS\imkrcac.dll Handle ID: 0x728 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:53 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\IME\IMEKR\APPLETS\imkrskf.dll Handle ID: 0x728 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:53 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\IME\IMEKR\DICTS\imkrhjd.dll Handle ID: 0x728 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:53 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\IME\IMETC\IMTCCFG.DLL Handle ID: 0x728 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:53 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\IME\IMETC\IMTCCORE.DLL Handle ID: 0x728 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:53 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\IME\IMETC\IMTCLNWZ.EXE Handle ID: 0x728 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:53 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\IME\IMETC\IMTCPROP.exe Handle ID: 0x728 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:53 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\IME\IMETC\IMTCTIP.dll Handle ID: 0x728 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:53 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\IME\IMETC\applets\IMTCCAC.dll Handle ID: 0x728 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:53 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\IME\IMETC\applets\IMTCSKF.dll Handle ID: 0x728 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:53 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\IME\SHARED\IMCCPHR.exe Handle ID: 0x728 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:53 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\IME\SHARED\imecfm.dll Handle ID: 0x728 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:53 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\IME\SHARED\imecfmui.exe Handle ID: 0x728 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:53 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\IME\SHARED\IMEFILES.DLL Handle ID: 0x728 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:53 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\IME\SHARED\IMELM.DLL Handle ID: 0x728 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:53 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\IME\SHARED\IMEPADSM.DLL Handle ID: 0x8b8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:53 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\IME\SHARED\IMEPADSV.EXE Handle ID: 0x728 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:53 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\IME\SHARED\IMESEARCH.EXE Handle ID: 0x498 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:53 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\IME\SHARED\IMESEARCHDLL.DLL Handle ID: 0x498 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:53 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\IME\SHARED\IMETIP.DLL Handle ID: 0x498 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:53 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\IME\SHARED\IMEWDBLD.EXE Handle ID: 0x498 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:53 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\IME\SHARED\IMJKAPI.DLL Handle ID: 0x498 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:53 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\IME\SHARED\MSCAND20.DLL Handle ID: 0x498 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:53 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\IME\SHARED\res\padrs411.dll Handle ID: 0x498 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:53 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\IME\SHARED\res\padrs412.dll Handle ID: 0x498 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:53 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\InputMethod\CHS\ChsIFEComp.dll Handle ID: 0x498 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:53 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\InstallShield\setup.exe Handle ID: 0x498 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:53 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\migration\imjpmig.dll Handle ID: 0x8b8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:53 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\migration\shmig.dll Handle ID: 0x8b8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:53 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\migration\sppmig.dll Handle ID: 0x8b8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:53 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\migration\WMIMigrationPlugin.dll Handle ID: 0x498 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:53 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\migration\WSearchMigPlugin.dll Handle ID: 0x498 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:53 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\setup\msdtcstp.dll Handle ID: 0x498 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:53 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\setup\pbkmigr.dll Handle ID: 0x498 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:53 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\setup\RasMigPlugin.dll Handle ID: 0x8b8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:53 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\Speech\Common\sapi.dll Handle ID: 0x8b8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:53 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\Speech_OneCore\Common\sapi_onecore.dll Handle ID: 0x8b8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:53 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\Speech_OneCore\Common\SpeechModelDownload.exe Handle ID: 0x498 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:53 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\Speech_OneCore\Common\Windows.Speech.Dictation.dll Handle ID: 0x8b8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:53 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\Speech_OneCore\Common\Windows.Speech.Shell.dll Handle ID: 0x498 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:53 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\Speech_OneCore\Engines\SR\spsreng_onecore.dll Handle ID: 0x498 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:53 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\Speech_OneCore\Engines\TTS\MSTTSEngine_OneCore.dll Handle ID: 0x8b8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:53 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\Speech_OneCore\Engines\TTS\MSTTSLoc_OneCore.dll Handle ID: 0x498 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:53 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\spp\tokens\pkeyconfig\pkeyconfig.xrm-ms Handle ID: 0x498 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:53 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\spp\tokens\skus\csvlk-pack\DefaultPpd-csvlk-pack-ppdlic.xrm-ms Handle ID: 0x498 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:53 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\wbem\esscli.dll Handle ID: 0x498 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:53 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\wbem\fastprox.dll Handle ID: 0x498 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:53 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\wbem\Microsoft.Uev.AgentWmi.dll Handle ID: 0x498 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:53 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\wbem\mofcomp.exe Handle ID: 0x498 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:53 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\wbem\mofd.dll Handle ID: 0x498 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:53 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\wbem\msdtcwmi.dll Handle ID: 0x498 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:53 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\wbem\PrintManagementProvider.dll Handle ID: 0x498 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:53 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\wbem\wbemdisp.dll Handle ID: 0x498 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:53 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\wbem\wbemprox.dll Handle ID: 0x498 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:53 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\wbem\wbemsvc.dll Handle ID: 0x498 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:53 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\wbem\WMIADAP.exe Handle ID: 0x498 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:53 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\wbem\WMICOOKR.dll Handle ID: 0x498 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:53 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\wbem\WmiPrvSE.exe Handle ID: 0x498 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:53 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\wbem\wmiutils.dll Handle ID: 0x498 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:53 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppvClientComConsumer.dll Handle ID: 0x8b8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:53 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\Appx\Appx.format.ps1xml Handle ID: 0x498 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:53 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\Appx\Microsoft.Windows.Appx.PackageManager.Commands.Core.dll Handle ID: 0x498 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:53 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\Appx\en\Appx.psd1 Handle ID: 0x8b8 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:53 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\Appx\en\Microsoft.Windows.Appx.PackageManager.Commands.Core.Resources.dll Handle ID: 0x498 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:53 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\Dism\Microsoft.Dism.PowerShell.dll Handle ID: 0x498 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:53 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\Provisioning\provpackageapi.dll Handle ID: 0x498 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:53 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\Storage\Storage.types.ps1xml Handle ID: 0x498 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:53 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\Storage\StorageScripts.psm1 Handle ID: 0x498 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:53 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\Storage\StorageSubSystem.cdxml Handle ID: 0x498 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:53 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\Wdac\MSFT_OdbcDriverTask_v1.0.cdxml Handle ID: 0x498 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:53 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\Wdac\MSFT_OdbcDsnTask_v1.0.cdxml Handle ID: 0x498 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:53 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\Wdac\MSFT_OdbcPerfCounterTask_v1.0.cdxml Handle ID: 0x498 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:53 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\Wdac\MSFT_WdacBidTraceTask_v1.0.cdxml Handle ID: 0x498 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:53 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\Wdac\Wdac.format.ps1xml Handle ID: 0x498 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:53 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\Wdac\Wdac.types.ps1xml Handle ID: 0x498 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:53 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\WinMetadata\Windows.AI.winmd Handle ID: 0x498 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:53 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\WinMetadata\Windows.ApplicationModel.winmd Handle ID: 0x498 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:53 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\WinMetadata\Windows.Data.winmd Handle ID: 0x498 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:53 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\WinMetadata\Windows.Devices.winmd Handle ID: 0x498 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:53 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\WinMetadata\Windows.Foundation.winmd Handle ID: 0x498 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:53 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\WinMetadata\Windows.Gaming.winmd Handle ID: 0x498 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:53 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\WinMetadata\Windows.Globalization.winmd Handle ID: 0x498 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:53 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\WinMetadata\Windows.Graphics.winmd Handle ID: 0x498 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:53 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\WinMetadata\Windows.Management.Setup.winmd Handle ID: 0x498 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:53 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\WinMetadata\Windows.Management.winmd Handle ID: 0x498 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:53 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\WinMetadata\Windows.Media.winmd Handle ID: 0x498 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:53 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\WinMetadata\Windows.Networking.winmd Handle ID: 0x498 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:53 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\WinMetadata\Windows.Perception.winmd Handle ID: 0x498 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:53 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\WinMetadata\Windows.Security.winmd Handle ID: 0x498 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:53 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\WinMetadata\Windows.Services.winmd Handle ID: 0x498 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:53 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\WinMetadata\Windows.Storage.winmd Handle ID: 0x498 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:53 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\WinMetadata\Windows.System.winmd Handle ID: 0xe9c Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:53 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\WinMetadata\Windows.UI.winmd Handle ID: 0x498 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:53 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\WinMetadata\Windows.UI.Xaml.winmd Handle ID: 0x498 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:53 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\SysWOW64\WinMetadata\Windows.Web.winmd Handle ID: 0x498 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:53 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\UUS\uusp.json Handle ID: 0x498 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:53 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\UUS\amd64\MoNotificationUx.exe Handle ID: 0x498 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:53 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\UUS\amd64\MoUsoCoreWorker.exe Handle ID: 0x498 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:53 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\UUS\amd64\musdialoghandlers.dll Handle ID: 0x498 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:53 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\UUS\amd64\storewuauthcore.dll Handle ID: 0x498 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:53 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\UUS\amd64\UpdateDeploy.dll Handle ID: 0x498 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:53 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\UUS\amd64\updatepolicycore.dll Handle ID: 0x498 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:53 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\UUS\amd64\UsoClientImpl.dll Handle ID: 0x498 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:53 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\UUS\amd64\usosvcimpl.dll Handle ID: 0x498 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:53 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\UUS\amd64\WaaSMedicAgent.exe Handle ID: 0x498 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:53 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\UUS\amd64\WaaSMedicCapsule.dll Handle ID: 0x498 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:53 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\UUS\amd64\WaaSMedicSvcImpl.dll Handle ID: 0x498 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:53 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\UUS\amd64\wuapicore.dll Handle ID: 0x498 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:53 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\UUS\amd64\wuaucltcore.exe Handle ID: 0x498 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:53 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\UUS\amd64\wuauengcore.dll Handle ID: 0x498 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:53 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\UUS\amd64\wups2core.dll Handle ID: 0x498 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:53 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\UUS\amd64\wuuhosdeployment.dll Handle ID: 0x498 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:53 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\UUS\amd64\en-US\MoNotificationUx.exe.mui Handle ID: 0x498 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:53 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\UUS\amd64\en-US\UpdatePolicyCore.dll.mui Handle ID: 0x498 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:53 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\UUS\amd64\en-US\wuapicore.dll.mui Handle ID: 0x498 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:53 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\UUS\amd64\en-US\wuauengcore.dll.mui Handle ID: 0x498 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:53 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\UUS\Packages\Preview\uusp.json Handle ID: 0x498 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:53 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\UUS\Packages\Preview\amd64\doclient.dll Handle ID: 0x498 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:53 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\UUS\Packages\Preview\amd64\domiprov.dll Handle ID: 0x498 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:53 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\UUS\Packages\Preview\amd64\MoNotificationUx.exe Handle ID: 0x498 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:53 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\UUS\Packages\Preview\amd64\MoUsoCoreWorker.exe Handle ID: 0x498 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:53 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\UUS\Packages\Preview\amd64\updatedeploy.dll Handle ID: 0x498 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:53 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\UUS\Packages\Preview\amd64\updatepolicycore.dll Handle ID: 0x498 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:53 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\UUS\Packages\Preview\amd64\UsoClientImpl.dll Handle ID: 0x498 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:53 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\UUS\Packages\Preview\amd64\UsoSvcImpl.dll Handle ID: 0x498 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:53 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\UUS\Packages\Preview\amd64\wuapicore.dll Handle ID: 0x498 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:53 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\UUS\Packages\Preview\amd64\wuaucltcore.exe Handle ID: 0x498 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:53 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\UUS\Packages\Preview\amd64\wuauengcore.dll Handle ID: 0x498 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:53 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\UUS\Packages\Preview\amd64\wuuhosdeployment.dll Handle ID: 0x498 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:53 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\UUS\Packages\Preview\amd64\en-US\MoNotificationUx.exe.mui Handle ID: 0x498 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:53 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\UUS\Packages\Preview\amd64\en-US\updatepolicycore.dll.mui Handle ID: 0x498 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:53 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\UUS\Packages\Preview\amd64\en-US\wuapicore.dll.mui Handle ID: 0x498 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:53 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\UUS\Packages\Preview\amd64\en-US\wuauengcore.dll.mui Handle ID: 0x498 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:53 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\UUS\Packages\Preview\x86\wuapicore.dll Handle ID: 0x498 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:53 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\UUS\Packages\Preview\x86\en-US\wuapicore.dll.mui Handle ID: 0x498 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:53 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\UUS\x86\wuapicore.dll Handle ID: 0x498 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:53 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\UUS\x86\en-US\wuapicore.dll.mui Handle ID: 0x498 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:53 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WaaS\services\14a3f9e824793931d34f7f786a538bbc9ef1f0d6.xml Handle ID: 0x498 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:53 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WaaS\services\315818c03ccc2b10070df2d4ebd09eb6c4c66e58.xml Handle ID: 0x498 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13568 | 2025-11-29 09:44:53 | | Microsoft-Windows-Security-Auditing | 4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WaaS\services\43ee7b2a373632f9a701249fd96d0edec2ff1279.xml Handle ID: 0x498 Process Information: Process ID: 0x3380 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.7010_none_a54d8be7772fd084\TiWorker.exe Auditing Settings: Original Security Descriptor: S:NO_ACCESS_CONTROL New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
|
| | Security | Audit Success | 13312 | 2025-11-29 09:45:44 | | Microsoft-Windows-Security-Auditing | 4688: A new process has been created. Creator Subject: Security ID: S-1-5-18 Account Name: - Account Domain: - Logon ID: 0x3e7 Target Subject: Security ID: S-1-0-0 Account Name: - Account Domain: - Logon ID: 0x0 Process Information: New Process ID: 0x170 New Process Name: R Token Elevation Type: %%1936 Mandatory Label: S-1-16-16384 Creator Process ID: 0x4 Creator Process Name: Process Command Line: Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
|
| | Security | Audit Success | 13312 | 2025-11-29 09:45:44 | | Microsoft-Windows-Security-Auditing | 4696: A primary token was assigned to process. Subject: Security ID: S-1-5-18 Account Name: - Account Domain: - Logon ID: 0x3e7 Process Information: Process ID: 0x4 Process Name: Target Process: Target Process ID: 0x170 Target Process Name: Registry New Token Information: Security ID: S-1-0-0 Account Name: - Account Domain: - Logon ID: 0x3e7
|
| | Security | Audit Success | 13312 | 2025-11-29 09:45:44 | | Microsoft-Windows-Security-Auditing | 4688: A new process has been created. Creator Subject: Security ID: S-1-5-18 Account Name: - Account Domain: - Logon ID: 0x3e7 Target Subject: Security ID: S-1-0-0 Account Name: - Account Domain: - Logon ID: 0x0 Process Information: New Process ID: 0x364 New Process Name: C Token Elevation Type: %%1936 Mandatory Label: S-1-16-16384 Creator Process ID: 0x4 Creator Process Name: Process Command Line: Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
|
| | Security | Audit Success | 13573 | 2025-11-29 09:45:44 | | Microsoft-Windows-Security-Auditing | 4826: Boot Configuration Data loaded. Subject: Security ID: S-1-5-18 Account Name: - Account Domain: - Logon ID: 0x3e7 General Settings: Load Options: - Advanced Options: %%1843 Configuration Access Policy: %%1846 System Event Logging: %%1843 Kernel Debugging: %%1843 VSM Launch Type: %%1848 Signature Settings: Test Signing: %%1843 Flight Signing: %%1843 Disable Integrity Checks: %%1843 HyperVisor Settings: HyperVisor Load Options: - HyperVisor Launch Type: %%1848 HyperVisor Debugging: %%1843
|
| | Security | Audit Success | 13312 | 2025-11-29 09:45:46 | | Microsoft-Windows-Security-Auditing | 4688: A new process has been created. Creator Subject: Security ID: S-1-5-18 Account Name: - Account Domain: - Logon ID: 0x3e7 Target Subject: Security ID: S-1-0-0 Account Name: - Account Domain: - Logon ID: 0x0 Process Information: New Process ID: 0x3b8 New Process Name: C Token Elevation Type: %%1936 Mandatory Label: S-1-16-16384 Creator Process ID: 0x364 Creator Process Name: C Process Command Line: Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
|
| | Security | Audit Success | 13312 | 2025-11-29 09:45:59 | | Microsoft-Windows-Security-Auditing | 4688: A new process has been created. Creator Subject: Security ID: S-1-5-18 Account Name: - Account Domain: - Logon ID: 0x3e7 Target Subject: Security ID: S-1-0-0 Account Name: - Account Domain: - Logon ID: 0x0 Process Information: New Process ID: 0x34c New Process Name: C Token Elevation Type: %%1936 Mandatory Label: S-1-16-16384 Creator Process ID: 0x364 Creator Process Name: C Process Command Line: Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
|
| | Security | Audit Success | 13312 | 2025-11-29 09:46:00 | | Microsoft-Windows-Security-Auditing | 4688: A new process has been created. Creator Subject: Security ID: S-1-5-18 Account Name: - Account Domain: - Logon ID: 0x3e7 Target Subject: Security ID: S-1-0-0 Account Name: - Account Domain: - Logon ID: 0x0 Process Information: New Process ID: 0x42c New Process Name: C Token Elevation Type: %%1936 Mandatory Label: S-1-16-16384 Creator Process ID: 0x34c Creator Process Name: C Process Command Line: Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
|
| | Security | Audit Success | 13312 | 2025-11-29 09:46:02 | | Microsoft-Windows-Security-Auditing | 4688: A new process has been created. Creator Subject: Security ID: S-1-5-18 Account Name: - Account Domain: - Logon ID: 0x3e7 Target Subject: Security ID: S-1-0-0 Account Name: - Account Domain: - Logon ID: 0x0 Process Information: New Process ID: 0x49c New Process Name: C Token Elevation Type: %%1936 Mandatory Label: S-1-16-16384 Creator Process ID: 0x364 Creator Process Name: C Process Command Line: Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
|
| | Security | Audit Success | 13312 | 2025-11-29 09:46:02 | | Microsoft-Windows-Security-Auditing | 4688: A new process has been created. Creator Subject: Security ID: S-1-5-18 Account Name: - Account Domain: - Logon ID: 0x3e7 Target Subject: Security ID: S-1-0-0 Account Name: - Account Domain: - Logon ID: 0x0 Process Information: New Process ID: 0x4a4 New Process Name: C Token Elevation Type: %%1936 Mandatory Label: S-1-16-16384 Creator Process ID: 0x34c Creator Process Name: C Process Command Line: Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
|
| | Security | Audit Success | 13312 | 2025-11-29 09:46:02 | | Microsoft-Windows-Security-Auditing | 4688: A new process has been created. Creator Subject: Security ID: S-1-5-18 Account Name: - Account Domain: - Logon ID: 0x3e7 Target Subject: Security ID: S-1-0-0 Account Name: - Account Domain: - Logon ID: 0x0 Process Information: New Process ID: 0x4ac New Process Name: C Token Elevation Type: %%1936 Mandatory Label: S-1-16-16384 Creator Process ID: 0x49c Creator Process Name: C Process Command Line: Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
|
| | Security | Audit Success | 12288 | 2025-11-29 09:46:03 | | Microsoft-Windows-Security-Auditing | 4608: Windows is starting up. This event is logged when LSASS.EXE starts and the auditing subsystem is initialized.
|
| | Security | Audit Success | 12290 | 2025-11-29 09:46:03 | | Microsoft-Windows-Security-Auditing | 6417: The FIPS mode crypto selftests succeeded. Process ID: 0x514 Process Name: C:\Windows\System32\winlogon.exe
|
| | Security | Audit Success | 12290 | 2025-11-29 09:46:03 | | Microsoft-Windows-Security-Auditing | 6417: The FIPS mode crypto selftests succeeded. Process ID: 0x534 Process Name: C:\Windows\System32\lsass.exe
|
| | Security | Audit Success | 12544 | 2025-11-29 09:46:03 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-0-0 Account Name: - Account Domain: - Logon ID: 0x0 Logon Information: Logon Type: 0 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: - New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4 Process Name: Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: - Authentication Package: - Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-29 09:46:03 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4f8 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-29 09:46:03 | | Microsoft-Windows-Security-Auditing | 4648: A logon was attempted using explicit credentials. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon GUID: {00000000-0000-0000-0000-000000000000} Account Whose Credentials Were Used: Account Name: UMFD-0 Account Domain: Font Driver Host Logon GUID: {00000000-0000-0000-0000-000000000000} Target Server: Target Server Name: localhost Additional Information: localhost Process Information: Process ID: 0x4a4 Process Name: C:\Windows\System32\wininit.exe Network Information: Network Address: - Port: - This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
|
| | Security | Audit Success | 12544 | 2025-11-29 09:46:03 | | Microsoft-Windows-Security-Auditing | 4648: A logon was attempted using explicit credentials. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon GUID: {00000000-0000-0000-0000-000000000000} Account Whose Credentials Were Used: Account Name: UMFD-1 Account Domain: Font Driver Host Logon GUID: {00000000-0000-0000-0000-000000000000} Target Server: Target Server Name: localhost Additional Information: localhost Process Information: Process ID: 0x514 Process Name: C:\Windows\System32\winlogon.exe Network Information: Network Address: - Port: - This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
|
| | Security | Audit Success | 12544 | 2025-11-29 09:46:03 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 2 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1842 Elevated Token: %%1843 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-96-0-0 Account Name: UMFD-0 Account Domain: Font Driver Host Logon ID: 0xfe27 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4a4 Process Name: C:\Windows\System32\wininit.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-29 09:46:03 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 2 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1842 Elevated Token: %%1843 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-96-0-1 Account Name: UMFD-1 Account Domain: Font Driver Host Logon ID: 0xfe19 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x514 Process Name: C:\Windows\System32\winlogon.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-29 09:46:03 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-20 Account Name: NETWORK SERVICE Account Domain: NT AUTHORITY Logon ID: 0x3e4 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4f8 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12548 | 2025-11-29 09:46:03 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-29 09:46:03 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-20 Account Name: NETWORK SERVICE Account Domain: NT AUTHORITY Logon ID: 0x3e4 Privileges: SeAssignPrimaryTokenPrivilege SeAuditPrivilege SeImpersonatePrivilege
|
| | Security | Audit Success | 13312 | 2025-11-29 09:46:03 | | Microsoft-Windows-Security-Auditing | 4688: A new process has been created. Creator Subject: Security ID: S-1-5-18 Account Name: - Account Domain: - Logon ID: 0x3e7 Target Subject: Security ID: S-1-0-0 Account Name: - Account Domain: - Logon ID: 0x0 Process Information: New Process ID: 0x4f8 New Process Name: C Token Elevation Type: %%1936 Mandatory Label: S-1-16-16384 Creator Process ID: 0x4a4 Creator Process Name: C Process Command Line: Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
|
| | Security | Audit Success | 13312 | 2025-11-29 09:46:03 | | Microsoft-Windows-Security-Auditing | 4688: A new process has been created. Creator Subject: Security ID: S-1-5-18 Account Name: - Account Domain: - Logon ID: 0x3e7 Target Subject: Security ID: S-1-0-0 Account Name: - Account Domain: - Logon ID: 0x0 Process Information: New Process ID: 0x514 New Process Name: C Token Elevation Type: %%1936 Mandatory Label: S-1-16-16384 Creator Process ID: 0x49c Creator Process Name: C Process Command Line: Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
|
| | Security | Audit Success | 13312 | 2025-11-29 09:46:03 | | Microsoft-Windows-Security-Auditing | 4688: A new process has been created. Creator Subject: Security ID: S-1-5-18 Account Name: - Account Domain: - Logon ID: 0x3e7 Target Subject: Security ID: S-1-0-0 Account Name: - Account Domain: - Logon ID: 0x0 Process Information: New Process ID: 0x534 New Process Name: C Token Elevation Type: %%1936 Mandatory Label: S-1-16-16384 Creator Process ID: 0x4a4 Creator Process Name: C Process Command Line: Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
|
| | Security | Audit Success | 13568 | 2025-11-29 09:46:03 | | Microsoft-Windows-Security-Auditing | 4902: The Per-user audit policy table was created. Number of Elements: 0 Policy ID: 0xf9f8
|
| | Security | Audit Success | 12544 | 2025-11-29 09:46:04 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4f8 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-29 09:46:04 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4f8 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-29 09:46:04 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-19 Account Name: LOCAL SERVICE Account Domain: NT AUTHORITY Logon ID: 0x3e5 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4f8 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-29 09:46:04 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4f8 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-29 09:46:04 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4f8 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-29 09:46:04 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4f8 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-29 09:46:04 | | Microsoft-Windows-Security-Auditing | 4648: A logon was attempted using explicit credentials. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon GUID: {00000000-0000-0000-0000-000000000000} Account Whose Credentials Were Used: Account Name: DWM-1 Account Domain: Window Manager Logon GUID: {00000000-0000-0000-0000-000000000000} Target Server: Target Server Name: localhost Additional Information: localhost Process Information: Process ID: 0x514 Process Name: C:\Windows\System32\winlogon.exe Network Information: Network Address: - Port: - This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
|
| | Security | Audit Success | 12544 | 2025-11-29 09:46:04 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 2 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1842 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-90-0-1 Account Name: DWM-1 Account Domain: Window Manager Logon ID: 0x194f2 Linked Logon ID: 0x1954a Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x514 Process Name: C:\Windows\System32\winlogon.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-29 09:46:04 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 2 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1842 Elevated Token: %%1843 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-90-0-1 Account Name: DWM-1 Account Domain: Window Manager Logon ID: 0x1954a Linked Logon ID: 0x194f2 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x514 Process Name: C:\Windows\System32\winlogon.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12548 | 2025-11-29 09:46:04 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-29 09:46:04 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-29 09:46:04 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-19 Account Name: LOCAL SERVICE Account Domain: NT AUTHORITY Logon ID: 0x3e5 Privileges: SeAssignPrimaryTokenPrivilege SeAuditPrivilege SeImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-29 09:46:04 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-29 09:46:04 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-29 09:46:04 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-29 09:46:04 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-90-0-1 Account Name: DWM-1 Account Domain: Window Manager Logon ID: 0x194f2 Privileges: SeAssignPrimaryTokenPrivilege SeAuditPrivilege SeImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-29 09:46:04 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-90-0-1 Account Name: DWM-1 Account Domain: Window Manager Logon ID: 0x1954a Privileges: SeAssignPrimaryTokenPrivilege SeAuditPrivilege
|
| | Security | Audit Success | 12292 | 2025-11-29 09:46:05 | | Microsoft-Windows-Security-Auditing | 5033: The Windows Firewall Driver started successfully.
|
| | Security | Audit Success | 12544 | 2025-11-29 09:46:05 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4f8 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-29 09:46:05 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4f8 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-29 09:46:05 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4f8 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-29 09:46:05 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4f8 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-29 09:46:05 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4f8 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-29 09:46:05 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4f8 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-29 09:46:05 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4f8 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-29 09:46:05 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4f8 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-29 09:46:05 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4f8 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-29 09:46:05 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4f8 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-29 09:46:05 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4f8 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-29 09:46:05 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4f8 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-29 09:46:05 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4f8 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-29 09:46:05 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4f8 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-29 09:46:05 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4f8 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-29 09:46:05 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4f8 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-29 09:46:05 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4f8 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-29 09:46:05 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4f8 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-29 09:46:05 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4f8 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-29 09:46:05 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4f8 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12548 | 2025-11-29 09:46:05 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-29 09:46:05 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-29 09:46:05 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-29 09:46:05 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-29 09:46:05 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-29 09:46:05 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-29 09:46:05 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-29 09:46:05 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-29 09:46:05 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-29 09:46:05 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-29 09:46:05 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-29 09:46:05 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-29 09:46:05 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-29 09:46:05 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-29 09:46:05 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-29 09:46:05 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-29 09:46:05 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-29 09:46:05 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-29 09:46:05 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-29 09:46:05 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 13826 | 2025-11-29 09:46:05 | | Microsoft-Windows-Security-Auditing | 4799: A security-enabled local group membership was enumerated. Subject: Security ID: S-1-5-20 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e4 Group: Security ID: S-1-5-32-544 Group Name: Administrators Group Domain: Builtin Process Information: Process ID: 0x6e4 Process Name: C:\Windows\System32\svchost.exe
|
| | Security | Audit Success | 13826 | 2025-11-29 09:46:05 | | Microsoft-Windows-Security-Auditing | 4799: A security-enabled local group membership was enumerated. Subject: Security ID: S-1-5-20 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e4 Group: Security ID: S-1-5-32-551 Group Name: Backup Operators Group Domain: Builtin Process Information: Process ID: 0x6e4 Process Name: C:\Windows\System32\svchost.exe
|
| | Security | Audit Success | 12544 | 2025-11-29 09:46:06 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4f8 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12548 | 2025-11-29 09:46:06 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12288 | 2025-11-29 09:46:46 | | Microsoft-Windows-Security-Auditing | 4616: The system time was changed. Subject: Security ID: S-1-5-19 Account Name: LOCAL SERVICE Account Domain: NT AUTHORITY Logon ID: 0x3e5 Process Information: Process ID: 0x11cc Name: C:\Windows\System32\svchost.exe Previous Time: 2025-11-29T17:46:07.2996914Z New Time: 2025-11-29T17:46:46.7012098Z This event is generated when the system time is changed. It is normal for the Windows Time Service, which runs with System privilege, to change the system time on a regular basis. Other system time changes may be indicative of attempts to tamper with the computer.
|
| | Security | Audit Success | 12288 | 2025-11-29 09:46:46 | | Microsoft-Windows-Security-Auditing | 4616: The system time was changed. Subject: Security ID: S-1-5-19 Account Name: LOCAL SERVICE Account Domain: NT AUTHORITY Logon ID: 0x3e5 Process Information: Process ID: 0x11cc Name: C:\Windows\System32\svchost.exe Previous Time: 2025-11-29T17:46:46.7012098Z New Time: 2025-11-29T17:46:46.7017254Z This event is generated when the system time is changed. It is normal for the Windows Time Service, which runs with System privilege, to change the system time on a regular basis. Other system time changes may be indicative of attempts to tamper with the computer.
|
| | Security | Audit Success | 12288 | 2025-11-29 09:46:46 | | Microsoft-Windows-Security-Auditing | 4616: The system time was changed. Subject: Security ID: S-1-5-19 Account Name: LOCAL SERVICE Account Domain: NT AUTHORITY Logon ID: 0x3e5 Process Information: Process ID: 0x11cc Name: C:\Windows\System32\svchost.exe Previous Time: 2025-11-29T17:46:46.7017254Z New Time: 2025-11-29T17:46:46.7046153Z This event is generated when the system time is changed. It is normal for the Windows Time Service, which runs with System privilege, to change the system time on a regular basis. Other system time changes may be indicative of attempts to tamper with the computer.
|
| | Security | Audit Success | 12544 | 2025-11-29 09:46:46 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4f8 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12548 | 2025-11-29 09:46:46 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12544 | 2025-11-29 09:46:47 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4f8 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-29 09:46:47 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4f8 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-29 09:46:47 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4f8 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12548 | 2025-11-29 09:46:47 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-29 09:46:47 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-29 09:46:47 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12292 | 2025-11-29 09:46:48 | | Microsoft-Windows-Security-Auditing | 5024: The Windows Firewall service started successfully.
|
| | Security | Audit Success | 12544 | 2025-11-29 09:47:00 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4f8 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12548 | 2025-11-29 09:47:00 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12288 | 2025-11-29 09:47:06 | | Microsoft-Windows-Security-Auditing | 4616: The system time was changed. Subject: Security ID: S-1-5-19 Account Name: LOCAL SERVICE Account Domain: NT AUTHORITY Logon ID: 0x3e5 Process Information: Process ID: 0x14b4 Name: C:\Windows\System32\svchost.exe Previous Time: 2025-11-29T17:47:06.0821924Z New Time: 2025-11-29T17:47:06.0856179Z This event is generated when the system time is changed. It is normal for the Windows Time Service, which runs with System privilege, to change the system time on a regular basis. Other system time changes may be indicative of attempts to tamper with the computer.
|
| | Security | Audit Success | 12544 | 2025-11-29 09:47:08 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4f8 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-29 09:47:08 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4f8 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12548 | 2025-11-29 09:47:08 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-29 09:47:08 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12544 | 2025-11-29 09:47:13 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4f8 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12548 | 2025-11-29 09:47:13 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12544 | 2025-11-29 09:47:24 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4f8 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12548 | 2025-11-29 09:47:24 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 13826 | 2025-11-29 09:47:45 | | Microsoft-Windows-Security-Auditing | 4799: A security-enabled local group membership was enumerated. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Group: Security ID: S-1-5-32-544 Group Name: Administrators Group Domain: Builtin Process Information: Process ID: 0xf2c Process Name: C:\Windows\System32\svchost.exe
|
| | Security | Audit Success | 13826 | 2025-11-29 09:47:45 | | Microsoft-Windows-Security-Auditing | 4799: A security-enabled local group membership was enumerated. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Group: Security ID: S-1-5-32-551 Group Name: Backup Operators Group Domain: Builtin Process Information: Process ID: 0xf2c Process Name: C:\Windows\System32\svchost.exe
|
| | Security | Audit Success | 12544 | 2025-11-29 09:47:50 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4f8 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12548 | 2025-11-29 09:47:50 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 103 | 2025-11-29 09:48:21 | | Microsoft-Windows-Eventlog | 1100: The event logging service has shut down.
|
| | Security | Audit Success | 13312 | 2025-11-29 09:48:28 | | Microsoft-Windows-Security-Auditing | 4688: A new process has been created. Creator Subject: Security ID: S-1-5-18 Account Name: - Account Domain: - Logon ID: 0x3e7 Target Subject: Security ID: S-1-0-0 Account Name: - Account Domain: - Logon ID: 0x0 Process Information: New Process ID: 0x170 New Process Name: R Token Elevation Type: %%1936 Mandatory Label: S-1-16-16384 Creator Process ID: 0x4 Creator Process Name: Process Command Line: Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
|
| | Security | Audit Success | 13312 | 2025-11-29 09:48:28 | | Microsoft-Windows-Security-Auditing | 4696: A primary token was assigned to process. Subject: Security ID: S-1-5-18 Account Name: - Account Domain: - Logon ID: 0x3e7 Process Information: Process ID: 0x4 Process Name: Target Process: Target Process ID: 0x170 Target Process Name: Registry New Token Information: Security ID: S-1-0-0 Account Name: - Account Domain: - Logon ID: 0x3e7
|
| | Security | Audit Success | 13312 | 2025-11-29 09:48:28 | | Microsoft-Windows-Security-Auditing | 4688: A new process has been created. Creator Subject: Security ID: S-1-5-18 Account Name: - Account Domain: - Logon ID: 0x3e7 Target Subject: Security ID: S-1-0-0 Account Name: - Account Domain: - Logon ID: 0x0 Process Information: New Process ID: 0x368 New Process Name: C Token Elevation Type: %%1936 Mandatory Label: S-1-16-16384 Creator Process ID: 0x4 Creator Process Name: Process Command Line: Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
|
| | Security | Audit Success | 13573 | 2025-11-29 09:48:28 | | Microsoft-Windows-Security-Auditing | 4826: Boot Configuration Data loaded. Subject: Security ID: S-1-5-18 Account Name: - Account Domain: - Logon ID: 0x3e7 General Settings: Load Options: - Advanced Options: %%1843 Configuration Access Policy: %%1846 System Event Logging: %%1843 Kernel Debugging: %%1843 VSM Launch Type: %%1848 Signature Settings: Test Signing: %%1843 Flight Signing: %%1843 Disable Integrity Checks: %%1843 HyperVisor Settings: HyperVisor Load Options: - HyperVisor Launch Type: %%1848 HyperVisor Debugging: %%1843
|
| | Security | Audit Success | 13312 | 2025-11-29 09:48:29 | | Microsoft-Windows-Security-Auditing | 4688: A new process has been created. Creator Subject: Security ID: S-1-5-18 Account Name: - Account Domain: - Logon ID: 0x3e7 Target Subject: Security ID: S-1-0-0 Account Name: - Account Domain: - Logon ID: 0x0 Process Information: New Process ID: 0x384 New Process Name: C Token Elevation Type: %%1936 Mandatory Label: S-1-16-16384 Creator Process ID: 0x368 Creator Process Name: C Process Command Line: Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
|
| | Security | Audit Success | 13312 | 2025-11-29 09:48:41 | | Microsoft-Windows-Security-Auditing | 4688: A new process has been created. Creator Subject: Security ID: S-1-5-18 Account Name: - Account Domain: - Logon ID: 0x3e7 Target Subject: Security ID: S-1-0-0 Account Name: - Account Domain: - Logon ID: 0x0 Process Information: New Process ID: 0x328 New Process Name: C Token Elevation Type: %%1936 Mandatory Label: S-1-16-16384 Creator Process ID: 0x368 Creator Process Name: C Process Command Line: Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
|
| | Security | Audit Success | 13312 | 2025-11-29 09:48:43 | | Microsoft-Windows-Security-Auditing | 4688: A new process has been created. Creator Subject: Security ID: S-1-5-18 Account Name: - Account Domain: - Logon ID: 0x3e7 Target Subject: Security ID: S-1-0-0 Account Name: - Account Domain: - Logon ID: 0x0 Process Information: New Process ID: 0x3b8 New Process Name: C Token Elevation Type: %%1936 Mandatory Label: S-1-16-16384 Creator Process ID: 0x328 Creator Process Name: C Process Command Line: Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
|
| | Security | Audit Success | 13312 | 2025-11-29 09:48:45 | | Microsoft-Windows-Security-Auditing | 4688: A new process has been created. Creator Subject: Security ID: S-1-5-18 Account Name: - Account Domain: - Logon ID: 0x3e7 Target Subject: Security ID: S-1-0-0 Account Name: - Account Domain: - Logon ID: 0x0 Process Information: New Process ID: 0x490 New Process Name: C Token Elevation Type: %%1936 Mandatory Label: S-1-16-16384 Creator Process ID: 0x368 Creator Process Name: C Process Command Line: Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
|
| | Security | Audit Success | 13312 | 2025-11-29 09:48:45 | | Microsoft-Windows-Security-Auditing | 4688: A new process has been created. Creator Subject: Security ID: S-1-5-18 Account Name: - Account Domain: - Logon ID: 0x3e7 Target Subject: Security ID: S-1-0-0 Account Name: - Account Domain: - Logon ID: 0x0 Process Information: New Process ID: 0x498 New Process Name: C Token Elevation Type: %%1936 Mandatory Label: S-1-16-16384 Creator Process ID: 0x328 Creator Process Name: C Process Command Line: Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
|
| | Security | Audit Success | 13312 | 2025-11-29 09:48:45 | | Microsoft-Windows-Security-Auditing | 4688: A new process has been created. Creator Subject: Security ID: S-1-5-18 Account Name: - Account Domain: - Logon ID: 0x3e7 Target Subject: Security ID: S-1-0-0 Account Name: - Account Domain: - Logon ID: 0x0 Process Information: New Process ID: 0x4a0 New Process Name: C Token Elevation Type: %%1936 Mandatory Label: S-1-16-16384 Creator Process ID: 0x490 Creator Process Name: C Process Command Line: Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
|
| | Security | Audit Success | 12288 | 2025-11-29 09:48:46 | | Microsoft-Windows-Security-Auditing | 4608: Windows is starting up. This event is logged when LSASS.EXE starts and the auditing subsystem is initialized.
|
| | Security | Audit Success | 12290 | 2025-11-29 09:48:46 | | Microsoft-Windows-Security-Auditing | 6417: The FIPS mode crypto selftests succeeded. Process ID: 0x530 Process Name: C:\Windows\System32\lsass.exe
|
| | Security | Audit Success | 12544 | 2025-11-29 09:48:46 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-0-0 Account Name: - Account Domain: - Logon ID: 0x0 Logon Information: Logon Type: 0 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: - New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4 Process Name: Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: - Authentication Package: - Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-29 09:48:46 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4f0 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-29 09:48:46 | | Microsoft-Windows-Security-Auditing | 4648: A logon was attempted using explicit credentials. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon GUID: {00000000-0000-0000-0000-000000000000} Account Whose Credentials Were Used: Account Name: UMFD-1 Account Domain: Font Driver Host Logon GUID: {00000000-0000-0000-0000-000000000000} Target Server: Target Server Name: localhost Additional Information: localhost Process Information: Process ID: 0x510 Process Name: C:\Windows\System32\winlogon.exe Network Information: Network Address: - Port: - This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
|
| | Security | Audit Success | 12544 | 2025-11-29 09:48:46 | | Microsoft-Windows-Security-Auditing | 4648: A logon was attempted using explicit credentials. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon GUID: {00000000-0000-0000-0000-000000000000} Account Whose Credentials Were Used: Account Name: UMFD-0 Account Domain: Font Driver Host Logon GUID: {00000000-0000-0000-0000-000000000000} Target Server: Target Server Name: localhost Additional Information: localhost Process Information: Process ID: 0x498 Process Name: C:\Windows\System32\wininit.exe Network Information: Network Address: - Port: - This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
|
| | Security | Audit Success | 12544 | 2025-11-29 09:48:46 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 2 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1842 Elevated Token: %%1843 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-96-0-1 Account Name: UMFD-1 Account Domain: Font Driver Host Logon ID: 0xf789 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x510 Process Name: C:\Windows\System32\winlogon.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-29 09:48:46 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 2 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1842 Elevated Token: %%1843 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-96-0-0 Account Name: UMFD-0 Account Domain: Font Driver Host Logon ID: 0xf784 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x498 Process Name: C:\Windows\System32\wininit.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-29 09:48:46 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-20 Account Name: NETWORK SERVICE Account Domain: NT AUTHORITY Logon ID: 0x3e4 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4f0 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12548 | 2025-11-29 09:48:46 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-29 09:48:46 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-20 Account Name: NETWORK SERVICE Account Domain: NT AUTHORITY Logon ID: 0x3e4 Privileges: SeAssignPrimaryTokenPrivilege SeAuditPrivilege SeImpersonatePrivilege
|
| | Security | Audit Success | 13312 | 2025-11-29 09:48:46 | | Microsoft-Windows-Security-Auditing | 4688: A new process has been created. Creator Subject: Security ID: S-1-5-18 Account Name: - Account Domain: - Logon ID: 0x3e7 Target Subject: Security ID: S-1-0-0 Account Name: - Account Domain: - Logon ID: 0x0 Process Information: New Process ID: 0x4f0 New Process Name: C Token Elevation Type: %%1936 Mandatory Label: S-1-16-16384 Creator Process ID: 0x498 Creator Process Name: C Process Command Line: Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
|
| | Security | Audit Success | 13312 | 2025-11-29 09:48:46 | | Microsoft-Windows-Security-Auditing | 4688: A new process has been created. Creator Subject: Security ID: S-1-5-18 Account Name: - Account Domain: - Logon ID: 0x3e7 Target Subject: Security ID: S-1-0-0 Account Name: - Account Domain: - Logon ID: 0x0 Process Information: New Process ID: 0x510 New Process Name: C Token Elevation Type: %%1936 Mandatory Label: S-1-16-16384 Creator Process ID: 0x490 Creator Process Name: C Process Command Line: Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
|
| | Security | Audit Success | 13312 | 2025-11-29 09:48:46 | | Microsoft-Windows-Security-Auditing | 4688: A new process has been created. Creator Subject: Security ID: S-1-5-18 Account Name: - Account Domain: - Logon ID: 0x3e7 Target Subject: Security ID: S-1-0-0 Account Name: - Account Domain: - Logon ID: 0x0 Process Information: New Process ID: 0x530 New Process Name: C Token Elevation Type: %%1936 Mandatory Label: S-1-16-16384 Creator Process ID: 0x498 Creator Process Name: C Process Command Line: Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
|
| | Security | Audit Success | 13568 | 2025-11-29 09:48:46 | | Microsoft-Windows-Security-Auditing | 4902: The Per-user audit policy table was created. Number of Elements: 0 Policy ID: 0xf354
|
| | Security | Audit Success | 12544 | 2025-11-29 09:48:47 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4f0 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-29 09:48:47 | | Microsoft-Windows-Security-Auditing | 4648: A logon was attempted using explicit credentials. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon GUID: {00000000-0000-0000-0000-000000000000} Account Whose Credentials Were Used: Account Name: DWM-1 Account Domain: Window Manager Logon GUID: {00000000-0000-0000-0000-000000000000} Target Server: Target Server Name: localhost Additional Information: localhost Process Information: Process ID: 0x510 Process Name: C:\Windows\System32\winlogon.exe Network Information: Network Address: - Port: - This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
|
| | Security | Audit Success | 12544 | 2025-11-29 09:48:47 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 2 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1842 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-90-0-1 Account Name: DWM-1 Account Domain: Window Manager Logon ID: 0x15c9b Linked Logon ID: 0x15ce5 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x510 Process Name: C:\Windows\System32\winlogon.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-29 09:48:47 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 2 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1842 Elevated Token: %%1843 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-90-0-1 Account Name: DWM-1 Account Domain: Window Manager Logon ID: 0x15ce5 Linked Logon ID: 0x15c9b Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x510 Process Name: C:\Windows\System32\winlogon.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-29 09:48:47 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4f0 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-29 09:48:47 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-19 Account Name: LOCAL SERVICE Account Domain: NT AUTHORITY Logon ID: 0x3e5 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4f0 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-29 09:48:47 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4f0 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-29 09:48:47 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4f0 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-29 09:48:47 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4f0 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-29 09:48:47 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4f0 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-29 09:48:47 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4f0 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-29 09:48:47 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4f0 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-29 09:48:47 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4f0 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-29 09:48:47 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4f0 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-29 09:48:47 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4f0 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-29 09:48:47 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4f0 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-29 09:48:47 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4f0 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-29 09:48:47 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4f0 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12548 | 2025-11-29 09:48:47 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-29 09:48:47 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-90-0-1 Account Name: DWM-1 Account Domain: Window Manager Logon ID: 0x15c9b Privileges: SeAssignPrimaryTokenPrivilege SeAuditPrivilege SeImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-29 09:48:47 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-90-0-1 Account Name: DWM-1 Account Domain: Window Manager Logon ID: 0x15ce5 Privileges: SeAssignPrimaryTokenPrivilege SeAuditPrivilege
|
| | Security | Audit Success | 12548 | 2025-11-29 09:48:47 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-29 09:48:47 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-19 Account Name: LOCAL SERVICE Account Domain: NT AUTHORITY Logon ID: 0x3e5 Privileges: SeAssignPrimaryTokenPrivilege SeAuditPrivilege SeImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-29 09:48:47 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-29 09:48:47 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-29 09:48:47 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-29 09:48:47 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-29 09:48:47 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-29 09:48:47 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-29 09:48:47 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-29 09:48:47 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-29 09:48:47 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-29 09:48:47 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-29 09:48:47 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-29 09:48:47 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12292 | 2025-11-29 09:48:48 | | Microsoft-Windows-Security-Auditing | 5033: The Windows Firewall Driver started successfully.
|
| | Security | Audit Success | 12544 | 2025-11-29 09:48:48 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4f0 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-29 09:48:48 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4f0 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-29 09:48:48 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4f0 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-29 09:48:48 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4f0 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-29 09:48:48 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4f0 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-29 09:48:48 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4f0 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-29 09:48:48 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4f0 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-29 09:48:48 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4f0 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-29 09:48:48 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4f0 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-29 09:48:48 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4f0 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-29 09:48:48 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4f0 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-29 09:48:48 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4f0 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12548 | 2025-11-29 09:48:48 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-29 09:48:48 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-29 09:48:48 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-29 09:48:48 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-29 09:48:48 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-29 09:48:48 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-29 09:48:48 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-29 09:48:48 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-29 09:48:48 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-29 09:48:48 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-29 09:48:48 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-29 09:48:48 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 13826 | 2025-11-29 09:48:48 | | Microsoft-Windows-Security-Auditing | 4799: A security-enabled local group membership was enumerated. Subject: Security ID: S-1-5-20 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e4 Group: Security ID: S-1-5-32-544 Group Name: Administrators Group Domain: Builtin Process Information: Process ID: 0x724 Process Name: C:\Windows\System32\svchost.exe
|
| | Security | Audit Success | 13826 | 2025-11-29 09:48:48 | | Microsoft-Windows-Security-Auditing | 4799: A security-enabled local group membership was enumerated. Subject: Security ID: S-1-5-20 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e4 Group: Security ID: S-1-5-32-551 Group Name: Backup Operators Group Domain: Builtin Process Information: Process ID: 0x724 Process Name: C:\Windows\System32\svchost.exe
|
| | Security | Audit Success | 12288 | 2025-11-29 09:49:28 | | Microsoft-Windows-Security-Auditing | 4616: The system time was changed. Subject: Security ID: S-1-5-19 Account Name: LOCAL SERVICE Account Domain: NT AUTHORITY Logon ID: 0x3e5 Process Information: Process ID: 0x120c Name: C:\Windows\System32\svchost.exe Previous Time: 2025-11-29T17:48:49.0857429Z New Time: 2025-11-29T17:49:28.0942218Z This event is generated when the system time is changed. It is normal for the Windows Time Service, which runs with System privilege, to change the system time on a regular basis. Other system time changes may be indicative of attempts to tamper with the computer.
|
| | Security | Audit Success | 12288 | 2025-11-29 09:49:28 | | Microsoft-Windows-Security-Auditing | 4616: The system time was changed. Subject: Security ID: S-1-5-19 Account Name: LOCAL SERVICE Account Domain: NT AUTHORITY Logon ID: 0x3e5 Process Information: Process ID: 0x120c Name: C:\Windows\System32\svchost.exe Previous Time: 2025-11-29T17:49:28.0942218Z New Time: 2025-11-29T17:49:28.0949059Z This event is generated when the system time is changed. It is normal for the Windows Time Service, which runs with System privilege, to change the system time on a regular basis. Other system time changes may be indicative of attempts to tamper with the computer.
|
| | Security | Audit Success | 12288 | 2025-11-29 09:49:29 | | Microsoft-Windows-Security-Auditing | 4616: The system time was changed. Subject: Security ID: S-1-5-19 Account Name: LOCAL SERVICE Account Domain: NT AUTHORITY Logon ID: 0x3e5 Process Information: Process ID: 0x120c Name: C:\Windows\System32\svchost.exe Previous Time: 2025-11-29T17:49:29.6026956Z New Time: 2025-11-29T17:49:29.6076271Z This event is generated when the system time is changed. It is normal for the Windows Time Service, which runs with System privilege, to change the system time on a regular basis. Other system time changes may be indicative of attempts to tamper with the computer.
|
| | Security | Audit Success | 12292 | 2025-11-29 09:49:30 | | Microsoft-Windows-Security-Auditing | 5024: The Windows Firewall service started successfully.
|
| | Security | Audit Success | 12544 | 2025-11-29 09:49:30 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4f0 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-29 09:49:30 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4f0 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12548 | 2025-11-29 09:49:30 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-29 09:49:30 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12544 | 2025-11-29 09:49:36 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4f0 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12548 | 2025-11-29 09:49:36 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 13824 | 2025-11-29 09:49:37 | | Microsoft-Windows-Security-Auditing | 4798: A user's local group membership was enumerated. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 User: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Process Information: Process ID: 0x6c8 Process Name: C:\Windows\System32\LogonUI.exe
|
| | Security | Audit Success | 12544 | 2025-11-29 09:49:42 | | Microsoft-Windows-Security-Auditing | 4648: A logon was attempted using explicit credentials. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon GUID: {00000000-0000-0000-0000-000000000000} Account Whose Credentials Were Used: Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon GUID: {00000000-0000-0000-0000-000000000000} Target Server: Target Server Name: localhost Additional Information: localhost Process Information: Process ID: 0xc04 Process Name: C:\Windows\System32\svchost.exe Network Information: Network Address: 127.0.0.1 Port: 0 This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
|
| | Security | Audit Success | 12544 | 2025-11-29 09:49:42 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 2 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x5ee9d Linked Logon ID: 0x5eed6 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0xc04 Process Name: C:\Windows\System32\svchost.exe Network Information: Workstation Name: DESKTOP-0JV7HJV Source Network Address: 127.0.0.1 Source Port: 0 Detailed Authentication Information: Logon Process: User32 Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-29 09:49:42 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 2 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1843 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x5eed6 Linked Logon ID: 0x5ee9d Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0xc04 Process Name: C:\Windows\System32\svchost.exe Network Information: Workstation Name: DESKTOP-0JV7HJV Source Network Address: 127.0.0.1 Source Port: 0 Detailed Authentication Information: Logon Process: User32 Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-29 09:49:42 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4f0 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-29 09:49:42 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4f0 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12548 | 2025-11-29 09:49:42 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x5ee9d Privileges: SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-29 09:49:42 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-29 09:49:42 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 13824 | 2025-11-29 09:49:42 | | Microsoft-Windows-Security-Auditing | 4798: A user's local group membership was enumerated. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 User: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Process Information: Process ID: 0x530 Process Name: C:\Windows\System32\lsass.exe
|
| | Security | Audit Success | 13826 | 2025-11-29 09:49:42 | | Microsoft-Windows-Security-Auditing | 4799: A security-enabled local group membership was enumerated. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Group: Security ID: S-1-5-32-544 Group Name: Administrators Group Domain: Builtin Process Information: Process ID: 0xa78 Process Name: C:\Windows\System32\svchost.exe
|
| | Security | Audit Success | 12290 | 2025-11-29 09:49:43 | | Microsoft-Windows-Security-Auditing | 5061: Cryptographic operation. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x5eed6 Cryptographic Parameters: Provider Name: Microsoft Software Key Storage Provider Algorithm Name: ECDSA_P256 Key Name: Microsoft Connected Devices Platform device certificate Key Type: %%2500 Cryptographic Operation: Operation: %%2480 Return Code: 0x0
|
| | Security | Audit Success | 12290 | 2025-11-29 09:49:43 | | Microsoft-Windows-Security-Auditing | 5061: Cryptographic operation. Subject: Security ID: S-1-5-19 Account Name: LOCAL SERVICE Account Domain: NT AUTHORITY Logon ID: 0x3e5 Cryptographic Parameters: Provider Name: Microsoft Software Key Storage Provider Algorithm Name: ECDSA_P256 Key Name: Microsoft Connected Devices Platform device certificate Key Type: %%2500 Cryptographic Operation: Operation: %%2480 Return Code: 0x0
|
| | Security | Audit Success | 12292 | 2025-11-29 09:49:43 | | Microsoft-Windows-Security-Auditing | 5058: Key file operation. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x5eed6 Process Information: Process ID: 5816 Process Creation Time: 2025-11-29T17:49:42.8241490Z Cryptographic Parameters: Provider Name: Microsoft Software Key Storage Provider Algorithm Name: UNKNOWN Key Name: Microsoft Connected Devices Platform device certificate Key Type: %%2500 Key File Operation Information: File Path: C:\Users\CogiArt\AppData\Roaming\Microsoft\Crypto\Keys\de7cf8a7901d2ad13e5c67c29e5d1662_9ee7012e-fa60-42be-b8b4-8dc8b4e1280d Operation: %%2458 Return Code: 0x0
|
| | Security | Audit Success | 12292 | 2025-11-29 09:49:43 | | Microsoft-Windows-Security-Auditing | 5059: Key migration operation. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x5eed6 Process Information: Process ID: 5816 Process Creation Time: 2025-11-29T17:49:42.8241490Z Cryptographic Parameters: Provider Name: Microsoft Software Key Storage Provider Algorithm Name: ECDSA_P256 Key Name: Microsoft Connected Devices Platform device certificate Key Type: %%2500 Additional Information: Operation: %%2464 Return Code: 0x0
|
| | Security | Audit Success | 12292 | 2025-11-29 09:49:43 | | Microsoft-Windows-Security-Auditing | 5058: Key file operation. Subject: Security ID: S-1-5-19 Account Name: LOCAL SERVICE Account Domain: NT AUTHORITY Logon ID: 0x3e5 Process Information: Process ID: 6460 Process Creation Time: 2025-11-29T17:49:43.4553661Z Cryptographic Parameters: Provider Name: Microsoft Software Key Storage Provider Algorithm Name: UNKNOWN Key Name: Microsoft Connected Devices Platform device certificate Key Type: %%2500 Key File Operation Information: File Path: C:\WINDOWS\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Crypto\Keys\de7cf8a7901d2ad13e5c67c29e5d1662_9ee7012e-fa60-42be-b8b4-8dc8b4e1280d Operation: %%2458 Return Code: 0x0
|
| | Security | Audit Success | 12292 | 2025-11-29 09:49:43 | | Microsoft-Windows-Security-Auditing | 5059: Key migration operation. Subject: Security ID: S-1-5-19 Account Name: LOCAL SERVICE Account Domain: NT AUTHORITY Logon ID: 0x3e5 Process Information: Process ID: 6460 Process Creation Time: 2025-11-29T17:49:43.4553661Z Cryptographic Parameters: Provider Name: Microsoft Software Key Storage Provider Algorithm Name: ECDSA_P256 Key Name: Microsoft Connected Devices Platform device certificate Key Type: %%2500 Additional Information: Operation: %%2464 Return Code: 0x0
|
| | Security | Audit Success | 12544 | 2025-11-29 09:49:44 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4f0 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-29 09:49:44 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4f0 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-29 09:49:44 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4f0 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-29 09:49:44 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4f0 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12548 | 2025-11-29 09:49:44 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-29 09:49:44 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-29 09:49:44 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-29 09:49:44 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 13824 | 2025-11-29 09:49:44 | | Microsoft-Windows-Security-Auditing | 4798: A user's local group membership was enumerated. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x5ee9d User: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Process Information: Process ID: 0x186c Process Name: C:\Program Files\AMD\CIM\Bin64\InstallManagerApp.exe
|
| | Security | Audit Success | 12288 | 2025-11-29 09:49:48 | | Microsoft-Windows-Security-Auditing | 4616: The system time was changed. Subject: Security ID: S-1-5-19 Account Name: LOCAL SERVICE Account Domain: NT AUTHORITY Logon ID: 0x3e5 Process Information: Process ID: 0x1f40 Name: C:\Windows\System32\svchost.exe Previous Time: 2025-11-29T17:49:48.9243351Z New Time: 2025-11-29T17:49:48.9278835Z This event is generated when the system time is changed. It is normal for the Windows Time Service, which runs with System privilege, to change the system time on a regular basis. Other system time changes may be indicative of attempts to tamper with the computer.
|
| | Security | Audit Success | 12544 | 2025-11-29 09:49:52 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4f0 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12548 | 2025-11-29 09:49:52 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 13826 | 2025-11-29 09:49:52 | | Microsoft-Windows-Security-Auditing | 4799: A security-enabled local group membership was enumerated. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Group: Security ID: S-1-5-32-544 Group Name: Administrators Group Domain: Builtin Process Information: Process ID: 0xf74 Process Name: C:\Windows\System32\svchost.exe
|
| | Security | Audit Success | 13826 | 2025-11-29 09:49:52 | | Microsoft-Windows-Security-Auditing | 4799: A security-enabled local group membership was enumerated. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Group: Security ID: S-1-5-32-551 Group Name: Backup Operators Group Domain: Builtin Process Information: Process ID: 0xf74 Process Name: C:\Windows\System32\svchost.exe
|
| | Security | Audit Success | 12544 | 2025-11-29 09:49:55 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4f0 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12548 | 2025-11-29 09:49:55 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 13826 | 2025-11-29 09:49:56 | | Microsoft-Windows-Security-Auditing | 4799: A security-enabled local group membership was enumerated. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Group: Security ID: S-1-5-32-544 Group Name: Administrators Group Domain: Builtin Process Information: Process ID: 0x1d40 Process Name: C:\Windows\System32\SearchIndexer.exe
|
| | Security | Audit Success | 13826 | 2025-11-29 09:49:56 | | Microsoft-Windows-Security-Auditing | 4799: A security-enabled local group membership was enumerated. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Group: Security ID: S-1-5-32-551 Group Name: Backup Operators Group Domain: Builtin Process Information: Process ID: 0x1d40 Process Name: C:\Windows\System32\SearchIndexer.exe
|
| | Security | Audit Success | 12544 | 2025-11-29 09:49:58 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4f0 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12548 | 2025-11-29 09:49:58 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 13824 | 2025-11-29 09:49:58 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 09:49:58 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 09:49:58 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 09:49:58 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x5eed6 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 09:49:58 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x5eed6 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 09:49:58 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x5eed6 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 09:49:58 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x5eed6 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 09:49:58 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x5eed6 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 09:49:58 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x5eed6 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 09:49:59 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x5eed6 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 12544 | 2025-11-29 09:50:00 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4f0 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12548 | 2025-11-29 09:50:00 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 13826 | 2025-11-29 09:50:00 | | Microsoft-Windows-Security-Auditing | 4799: A security-enabled local group membership was enumerated. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x5eed6 Group: Security ID: S-1-5-32-544 Group Name: Administrators Group Domain: Builtin Process Information: Process ID: 0x1798 Process Name: C:\Windows\System32\svchost.exe
|
| | Security | Audit Success | 13824 | 2025-11-29 09:50:15 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x5eed6 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 09:50:15 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x5eed6 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 09:50:15 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x5eed6 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 09:50:15 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x5eed6 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 12544 | 2025-11-29 09:50:18 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4f0 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12548 | 2025-11-29 09:50:18 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12544 | 2025-11-29 09:50:50 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4f0 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-29 09:50:50 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4f0 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12548 | 2025-11-29 09:50:50 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-29 09:50:50 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 13824 | 2025-11-29 09:50:50 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x5eed6 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 09:50:50 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x5eed6 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 09:50:50 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x5eed6 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 09:50:50 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x5eed6 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 12544 | 2025-11-29 09:50:51 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4f0 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12548 | 2025-11-29 09:50:51 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12544 | 2025-11-29 09:51:11 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4f0 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12548 | 2025-11-29 09:51:11 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12544 | 2025-11-29 09:51:19 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4f0 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12548 | 2025-11-29 09:51:19 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12544 | 2025-11-29 09:51:31 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4f0 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-29 09:51:31 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4f0 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-29 09:51:31 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4f0 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12548 | 2025-11-29 09:51:31 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-29 09:51:31 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-29 09:51:31 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 13824 | 2025-11-29 09:51:48 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x5eed6 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 09:51:48 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x5eed6 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 09:51:48 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x5eed6 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 09:51:49 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x5eed6 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 09:51:49 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x5eed6 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 09:51:49 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x5eed6 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 09:51:49 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x5eed6 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 12544 | 2025-11-29 09:54:25 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4f0 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12548 | 2025-11-29 09:54:25 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12544 | 2025-11-29 09:54:38 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4f0 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12548 | 2025-11-29 09:54:38 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12544 | 2025-11-29 09:54:43 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4f0 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-29 09:54:43 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4f0 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12548 | 2025-11-29 09:54:43 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-29 09:54:43 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12544 | 2025-11-29 09:55:34 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4f0 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12548 | 2025-11-29 09:55:34 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 13826 | 2025-11-29 09:55:39 | | Microsoft-Windows-Security-Auditing | 4799: A security-enabled local group membership was enumerated. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Group: Security ID: S-1-5-32-544 Group Name: Administrators Group Domain: Builtin Process Information: Process ID: 0x2744 Process Name: C:\Windows\System32\svchost.exe
|
| | Security | Audit Success | 13826 | 2025-11-29 09:55:39 | | Microsoft-Windows-Security-Auditing | 4799: A security-enabled local group membership was enumerated. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Group: Security ID: S-1-5-32-551 Group Name: Backup Operators Group Domain: Builtin Process Information: Process ID: 0x2744 Process Name: C:\Windows\System32\svchost.exe
|
| | Security | Audit Success | 12544 | 2025-11-29 09:55:45 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4f0 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-29 09:55:45 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4f0 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-29 09:55:45 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4f0 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12548 | 2025-11-29 09:55:45 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-29 09:55:45 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-29 09:55:45 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12544 | 2025-11-29 09:55:46 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4f0 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12548 | 2025-11-29 09:55:46 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12544 | 2025-11-29 09:56:48 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4f0 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12548 | 2025-11-29 09:56:48 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12544 | 2025-11-29 10:00:18 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4f0 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12548 | 2025-11-29 10:00:18 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 13824 | 2025-11-29 10:02:04 | | Microsoft-Windows-Security-Auditing | 4797: An attempt was made to query the existence of a blank password for an account. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x5eed6 Additional Information: Caller Workstation: DESKTOP-0JV7HJV Target Account Name: Administrator Target Account Domain: DESKTOP-0JV7HJV
|
| | Security | Audit Success | 13824 | 2025-11-29 10:02:04 | | Microsoft-Windows-Security-Auditing | 4797: An attempt was made to query the existence of a blank password for an account. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x5eed6 Additional Information: Caller Workstation: DESKTOP-0JV7HJV Target Account Name: DefaultAccount Target Account Domain: DESKTOP-0JV7HJV
|
| | Security | Audit Success | 13824 | 2025-11-29 10:02:04 | | Microsoft-Windows-Security-Auditing | 4797: An attempt was made to query the existence of a blank password for an account. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x5eed6 Additional Information: Caller Workstation: DESKTOP-0JV7HJV Target Account Name: Guest Target Account Domain: DESKTOP-0JV7HJV
|
| | Security | Audit Success | 13824 | 2025-11-29 10:02:04 | | Microsoft-Windows-Security-Auditing | 4797: An attempt was made to query the existence of a blank password for an account. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x5eed6 Additional Information: Caller Workstation: DESKTOP-0JV7HJV Target Account Name: WDAGUtilityAccount Target Account Domain: DESKTOP-0JV7HJV
|
| | Security | Audit Success | 12544 | 2025-11-29 10:03:49 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4f0 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12548 | 2025-11-29 10:03:49 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 13824 | 2025-11-29 10:03:55 | | Microsoft-Windows-Security-Auditing | 4798: A user's local group membership was enumerated. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x5ee9d User: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Process Information: Process ID: 0x1c60 Process Name: C:\Windows\System32\mmc.exe
|
| | Security | Audit Success | 12544 | 2025-11-29 10:04:16 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4f0 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12548 | 2025-11-29 10:04:16 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12544 | 2025-11-29 10:04:17 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4f0 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12548 | 2025-11-29 10:04:17 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12544 | 2025-11-29 10:04:18 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4f0 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-29 10:04:18 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4f0 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12548 | 2025-11-29 10:04:18 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-29 10:04:18 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12544 | 2025-11-29 10:04:43 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4f0 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12548 | 2025-11-29 10:04:43 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12544 | 2025-11-29 10:05:33 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4f0 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12548 | 2025-11-29 10:05:33 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 13824 | 2025-11-29 10:05:33 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 10:05:33 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 10:05:33 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 10:05:33 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x5eed6 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 10:05:33 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x5eed6 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 10:05:33 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x5eed6 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 10:05:33 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x5eed6 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 10:05:33 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x5eed6 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 10:05:33 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x5eed6 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 10:05:33 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x5eed6 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 12544 | 2025-11-29 10:05:55 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4f0 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12548 | 2025-11-29 10:05:55 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12544 | 2025-11-29 10:05:56 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4f0 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-29 10:05:56 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4f0 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12548 | 2025-11-29 10:05:56 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-29 10:05:56 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12544 | 2025-11-29 10:07:08 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4f0 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12548 | 2025-11-29 10:07:08 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 13826 | 2025-11-29 10:07:13 | | Microsoft-Windows-Security-Auditing | 4799: A security-enabled local group membership was enumerated. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Group: Security ID: S-1-5-32-544 Group Name: Administrators Group Domain: Builtin Process Information: Process ID: 0x2a90 Process Name: C:\Windows\System32\svchost.exe
|
| | Security | Audit Success | 13826 | 2025-11-29 10:07:13 | | Microsoft-Windows-Security-Auditing | 4799: A security-enabled local group membership was enumerated. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Group: Security ID: S-1-5-32-551 Group Name: Backup Operators Group Domain: Builtin Process Information: Process ID: 0x2a90 Process Name: C:\Windows\System32\svchost.exe
|
| | Security | Audit Success | 13824 | 2025-11-29 10:07:18 | | Microsoft-Windows-Security-Auditing | 4798: A user's local group membership was enumerated. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x5eed6 User: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Process Information: Process ID: 0x1030 Process Name: C:\Program Files\WindowsApps\Microsoft.Paint_11.2509.441.0_x64__8wekyb3d8bbwe\PaintApp\mspaint.exe
|
| | Security | Audit Success | 13824 | 2025-11-29 10:08:09 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x5eed6 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 10:08:09 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x5eed6 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 10:08:09 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x5eed6 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 10:08:09 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x5eed6 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 10:08:29 | | Microsoft-Windows-Security-Auditing | 4798: A user's local group membership was enumerated. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x5eed6 User: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Process Information: Process ID: 0x2934 Process Name: C:\Program Files\WindowsApps\Microsoft.Paint_11.2509.441.0_x64__8wekyb3d8bbwe\PaintApp\mspaint.exe
|
| | Security | Audit Success | 12544 | 2025-11-29 10:10:30 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4f0 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12548 | 2025-11-29 10:10:30 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 13824 | 2025-11-29 10:12:07 | | Microsoft-Windows-Security-Auditing | 4798: A user's local group membership was enumerated. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x5ee9d User: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Process Information: Process ID: 0x2e68 Process Name: C:\Program Files (x86)\GPU-Z\GPU-Z.exe
|
| | Security | Audit Success | 12544 | 2025-11-29 10:12:21 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4f0 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12548 | 2025-11-29 10:12:21 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 13826 | 2025-11-29 10:12:25 | | Microsoft-Windows-Security-Auditing | 4799: A security-enabled local group membership was enumerated. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Group: Security ID: S-1-5-32-544 Group Name: Administrators Group Domain: Builtin Process Information: Process ID: 0x194c Process Name: C:\Windows\System32\svchost.exe
|
| | Security | Audit Success | 13826 | 2025-11-29 10:12:25 | | Microsoft-Windows-Security-Auditing | 4799: A security-enabled local group membership was enumerated. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Group: Security ID: S-1-5-32-551 Group Name: Backup Operators Group Domain: Builtin Process Information: Process ID: 0x194c Process Name: C:\Windows\System32\svchost.exe
|
| | Security | Audit Success | 12544 | 2025-11-29 10:21:00 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4f0 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12548 | 2025-11-29 10:21:00 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12544 | 2025-11-29 10:31:46 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4f0 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12548 | 2025-11-29 10:31:46 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12544 | 2025-11-29 10:35:13 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4f0 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12548 | 2025-11-29 10:35:13 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12544 | 2025-11-29 10:48:04 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4f0 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12548 | 2025-11-29 10:48:04 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12544 | 2025-11-29 10:48:05 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4f0 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-29 10:48:05 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4f0 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12548 | 2025-11-29 10:48:05 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-29 10:48:05 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 13826 | 2025-11-29 10:48:09 | | Microsoft-Windows-Security-Auditing | 4799: A security-enabled local group membership was enumerated. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Group: Security ID: S-1-5-32-544 Group Name: Administrators Group Domain: Builtin Process Information: Process ID: 0x1ca4 Process Name: C:\Windows\System32\svchost.exe
|
| | Security | Audit Success | 13826 | 2025-11-29 10:48:09 | | Microsoft-Windows-Security-Auditing | 4799: A security-enabled local group membership was enumerated. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Group: Security ID: S-1-5-32-551 Group Name: Backup Operators Group Domain: Builtin Process Information: Process ID: 0x1ca4 Process Name: C:\Windows\System32\svchost.exe
|
| | Security | Audit Success | 12544 | 2025-11-29 10:48:34 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4f0 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12548 | 2025-11-29 10:48:34 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12544 | 2025-11-29 10:49:22 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4f0 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12548 | 2025-11-29 10:49:22 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12544 | 2025-11-29 10:53:12 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4f0 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-29 10:53:12 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4f0 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12548 | 2025-11-29 10:53:12 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-29 10:53:12 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12544 | 2025-11-29 10:53:13 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4f0 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12548 | 2025-11-29 10:53:13 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12544 | 2025-11-29 10:54:07 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4f0 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-29 10:54:07 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4f0 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-29 10:54:07 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4f0 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12548 | 2025-11-29 10:54:07 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-29 10:54:07 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-29 10:54:07 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 13824 | 2025-11-29 10:54:07 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 10:54:07 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 10:54:07 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 10:54:07 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x5eed6 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 10:54:07 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x5eed6 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 10:54:07 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x5eed6 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 10:54:07 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x5eed6 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 10:54:07 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x5eed6 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 10:54:07 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x5eed6 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 10:54:07 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x5eed6 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 12544 | 2025-11-29 10:58:14 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4f0 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12548 | 2025-11-29 10:58:14 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 13824 | 2025-11-29 11:02:36 | | Microsoft-Windows-Security-Auditing | 4798: A user's local group membership was enumerated. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x5ee9d User: Security ID: S-1-5-21-2954332259-1466799094-2054226798-500 Account Name: Administrator Account Domain: DESKTOP-0JV7HJV Process Information: Process ID: 0x2ed8 Process Name: C:\Program Files\FinalWire\AIDA64 Extreme\aida64.exe
|
| | Security | Audit Success | 13824 | 2025-11-29 11:02:36 | | Microsoft-Windows-Security-Auditing | 4798: A user's local group membership was enumerated. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x5ee9d User: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Process Information: Process ID: 0x2ed8 Process Name: C:\Program Files\FinalWire\AIDA64 Extreme\aida64.exe
|
| | Security | Audit Success | 13824 | 2025-11-29 11:02:36 | | Microsoft-Windows-Security-Auditing | 4798: A user's local group membership was enumerated. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x5ee9d User: Security ID: S-1-5-21-2954332259-1466799094-2054226798-503 Account Name: DefaultAccount Account Domain: DESKTOP-0JV7HJV Process Information: Process ID: 0x2ed8 Process Name: C:\Program Files\FinalWire\AIDA64 Extreme\aida64.exe
|
| | Security | Audit Success | 13824 | 2025-11-29 11:02:36 | | Microsoft-Windows-Security-Auditing | 4798: A user's local group membership was enumerated. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x5ee9d User: Security ID: S-1-5-21-2954332259-1466799094-2054226798-501 Account Name: Guest Account Domain: DESKTOP-0JV7HJV Process Information: Process ID: 0x2ed8 Process Name: C:\Program Files\FinalWire\AIDA64 Extreme\aida64.exe
|
| | Security | Audit Success | 13824 | 2025-11-29 11:02:36 | | Microsoft-Windows-Security-Auditing | 4798: A user's local group membership was enumerated. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x5ee9d User: Security ID: S-1-5-21-2954332259-1466799094-2054226798-504 Account Name: WDAGUtilityAccount Account Domain: DESKTOP-0JV7HJV Process Information: Process ID: 0x2ed8 Process Name: C:\Program Files\FinalWire\AIDA64 Extreme\aida64.exe
|
| | Security | Audit Success | 13824 | 2025-11-29 11:02:36 | | Microsoft-Windows-Security-Auditing | 4798: A user's local group membership was enumerated. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x5ee9d User: Security ID: S-1-5-21-2954332259-1466799094-2054226798-500 Account Name: Administrator Account Domain: DESKTOP-0JV7HJV Process Information: Process ID: 0x2ed8 Process Name: C:\Program Files\FinalWire\AIDA64 Extreme\aida64.exe
|
| | Security | Audit Success | 13824 | 2025-11-29 11:02:36 | | Microsoft-Windows-Security-Auditing | 4798: A user's local group membership was enumerated. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x5ee9d User: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Process Information: Process ID: 0x2ed8 Process Name: C:\Program Files\FinalWire\AIDA64 Extreme\aida64.exe
|
| | Security | Audit Success | 13824 | 2025-11-29 11:02:36 | | Microsoft-Windows-Security-Auditing | 4798: A user's local group membership was enumerated. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x5ee9d User: Security ID: S-1-5-21-2954332259-1466799094-2054226798-503 Account Name: DefaultAccount Account Domain: DESKTOP-0JV7HJV Process Information: Process ID: 0x2ed8 Process Name: C:\Program Files\FinalWire\AIDA64 Extreme\aida64.exe
|
| | Security | Audit Success | 13824 | 2025-11-29 11:02:36 | | Microsoft-Windows-Security-Auditing | 4798: A user's local group membership was enumerated. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x5ee9d User: Security ID: S-1-5-21-2954332259-1466799094-2054226798-501 Account Name: Guest Account Domain: DESKTOP-0JV7HJV Process Information: Process ID: 0x2ed8 Process Name: C:\Program Files\FinalWire\AIDA64 Extreme\aida64.exe
|
| | Security | Audit Success | 13824 | 2025-11-29 11:02:36 | | Microsoft-Windows-Security-Auditing | 4798: A user's local group membership was enumerated. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x5ee9d User: Security ID: S-1-5-21-2954332259-1466799094-2054226798-504 Account Name: WDAGUtilityAccount Account Domain: DESKTOP-0JV7HJV Process Information: Process ID: 0x2ed8 Process Name: C:\Program Files\FinalWire\AIDA64 Extreme\aida64.exe
|
| | Security | Audit Success | 13824 | 2025-11-29 11:02:36 | | Microsoft-Windows-Security-Auditing | 4798: A user's local group membership was enumerated. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x5ee9d User: Security ID: S-1-5-21-2954332259-1466799094-2054226798-500 Account Name: Administrator Account Domain: DESKTOP-0JV7HJV Process Information: Process ID: 0x2ed8 Process Name: C:\Program Files\FinalWire\AIDA64 Extreme\aida64.exe
|
| | Security | Audit Success | 13824 | 2025-11-29 11:02:36 | | Microsoft-Windows-Security-Auditing | 4798: A user's local group membership was enumerated. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x5ee9d User: Security ID: S-1-5-21-2954332259-1466799094-2054226798-500 Account Name: Administrator Account Domain: DESKTOP-0JV7HJV Process Information: Process ID: 0x2ed8 Process Name: C:\Program Files\FinalWire\AIDA64 Extreme\aida64.exe
|
| | Security | Audit Success | 13824 | 2025-11-29 11:02:36 | | Microsoft-Windows-Security-Auditing | 4798: A user's local group membership was enumerated. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x5ee9d User: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Process Information: Process ID: 0x2ed8 Process Name: C:\Program Files\FinalWire\AIDA64 Extreme\aida64.exe
|
| | Security | Audit Success | 13824 | 2025-11-29 11:02:36 | | Microsoft-Windows-Security-Auditing | 4798: A user's local group membership was enumerated. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x5ee9d User: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Process Information: Process ID: 0x2ed8 Process Name: C:\Program Files\FinalWire\AIDA64 Extreme\aida64.exe
|
| | Security | Audit Success | 13824 | 2025-11-29 11:02:36 | | Microsoft-Windows-Security-Auditing | 4798: A user's local group membership was enumerated. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x5ee9d User: Security ID: S-1-5-21-2954332259-1466799094-2054226798-503 Account Name: DefaultAccount Account Domain: DESKTOP-0JV7HJV Process Information: Process ID: 0x2ed8 Process Name: C:\Program Files\FinalWire\AIDA64 Extreme\aida64.exe
|
| | Security | Audit Success | 13824 | 2025-11-29 11:02:36 | | Microsoft-Windows-Security-Auditing | 4798: A user's local group membership was enumerated. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x5ee9d User: Security ID: S-1-5-21-2954332259-1466799094-2054226798-503 Account Name: DefaultAccount Account Domain: DESKTOP-0JV7HJV Process Information: Process ID: 0x2ed8 Process Name: C:\Program Files\FinalWire\AIDA64 Extreme\aida64.exe
|
| | Security | Audit Success | 13824 | 2025-11-29 11:02:36 | | Microsoft-Windows-Security-Auditing | 4798: A user's local group membership was enumerated. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x5ee9d User: Security ID: S-1-5-21-2954332259-1466799094-2054226798-501 Account Name: Guest Account Domain: DESKTOP-0JV7HJV Process Information: Process ID: 0x2ed8 Process Name: C:\Program Files\FinalWire\AIDA64 Extreme\aida64.exe
|
| | Security | Audit Success | 13824 | 2025-11-29 11:02:36 | | Microsoft-Windows-Security-Auditing | 4798: A user's local group membership was enumerated. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x5ee9d User: Security ID: S-1-5-21-2954332259-1466799094-2054226798-501 Account Name: Guest Account Domain: DESKTOP-0JV7HJV Process Information: Process ID: 0x2ed8 Process Name: C:\Program Files\FinalWire\AIDA64 Extreme\aida64.exe
|
| | Security | Audit Success | 13824 | 2025-11-29 11:02:36 | | Microsoft-Windows-Security-Auditing | 4798: A user's local group membership was enumerated. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x5ee9d User: Security ID: S-1-5-21-2954332259-1466799094-2054226798-504 Account Name: WDAGUtilityAccount Account Domain: DESKTOP-0JV7HJV Process Information: Process ID: 0x2ed8 Process Name: C:\Program Files\FinalWire\AIDA64 Extreme\aida64.exe
|
| | Security | Audit Success | 13824 | 2025-11-29 11:02:36 | | Microsoft-Windows-Security-Auditing | 4798: A user's local group membership was enumerated. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x5ee9d User: Security ID: S-1-5-21-2954332259-1466799094-2054226798-504 Account Name: WDAGUtilityAccount Account Domain: DESKTOP-0JV7HJV Process Information: Process ID: 0x2ed8 Process Name: C:\Program Files\FinalWire\AIDA64 Extreme\aida64.exe
|
| | Security | Audit Success | 13824 | 2025-11-29 11:02:36 | | Microsoft-Windows-Security-Auditing | 4798: A user's local group membership was enumerated. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x5ee9d User: Security ID: S-1-5-21-2954332259-1466799094-2054226798-500 Account Name: Administrator Account Domain: DESKTOP-0JV7HJV Process Information: Process ID: 0x2ed8 Process Name: C:\Program Files\FinalWire\AIDA64 Extreme\aida64.exe
|
| | Security | Audit Success | 13824 | 2025-11-29 11:02:36 | | Microsoft-Windows-Security-Auditing | 4798: A user's local group membership was enumerated. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x5ee9d User: Security ID: S-1-5-21-2954332259-1466799094-2054226798-500 Account Name: Administrator Account Domain: DESKTOP-0JV7HJV Process Information: Process ID: 0x2ed8 Process Name: C:\Program Files\FinalWire\AIDA64 Extreme\aida64.exe
|
| | Security | Audit Success | 13824 | 2025-11-29 11:02:36 | | Microsoft-Windows-Security-Auditing | 4798: A user's local group membership was enumerated. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x5ee9d User: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Process Information: Process ID: 0x2ed8 Process Name: C:\Program Files\FinalWire\AIDA64 Extreme\aida64.exe
|
| | Security | Audit Success | 13824 | 2025-11-29 11:02:36 | | Microsoft-Windows-Security-Auditing | 4798: A user's local group membership was enumerated. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x5ee9d User: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Process Information: Process ID: 0x2ed8 Process Name: C:\Program Files\FinalWire\AIDA64 Extreme\aida64.exe
|
| | Security | Audit Success | 13824 | 2025-11-29 11:02:36 | | Microsoft-Windows-Security-Auditing | 4798: A user's local group membership was enumerated. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x5ee9d User: Security ID: S-1-5-21-2954332259-1466799094-2054226798-501 Account Name: Guest Account Domain: DESKTOP-0JV7HJV Process Information: Process ID: 0x2ed8 Process Name: C:\Program Files\FinalWire\AIDA64 Extreme\aida64.exe
|
| | Security | Audit Success | 13824 | 2025-11-29 11:02:36 | | Microsoft-Windows-Security-Auditing | 4798: A user's local group membership was enumerated. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x5ee9d User: Security ID: S-1-5-21-2954332259-1466799094-2054226798-501 Account Name: Guest Account Domain: DESKTOP-0JV7HJV Process Information: Process ID: 0x2ed8 Process Name: C:\Program Files\FinalWire\AIDA64 Extreme\aida64.exe
|
| | Security | Audit Success | 13824 | 2025-11-29 11:02:36 | | Microsoft-Windows-Security-Auditing | 4798: A user's local group membership was enumerated. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x5ee9d User: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Process Information: Process ID: 0x2ed8 Process Name: C:\Program Files\FinalWire\AIDA64 Extreme\aida64.exe
|
| | Security | Audit Success | 13824 | 2025-11-29 11:02:36 | | Microsoft-Windows-Security-Auditing | 4798: A user's local group membership was enumerated. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x5ee9d User: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Process Information: Process ID: 0x2ed8 Process Name: C:\Program Files\FinalWire\AIDA64 Extreme\aida64.exe
|
| | Security | Audit Success | 13824 | 2025-11-29 11:02:36 | | Microsoft-Windows-Security-Auditing | 4798: A user's local group membership was enumerated. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x5ee9d User: Security ID: S-1-5-21-2954332259-1466799094-2054226798-503 Account Name: DefaultAccount Account Domain: DESKTOP-0JV7HJV Process Information: Process ID: 0x2ed8 Process Name: C:\Program Files\FinalWire\AIDA64 Extreme\aida64.exe
|
| | Security | Audit Success | 13824 | 2025-11-29 11:02:36 | | Microsoft-Windows-Security-Auditing | 4798: A user's local group membership was enumerated. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x5ee9d User: Security ID: S-1-5-21-2954332259-1466799094-2054226798-503 Account Name: DefaultAccount Account Domain: DESKTOP-0JV7HJV Process Information: Process ID: 0x2ed8 Process Name: C:\Program Files\FinalWire\AIDA64 Extreme\aida64.exe
|
| | Security | Audit Success | 13824 | 2025-11-29 11:02:36 | | Microsoft-Windows-Security-Auditing | 4798: A user's local group membership was enumerated. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x5ee9d User: Security ID: S-1-5-21-2954332259-1466799094-2054226798-500 Account Name: Administrator Account Domain: DESKTOP-0JV7HJV Process Information: Process ID: 0x2ed8 Process Name: C:\Program Files\FinalWire\AIDA64 Extreme\aida64.exe
|
| | Security | Audit Success | 13824 | 2025-11-29 11:02:36 | | Microsoft-Windows-Security-Auditing | 4798: A user's local group membership was enumerated. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x5ee9d User: Security ID: S-1-5-21-2954332259-1466799094-2054226798-500 Account Name: Administrator Account Domain: DESKTOP-0JV7HJV Process Information: Process ID: 0x2ed8 Process Name: C:\Program Files\FinalWire\AIDA64 Extreme\aida64.exe
|
| | Security | Audit Success | 13824 | 2025-11-29 11:02:36 | | Microsoft-Windows-Security-Auditing | 4798: A user's local group membership was enumerated. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x5ee9d User: Security ID: S-1-5-21-2954332259-1466799094-2054226798-501 Account Name: Guest Account Domain: DESKTOP-0JV7HJV Process Information: Process ID: 0x2ed8 Process Name: C:\Program Files\FinalWire\AIDA64 Extreme\aida64.exe
|
| | Security | Audit Success | 13824 | 2025-11-29 11:02:36 | | Microsoft-Windows-Security-Auditing | 4798: A user's local group membership was enumerated. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x5ee9d User: Security ID: S-1-5-21-2954332259-1466799094-2054226798-501 Account Name: Guest Account Domain: DESKTOP-0JV7HJV Process Information: Process ID: 0x2ed8 Process Name: C:\Program Files\FinalWire\AIDA64 Extreme\aida64.exe
|
| | Security | Audit Success | 13824 | 2025-11-29 11:02:36 | | Microsoft-Windows-Security-Auditing | 4798: A user's local group membership was enumerated. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x5ee9d User: Security ID: S-1-5-21-2954332259-1466799094-2054226798-503 Account Name: DefaultAccount Account Domain: DESKTOP-0JV7HJV Process Information: Process ID: 0x2ed8 Process Name: C:\Program Files\FinalWire\AIDA64 Extreme\aida64.exe
|
| | Security | Audit Success | 13824 | 2025-11-29 11:02:36 | | Microsoft-Windows-Security-Auditing | 4798: A user's local group membership was enumerated. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x5ee9d User: Security ID: S-1-5-21-2954332259-1466799094-2054226798-503 Account Name: DefaultAccount Account Domain: DESKTOP-0JV7HJV Process Information: Process ID: 0x2ed8 Process Name: C:\Program Files\FinalWire\AIDA64 Extreme\aida64.exe
|
| | Security | Audit Success | 13824 | 2025-11-29 11:02:36 | | Microsoft-Windows-Security-Auditing | 4798: A user's local group membership was enumerated. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x5ee9d User: Security ID: S-1-5-21-2954332259-1466799094-2054226798-504 Account Name: WDAGUtilityAccount Account Domain: DESKTOP-0JV7HJV Process Information: Process ID: 0x2ed8 Process Name: C:\Program Files\FinalWire\AIDA64 Extreme\aida64.exe
|
| | Security | Audit Success | 13824 | 2025-11-29 11:02:36 | | Microsoft-Windows-Security-Auditing | 4798: A user's local group membership was enumerated. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x5ee9d User: Security ID: S-1-5-21-2954332259-1466799094-2054226798-504 Account Name: WDAGUtilityAccount Account Domain: DESKTOP-0JV7HJV Process Information: Process ID: 0x2ed8 Process Name: C:\Program Files\FinalWire\AIDA64 Extreme\aida64.exe
|
| | Security | Audit Success | 13824 | 2025-11-29 11:02:36 | | Microsoft-Windows-Security-Auditing | 4798: A user's local group membership was enumerated. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x5ee9d User: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Process Information: Process ID: 0x2ed8 Process Name: C:\Program Files\FinalWire\AIDA64 Extreme\aida64.exe
|
| | Security | Audit Success | 13824 | 2025-11-29 11:02:36 | | Microsoft-Windows-Security-Auditing | 4798: A user's local group membership was enumerated. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x5ee9d User: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Process Information: Process ID: 0x2ed8 Process Name: C:\Program Files\FinalWire\AIDA64 Extreme\aida64.exe
|
| | Security | Audit Success | 13826 | 2025-11-29 11:02:36 | | Microsoft-Windows-Security-Auditing | 4799: A security-enabled local group membership was enumerated. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x5ee9d Group: Security ID: S-1-5-32-579 Group Name: Access Control Assistance Operators Group Domain: Builtin Process Information: Process ID: 0x2ed8 Process Name: C:\Program Files\FinalWire\AIDA64 Extreme\aida64.exe
|
| | Security | Audit Success | 13826 | 2025-11-29 11:02:36 | | Microsoft-Windows-Security-Auditing | 4799: A security-enabled local group membership was enumerated. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x5ee9d Group: Security ID: S-1-5-32-544 Group Name: Administrators Group Domain: Builtin Process Information: Process ID: 0x2ed8 Process Name: C:\Program Files\FinalWire\AIDA64 Extreme\aida64.exe
|
| | Security | Audit Success | 13826 | 2025-11-29 11:02:36 | | Microsoft-Windows-Security-Auditing | 4799: A security-enabled local group membership was enumerated. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x5ee9d Group: Security ID: S-1-5-32-551 Group Name: Backup Operators Group Domain: Builtin Process Information: Process ID: 0x2ed8 Process Name: C:\Program Files\FinalWire\AIDA64 Extreme\aida64.exe
|
| | Security | Audit Success | 13826 | 2025-11-29 11:02:36 | | Microsoft-Windows-Security-Auditing | 4799: A security-enabled local group membership was enumerated. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x5ee9d Group: Security ID: S-1-5-32-569 Group Name: Cryptographic Operators Group Domain: Builtin Process Information: Process ID: 0x2ed8 Process Name: C:\Program Files\FinalWire\AIDA64 Extreme\aida64.exe
|
| | Security | Audit Success | 13826 | 2025-11-29 11:02:36 | | Microsoft-Windows-Security-Auditing | 4799: A security-enabled local group membership was enumerated. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x5ee9d Group: Security ID: S-1-5-32-583 Group Name: Device Owners Group Domain: Builtin Process Information: Process ID: 0x2ed8 Process Name: C:\Program Files\FinalWire\AIDA64 Extreme\aida64.exe
|
| | Security | Audit Success | 13826 | 2025-11-29 11:02:36 | | Microsoft-Windows-Security-Auditing | 4799: A security-enabled local group membership was enumerated. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x5ee9d Group: Security ID: S-1-5-32-562 Group Name: Distributed COM Users Group Domain: Builtin Process Information: Process ID: 0x2ed8 Process Name: C:\Program Files\FinalWire\AIDA64 Extreme\aida64.exe
|
| | Security | Audit Success | 13826 | 2025-11-29 11:02:36 | | Microsoft-Windows-Security-Auditing | 4799: A security-enabled local group membership was enumerated. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x5ee9d Group: Security ID: S-1-5-32-573 Group Name: Event Log Readers Group Domain: Builtin Process Information: Process ID: 0x2ed8 Process Name: C:\Program Files\FinalWire\AIDA64 Extreme\aida64.exe
|
| | Security | Audit Success | 13826 | 2025-11-29 11:02:36 | | Microsoft-Windows-Security-Auditing | 4799: A security-enabled local group membership was enumerated. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x5ee9d Group: Security ID: S-1-5-32-546 Group Name: Guests Group Domain: Builtin Process Information: Process ID: 0x2ed8 Process Name: C:\Program Files\FinalWire\AIDA64 Extreme\aida64.exe
|
| | Security | Audit Success | 13826 | 2025-11-29 11:02:36 | | Microsoft-Windows-Security-Auditing | 4799: A security-enabled local group membership was enumerated. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x5ee9d Group: Security ID: S-1-5-32-578 Group Name: Hyper-V Administrators Group Domain: Builtin Process Information: Process ID: 0x2ed8 Process Name: C:\Program Files\FinalWire\AIDA64 Extreme\aida64.exe
|
| | Security | Audit Success | 13826 | 2025-11-29 11:02:36 | | Microsoft-Windows-Security-Auditing | 4799: A security-enabled local group membership was enumerated. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x5ee9d Group: Security ID: S-1-5-32-568 Group Name: IIS_IUSRS Group Domain: Builtin Process Information: Process ID: 0x2ed8 Process Name: C:\Program Files\FinalWire\AIDA64 Extreme\aida64.exe
|
| | Security | Audit Success | 13826 | 2025-11-29 11:02:36 | | Microsoft-Windows-Security-Auditing | 4799: A security-enabled local group membership was enumerated. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x5ee9d Group: Security ID: S-1-5-32-556 Group Name: Network Configuration Operators Group Domain: Builtin Process Information: Process ID: 0x2ed8 Process Name: C:\Program Files\FinalWire\AIDA64 Extreme\aida64.exe
|
| | Security | Audit Success | 13826 | 2025-11-29 11:02:36 | | Microsoft-Windows-Security-Auditing | 4799: A security-enabled local group membership was enumerated. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x5ee9d Group: Security ID: S-1-5-32-585 Group Name: OpenSSH Users Group Domain: Builtin Process Information: Process ID: 0x2ed8 Process Name: C:\Program Files\FinalWire\AIDA64 Extreme\aida64.exe
|
| | Security | Audit Success | 13826 | 2025-11-29 11:02:36 | | Microsoft-Windows-Security-Auditing | 4799: A security-enabled local group membership was enumerated. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x5ee9d Group: Security ID: S-1-5-32-559 Group Name: Performance Log Users Group Domain: Builtin Process Information: Process ID: 0x2ed8 Process Name: C:\Program Files\FinalWire\AIDA64 Extreme\aida64.exe
|
| | Security | Audit Success | 13826 | 2025-11-29 11:02:36 | | Microsoft-Windows-Security-Auditing | 4799: A security-enabled local group membership was enumerated. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x5ee9d Group: Security ID: S-1-5-32-558 Group Name: Performance Monitor Users Group Domain: Builtin Process Information: Process ID: 0x2ed8 Process Name: C:\Program Files\FinalWire\AIDA64 Extreme\aida64.exe
|
| | Security | Audit Success | 13826 | 2025-11-29 11:02:36 | | Microsoft-Windows-Security-Auditing | 4799: A security-enabled local group membership was enumerated. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x5ee9d Group: Security ID: S-1-5-32-547 Group Name: Power Users Group Domain: Builtin Process Information: Process ID: 0x2ed8 Process Name: C:\Program Files\FinalWire\AIDA64 Extreme\aida64.exe
|
| | Security | Audit Success | 13826 | 2025-11-29 11:02:36 | | Microsoft-Windows-Security-Auditing | 4799: A security-enabled local group membership was enumerated. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x5ee9d Group: Security ID: S-1-5-32-555 Group Name: Remote Desktop Users Group Domain: Builtin Process Information: Process ID: 0x2ed8 Process Name: C:\Program Files\FinalWire\AIDA64 Extreme\aida64.exe
|
| | Security | Audit Success | 13826 | 2025-11-29 11:02:36 | | Microsoft-Windows-Security-Auditing | 4799: A security-enabled local group membership was enumerated. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x5ee9d Group: Security ID: S-1-5-32-580 Group Name: Remote Management Users Group Domain: Builtin Process Information: Process ID: 0x2ed8 Process Name: C:\Program Files\FinalWire\AIDA64 Extreme\aida64.exe
|
| | Security | Audit Success | 13826 | 2025-11-29 11:02:36 | | Microsoft-Windows-Security-Auditing | 4799: A security-enabled local group membership was enumerated. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x5ee9d Group: Security ID: S-1-5-32-552 Group Name: Replicator Group Domain: Builtin Process Information: Process ID: 0x2ed8 Process Name: C:\Program Files\FinalWire\AIDA64 Extreme\aida64.exe
|
| | Security | Audit Success | 13826 | 2025-11-29 11:02:36 | | Microsoft-Windows-Security-Auditing | 4799: A security-enabled local group membership was enumerated. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x5ee9d Group: Security ID: S-1-5-32-581 Group Name: System Managed Accounts Group Group Domain: Builtin Process Information: Process ID: 0x2ed8 Process Name: C:\Program Files\FinalWire\AIDA64 Extreme\aida64.exe
|
| | Security | Audit Success | 13826 | 2025-11-29 11:02:36 | | Microsoft-Windows-Security-Auditing | 4799: A security-enabled local group membership was enumerated. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x5ee9d Group: Security ID: S-1-5-32-584 Group Name: User Mode Hardware Operators Group Domain: Builtin Process Information: Process ID: 0x2ed8 Process Name: C:\Program Files\FinalWire\AIDA64 Extreme\aida64.exe
|
| | Security | Audit Success | 13826 | 2025-11-29 11:02:36 | | Microsoft-Windows-Security-Auditing | 4799: A security-enabled local group membership was enumerated. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x5ee9d Group: Security ID: S-1-5-32-545 Group Name: Users Group Domain: Builtin Process Information: Process ID: 0x2ed8 Process Name: C:\Program Files\FinalWire\AIDA64 Extreme\aida64.exe
|
| | Security | Audit Success | 12544 | 2025-11-29 11:02:53 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4f0 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12548 | 2025-11-29 11:02:53 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12544 | 2025-11-29 11:05:13 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4f0 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12548 | 2025-11-29 11:05:13 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12544 | 2025-11-29 11:07:20 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4f0 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12548 | 2025-11-29 11:07:20 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12544 | 2025-11-29 11:07:21 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4f0 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12548 | 2025-11-29 11:07:21 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12544 | 2025-11-29 11:19:27 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4f0 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12548 | 2025-11-29 11:19:27 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12544 | 2025-11-29 11:19:40 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4f0 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12548 | 2025-11-29 11:19:40 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 13824 | 2025-11-29 11:19:48 | | Microsoft-Windows-Security-Auditing | 5382: Vault credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x5eed6 This event occurs when a user reads a stored vault credential.
|
| | Security | Audit Success | 13824 | 2025-11-29 11:19:48 | | Microsoft-Windows-Security-Auditing | 5382: Vault credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x5eed6 This event occurs when a user reads a stored vault credential.
|
| | Security | Audit Success | 12544 | 2025-11-29 11:20:13 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4f0 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12548 | 2025-11-29 11:20:13 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12544 | 2025-11-29 11:35:13 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4f0 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12548 | 2025-11-29 11:35:13 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12544 | 2025-11-29 11:36:20 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4f0 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12548 | 2025-11-29 11:36:20 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12544 | 2025-11-29 11:37:34 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4f0 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12548 | 2025-11-29 11:37:34 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 13824 | 2025-11-29 11:37:34 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 11:37:34 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 11:37:34 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 11:37:34 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x5eed6 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 11:37:34 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x5eed6 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 11:37:34 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x5eed6 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 11:37:34 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x5eed6 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 11:37:34 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x5eed6 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 11:37:34 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x5eed6 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 11:37:34 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x5eed6 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 12544 | 2025-11-29 11:37:41 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4f0 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12548 | 2025-11-29 11:37:41 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12544 | 2025-11-29 11:37:52 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4f0 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-29 11:37:52 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4f0 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12548 | 2025-11-29 11:37:52 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-29 11:37:52 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 13824 | 2025-11-29 11:37:52 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x5eed6 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 11:37:52 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x5eed6 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 11:37:52 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x5eed6 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 11:37:52 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x5eed6 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13826 | 2025-11-29 11:37:57 | | Microsoft-Windows-Security-Auditing | 4799: A security-enabled local group membership was enumerated. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Group: Security ID: S-1-5-32-544 Group Name: Administrators Group Domain: Builtin Process Information: Process ID: 0x2758 Process Name: C:\Windows\System32\svchost.exe
|
| | Security | Audit Success | 13826 | 2025-11-29 11:37:57 | | Microsoft-Windows-Security-Auditing | 4799: A security-enabled local group membership was enumerated. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Group: Security ID: S-1-5-32-551 Group Name: Backup Operators Group Domain: Builtin Process Information: Process ID: 0x2758 Process Name: C:\Windows\System32\svchost.exe
|
| | Security | Audit Success | 12544 | 2025-11-29 11:38:03 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4f0 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12548 | 2025-11-29 11:38:03 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12544 | 2025-11-29 11:40:52 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4f0 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-29 11:40:52 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4f0 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12548 | 2025-11-29 11:40:52 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-29 11:40:52 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12544 | 2025-11-29 11:40:53 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4f0 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12548 | 2025-11-29 11:40:53 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12544 | 2025-11-29 11:40:55 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4f0 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12548 | 2025-11-29 11:40:55 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12544 | 2025-11-29 11:45:37 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4f0 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12548 | 2025-11-29 11:45:37 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12544 | 2025-11-29 11:46:48 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4f0 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12548 | 2025-11-29 11:46:48 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12544 | 2025-11-29 11:46:49 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4f0 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12548 | 2025-11-29 11:46:49 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12544 | 2025-11-29 11:48:25 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4f0 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12548 | 2025-11-29 11:48:25 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12544 | 2025-11-29 11:49:00 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4f0 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12548 | 2025-11-29 11:49:00 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12544 | 2025-11-29 11:49:07 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4f0 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12548 | 2025-11-29 11:49:07 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12544 | 2025-11-29 11:49:12 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4f0 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12548 | 2025-11-29 11:49:12 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12544 | 2025-11-29 11:49:43 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4f0 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-29 11:49:43 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4f0 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12548 | 2025-11-29 11:49:43 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-29 11:49:43 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12544 | 2025-11-29 11:49:47 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4f0 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-29 11:49:47 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4f0 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12548 | 2025-11-29 11:49:47 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-29 11:49:47 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 13824 | 2025-11-29 11:49:47 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Read Operation: %%8099 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 11:49:47 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x5eed6 Read Operation: %%8099 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 12544 | 2025-11-29 11:49:48 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4f0 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12548 | 2025-11-29 11:49:48 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12544 | 2025-11-29 11:49:50 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4f0 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12548 | 2025-11-29 11:49:50 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12544 | 2025-11-29 11:53:49 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4f0 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12548 | 2025-11-29 11:53:49 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12544 | 2025-11-29 11:54:35 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4f0 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-29 11:54:35 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4f0 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12548 | 2025-11-29 11:54:35 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-29 11:54:35 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 13824 | 2025-11-29 11:54:35 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 11:54:35 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 11:54:35 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 11:54:35 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x5ee9d Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 11:54:35 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x5ee9d Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 11:54:35 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x5ee9d Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 11:54:35 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x5ee9d Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 11:54:35 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x5ee9d Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 11:54:35 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x5ee9d Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 11:54:36 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x5ee9d Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 11:54:36 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x5ee9d Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 11:54:36 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x5ee9d Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 11:54:36 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x5ee9d Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 12544 | 2025-11-29 11:56:46 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4f0 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12548 | 2025-11-29 11:56:46 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12545 | 2025-11-29 11:57:04 | | Microsoft-Windows-Security-Auditing | 4647: User initiated logoff: Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x5eed6 This event is generated when a logoff is initiated. No further user-initiated activity can occur. This event can be interpreted as a logoff event.
|
| | Security | Audit Success | 103 | 2025-11-29 11:57:06 | | Microsoft-Windows-Eventlog | 1100: The event logging service has shut down.
|
| | Security | Audit Success | 12544 | 2025-11-29 11:57:06 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4f0 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12548 | 2025-11-29 11:57:06 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 13312 | 2025-11-29 23:51:52 | | Microsoft-Windows-Security-Auditing | 4688: A new process has been created. Creator Subject: Security ID: S-1-5-18 Account Name: - Account Domain: - Logon ID: 0x3e7 Target Subject: Security ID: S-1-0-0 Account Name: - Account Domain: - Logon ID: 0x0 Process Information: New Process ID: 0x170 New Process Name: R Token Elevation Type: %%1936 Mandatory Label: S-1-16-16384 Creator Process ID: 0x4 Creator Process Name: Process Command Line: Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
|
| | Security | Audit Success | 13312 | 2025-11-29 23:51:52 | | Microsoft-Windows-Security-Auditing | 4696: A primary token was assigned to process. Subject: Security ID: S-1-5-18 Account Name: - Account Domain: - Logon ID: 0x3e7 Process Information: Process ID: 0x4 Process Name: Target Process: Target Process ID: 0x170 Target Process Name: Registry New Token Information: Security ID: S-1-0-0 Account Name: - Account Domain: - Logon ID: 0x3e7
|
| | Security | Audit Success | 13312 | 2025-11-29 23:51:52 | | Microsoft-Windows-Security-Auditing | 4688: A new process has been created. Creator Subject: Security ID: S-1-5-18 Account Name: - Account Domain: - Logon ID: 0x3e7 Target Subject: Security ID: S-1-0-0 Account Name: - Account Domain: - Logon ID: 0x0 Process Information: New Process ID: 0x364 New Process Name: C Token Elevation Type: %%1936 Mandatory Label: S-1-16-16384 Creator Process ID: 0x4 Creator Process Name: Process Command Line: Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
|
| | Security | Audit Success | 13573 | 2025-11-29 23:51:52 | | Microsoft-Windows-Security-Auditing | 4826: Boot Configuration Data loaded. Subject: Security ID: S-1-5-18 Account Name: - Account Domain: - Logon ID: 0x3e7 General Settings: Load Options: - Advanced Options: %%1843 Configuration Access Policy: %%1846 System Event Logging: %%1843 Kernel Debugging: %%1843 VSM Launch Type: %%1848 Signature Settings: Test Signing: %%1843 Flight Signing: %%1843 Disable Integrity Checks: %%1843 HyperVisor Settings: HyperVisor Load Options: - HyperVisor Launch Type: %%1848 HyperVisor Debugging: %%1843
|
| | Security | Audit Success | 13312 | 2025-11-29 23:51:53 | | Microsoft-Windows-Security-Auditing | 4688: A new process has been created. Creator Subject: Security ID: S-1-5-18 Account Name: - Account Domain: - Logon ID: 0x3e7 Target Subject: Security ID: S-1-0-0 Account Name: - Account Domain: - Logon ID: 0x0 Process Information: New Process ID: 0x380 New Process Name: C Token Elevation Type: %%1936 Mandatory Label: S-1-16-16384 Creator Process ID: 0x364 Creator Process Name: C Process Command Line: Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
|
| | Security | Audit Success | 13312 | 2025-11-29 23:52:06 | | Microsoft-Windows-Security-Auditing | 4688: A new process has been created. Creator Subject: Security ID: S-1-5-18 Account Name: - Account Domain: - Logon ID: 0x3e7 Target Subject: Security ID: S-1-0-0 Account Name: - Account Domain: - Logon ID: 0x0 Process Information: New Process ID: 0x3fc New Process Name: C Token Elevation Type: %%1936 Mandatory Label: S-1-16-16384 Creator Process ID: 0x364 Creator Process Name: C Process Command Line: Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
|
| | Security | Audit Success | 13312 | 2025-11-29 23:52:08 | | Microsoft-Windows-Security-Auditing | 4688: A new process has been created. Creator Subject: Security ID: S-1-5-18 Account Name: - Account Domain: - Logon ID: 0x3e7 Target Subject: Security ID: S-1-0-0 Account Name: - Account Domain: - Logon ID: 0x0 Process Information: New Process ID: 0x3b4 New Process Name: C Token Elevation Type: %%1936 Mandatory Label: S-1-16-16384 Creator Process ID: 0x3fc Creator Process Name: C Process Command Line: Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
|
| | Security | Audit Success | 13312 | 2025-11-29 23:52:10 | | Microsoft-Windows-Security-Auditing | 4688: A new process has been created. Creator Subject: Security ID: S-1-5-18 Account Name: - Account Domain: - Logon ID: 0x3e7 Target Subject: Security ID: S-1-0-0 Account Name: - Account Domain: - Logon ID: 0x0 Process Information: New Process ID: 0x498 New Process Name: C Token Elevation Type: %%1936 Mandatory Label: S-1-16-16384 Creator Process ID: 0x364 Creator Process Name: C Process Command Line: Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
|
| | Security | Audit Success | 13312 | 2025-11-29 23:52:10 | | Microsoft-Windows-Security-Auditing | 4688: A new process has been created. Creator Subject: Security ID: S-1-5-18 Account Name: - Account Domain: - Logon ID: 0x3e7 Target Subject: Security ID: S-1-0-0 Account Name: - Account Domain: - Logon ID: 0x0 Process Information: New Process ID: 0x4a0 New Process Name: C Token Elevation Type: %%1936 Mandatory Label: S-1-16-16384 Creator Process ID: 0x3fc Creator Process Name: C Process Command Line: Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
|
| | Security | Audit Success | 13312 | 2025-11-29 23:52:10 | | Microsoft-Windows-Security-Auditing | 4688: A new process has been created. Creator Subject: Security ID: S-1-5-18 Account Name: - Account Domain: - Logon ID: 0x3e7 Target Subject: Security ID: S-1-0-0 Account Name: - Account Domain: - Logon ID: 0x0 Process Information: New Process ID: 0x4a8 New Process Name: C Token Elevation Type: %%1936 Mandatory Label: S-1-16-16384 Creator Process ID: 0x498 Creator Process Name: C Process Command Line: Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
|
| | Security | Audit Success | 13312 | 2025-11-29 23:52:10 | | Microsoft-Windows-Security-Auditing | 4688: A new process has been created. Creator Subject: Security ID: S-1-5-18 Account Name: - Account Domain: - Logon ID: 0x3e7 Target Subject: Security ID: S-1-0-0 Account Name: - Account Domain: - Logon ID: 0x0 Process Information: New Process ID: 0x4f8 New Process Name: C Token Elevation Type: %%1936 Mandatory Label: S-1-16-16384 Creator Process ID: 0x4a0 Creator Process Name: C Process Command Line: Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
|
| | Security | Audit Success | 13312 | 2025-11-29 23:52:10 | | Microsoft-Windows-Security-Auditing | 4688: A new process has been created. Creator Subject: Security ID: S-1-5-18 Account Name: - Account Domain: - Logon ID: 0x3e7 Target Subject: Security ID: S-1-0-0 Account Name: - Account Domain: - Logon ID: 0x0 Process Information: New Process ID: 0x518 New Process Name: C Token Elevation Type: %%1936 Mandatory Label: S-1-16-16384 Creator Process ID: 0x498 Creator Process Name: C Process Command Line: Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
|
| | Security | Audit Success | 13312 | 2025-11-29 23:52:10 | | Microsoft-Windows-Security-Auditing | 4688: A new process has been created. Creator Subject: Security ID: S-1-5-18 Account Name: - Account Domain: - Logon ID: 0x3e7 Target Subject: Security ID: S-1-0-0 Account Name: - Account Domain: - Logon ID: 0x0 Process Information: New Process ID: 0x538 New Process Name: C Token Elevation Type: %%1936 Mandatory Label: S-1-16-16384 Creator Process ID: 0x4a0 Creator Process Name: C Process Command Line: Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
|
| | Security | Audit Success | 12288 | 2025-11-29 23:52:11 | | Microsoft-Windows-Security-Auditing | 4608: Windows is starting up. This event is logged when LSASS.EXE starts and the auditing subsystem is initialized.
|
| | Security | Audit Success | 12290 | 2025-11-29 23:52:11 | | Microsoft-Windows-Security-Auditing | 6417: The FIPS mode crypto selftests succeeded. Process ID: 0x538 Process Name: C:\Windows\System32\lsass.exe
|
| | Security | Audit Success | 12544 | 2025-11-29 23:52:11 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-0-0 Account Name: - Account Domain: - Logon ID: 0x0 Logon Information: Logon Type: 0 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: - New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4 Process Name: Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: - Authentication Package: - Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-29 23:52:11 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4f8 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-29 23:52:11 | | Microsoft-Windows-Security-Auditing | 4648: A logon was attempted using explicit credentials. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon GUID: {00000000-0000-0000-0000-000000000000} Account Whose Credentials Were Used: Account Name: UMFD-0 Account Domain: Font Driver Host Logon GUID: {00000000-0000-0000-0000-000000000000} Target Server: Target Server Name: localhost Additional Information: localhost Process Information: Process ID: 0x4a0 Process Name: C:\Windows\System32\wininit.exe Network Information: Network Address: - Port: - This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
|
| | Security | Audit Success | 12544 | 2025-11-29 23:52:11 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 2 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1842 Elevated Token: %%1843 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-96-0-0 Account Name: UMFD-0 Account Domain: Font Driver Host Logon ID: 0xff86 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4a0 Process Name: C:\Windows\System32\wininit.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-29 23:52:11 | | Microsoft-Windows-Security-Auditing | 4648: A logon was attempted using explicit credentials. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon GUID: {00000000-0000-0000-0000-000000000000} Account Whose Credentials Were Used: Account Name: UMFD-1 Account Domain: Font Driver Host Logon GUID: {00000000-0000-0000-0000-000000000000} Target Server: Target Server Name: localhost Additional Information: localhost Process Information: Process ID: 0x518 Process Name: C:\Windows\System32\winlogon.exe Network Information: Network Address: - Port: - This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
|
| | Security | Audit Success | 12544 | 2025-11-29 23:52:11 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 2 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1842 Elevated Token: %%1843 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-96-0-1 Account Name: UMFD-1 Account Domain: Font Driver Host Logon ID: 0xff84 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x518 Process Name: C:\Windows\System32\winlogon.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-29 23:52:11 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-20 Account Name: NETWORK SERVICE Account Domain: NT AUTHORITY Logon ID: 0x3e4 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4f8 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12548 | 2025-11-29 23:52:11 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-29 23:52:11 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-20 Account Name: NETWORK SERVICE Account Domain: NT AUTHORITY Logon ID: 0x3e4 Privileges: SeAssignPrimaryTokenPrivilege SeAuditPrivilege SeImpersonatePrivilege
|
| | Security | Audit Success | 13568 | 2025-11-29 23:52:11 | | Microsoft-Windows-Security-Auditing | 4902: The Per-user audit policy table was created. Number of Elements: 0 Policy ID: 0xfb35
|
| | Security | Audit Success | 12292 | 2025-11-29 23:52:12 | | Microsoft-Windows-Security-Auditing | 5033: The Windows Firewall Driver started successfully.
|
| | Security | Audit Success | 12544 | 2025-11-29 23:52:12 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4f8 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-29 23:52:12 | | Microsoft-Windows-Security-Auditing | 4648: A logon was attempted using explicit credentials. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon GUID: {00000000-0000-0000-0000-000000000000} Account Whose Credentials Were Used: Account Name: DWM-1 Account Domain: Window Manager Logon GUID: {00000000-0000-0000-0000-000000000000} Target Server: Target Server Name: localhost Additional Information: localhost Process Information: Process ID: 0x518 Process Name: C:\Windows\System32\winlogon.exe Network Information: Network Address: - Port: - This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
|
| | Security | Audit Success | 12544 | 2025-11-29 23:52:12 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 2 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1842 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-90-0-1 Account Name: DWM-1 Account Domain: Window Manager Logon ID: 0x16b0f Linked Logon ID: 0x16b54 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x518 Process Name: C:\Windows\System32\winlogon.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-29 23:52:12 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 2 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1842 Elevated Token: %%1843 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-90-0-1 Account Name: DWM-1 Account Domain: Window Manager Logon ID: 0x16b54 Linked Logon ID: 0x16b0f Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x518 Process Name: C:\Windows\System32\winlogon.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-29 23:52:12 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4f8 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-29 23:52:12 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4f8 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-29 23:52:12 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-19 Account Name: LOCAL SERVICE Account Domain: NT AUTHORITY Logon ID: 0x3e5 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4f8 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-29 23:52:12 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4f8 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-29 23:52:12 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4f8 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-29 23:52:12 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4f8 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-29 23:52:12 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4f8 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-29 23:52:12 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4f8 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-29 23:52:12 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4f8 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-29 23:52:12 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4f8 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-29 23:52:12 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4f8 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-29 23:52:12 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4f8 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-29 23:52:12 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4f8 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-29 23:52:12 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4f8 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-29 23:52:12 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4f8 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-29 23:52:12 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4f8 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-29 23:52:12 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4f8 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-29 23:52:12 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4f8 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-29 23:52:12 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4f8 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12548 | 2025-11-29 23:52:12 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-29 23:52:12 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-90-0-1 Account Name: DWM-1 Account Domain: Window Manager Logon ID: 0x16b0f Privileges: SeAssignPrimaryTokenPrivilege SeAuditPrivilege SeImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-29 23:52:12 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-90-0-1 Account Name: DWM-1 Account Domain: Window Manager Logon ID: 0x16b54 Privileges: SeAssignPrimaryTokenPrivilege SeAuditPrivilege
|
| | Security | Audit Success | 12548 | 2025-11-29 23:52:12 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-29 23:52:12 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-29 23:52:12 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-19 Account Name: LOCAL SERVICE Account Domain: NT AUTHORITY Logon ID: 0x3e5 Privileges: SeAssignPrimaryTokenPrivilege SeAuditPrivilege SeImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-29 23:52:12 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-29 23:52:12 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-29 23:52:12 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-29 23:52:12 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-29 23:52:12 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-29 23:52:12 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-29 23:52:12 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-29 23:52:12 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-29 23:52:12 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-29 23:52:12 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-29 23:52:12 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-29 23:52:12 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-29 23:52:12 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-29 23:52:12 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-29 23:52:12 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-29 23:52:12 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 13826 | 2025-11-29 23:52:12 | | Microsoft-Windows-Security-Auditing | 4799: A security-enabled local group membership was enumerated. Subject: Security ID: S-1-5-20 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e4 Group: Security ID: S-1-5-32-544 Group Name: Administrators Group Domain: Builtin Process Information: Process ID: 0x740 Process Name: C:\Windows\System32\svchost.exe
|
| | Security | Audit Success | 13826 | 2025-11-29 23:52:12 | | Microsoft-Windows-Security-Auditing | 4799: A security-enabled local group membership was enumerated. Subject: Security ID: S-1-5-20 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e4 Group: Security ID: S-1-5-32-551 Group Name: Backup Operators Group Domain: Builtin Process Information: Process ID: 0x740 Process Name: C:\Windows\System32\svchost.exe
|
| | Security | Audit Success | 12544 | 2025-11-29 23:52:13 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4f8 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-29 23:52:13 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4f8 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-29 23:52:13 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4f8 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-29 23:52:13 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4f8 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-29 23:52:13 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4f8 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-29 23:52:13 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4f8 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-29 23:52:13 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4f8 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-29 23:52:13 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4f8 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12548 | 2025-11-29 23:52:13 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-29 23:52:13 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-29 23:52:13 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-29 23:52:13 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-29 23:52:13 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-29 23:52:13 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-29 23:52:13 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-29 23:52:13 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 13824 | 2025-11-29 23:52:14 | | Microsoft-Windows-Security-Auditing | 4798: A user's local group membership was enumerated. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 User: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Process Information: Process ID: 0x6cc Process Name: C:\Windows\System32\LogonUI.exe
|
| | Security | Audit Success | 12544 | 2025-11-29 23:52:15 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4f8 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-29 23:52:15 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4f8 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12548 | 2025-11-29 23:52:15 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-29 23:52:15 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12292 | 2025-11-29 23:52:16 | | Microsoft-Windows-Security-Auditing | 5024: The Windows Firewall service started successfully.
|
| | Security | Audit Success | 12544 | 2025-11-29 23:52:18 | | Microsoft-Windows-Security-Auditing | 4648: A logon was attempted using explicit credentials. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon GUID: {00000000-0000-0000-0000-000000000000} Account Whose Credentials Were Used: Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon GUID: {00000000-0000-0000-0000-000000000000} Target Server: Target Server Name: localhost Additional Information: localhost Process Information: Process ID: 0x970 Process Name: C:\Windows\System32\svchost.exe Network Information: Network Address: 127.0.0.1 Port: 0 This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
|
| | Security | Audit Success | 12544 | 2025-11-29 23:52:18 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 2 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x5a702 Linked Logon ID: 0x5a73b Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x970 Process Name: C:\Windows\System32\svchost.exe Network Information: Workstation Name: DESKTOP-0JV7HJV Source Network Address: 127.0.0.1 Source Port: 0 Detailed Authentication Information: Logon Process: User32 Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-29 23:52:18 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 2 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1843 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x5a73b Linked Logon ID: 0x5a702 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x970 Process Name: C:\Windows\System32\svchost.exe Network Information: Workstation Name: DESKTOP-0JV7HJV Source Network Address: 127.0.0.1 Source Port: 0 Detailed Authentication Information: Logon Process: User32 Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-29 23:52:18 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4f8 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12548 | 2025-11-29 23:52:18 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x5a702 Privileges: SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-29 23:52:18 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 13824 | 2025-11-29 23:52:18 | | Microsoft-Windows-Security-Auditing | 4798: A user's local group membership was enumerated. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 User: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Process Information: Process ID: 0x538 Process Name: C:\Windows\System32\lsass.exe
|
| | Security | Audit Success | 13826 | 2025-11-29 23:52:18 | | Microsoft-Windows-Security-Auditing | 4799: A security-enabled local group membership was enumerated. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Group: Security ID: S-1-5-32-544 Group Name: Administrators Group Domain: Builtin Process Information: Process ID: 0x84c Process Name: C:\Windows\System32\svchost.exe
|
| | Security | Audit Success | 12290 | 2025-11-29 23:52:19 | | Microsoft-Windows-Security-Auditing | 5061: Cryptographic operation. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x5a73b Cryptographic Parameters: Provider Name: Microsoft Software Key Storage Provider Algorithm Name: ECDSA_P256 Key Name: Microsoft Connected Devices Platform device certificate Key Type: %%2500 Cryptographic Operation: Operation: %%2480 Return Code: 0x0
|
| | Security | Audit Success | 12290 | 2025-11-29 23:52:19 | | Microsoft-Windows-Security-Auditing | 5061: Cryptographic operation. Subject: Security ID: S-1-5-19 Account Name: LOCAL SERVICE Account Domain: NT AUTHORITY Logon ID: 0x3e5 Cryptographic Parameters: Provider Name: Microsoft Software Key Storage Provider Algorithm Name: ECDSA_P256 Key Name: Microsoft Connected Devices Platform device certificate Key Type: %%2500 Cryptographic Operation: Operation: %%2480 Return Code: 0x0
|
| | Security | Audit Success | 12292 | 2025-11-29 23:52:19 | | Microsoft-Windows-Security-Auditing | 5058: Key file operation. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x5a73b Process Information: Process ID: 5416 Process Creation Time: 2025-11-30T07:52:19.1683058Z Cryptographic Parameters: Provider Name: Microsoft Software Key Storage Provider Algorithm Name: UNKNOWN Key Name: Microsoft Connected Devices Platform device certificate Key Type: %%2500 Key File Operation Information: File Path: C:\Users\CogiArt\AppData\Roaming\Microsoft\Crypto\Keys\de7cf8a7901d2ad13e5c67c29e5d1662_9ee7012e-fa60-42be-b8b4-8dc8b4e1280d Operation: %%2458 Return Code: 0x0
|
| | Security | Audit Success | 12292 | 2025-11-29 23:52:19 | | Microsoft-Windows-Security-Auditing | 5059: Key migration operation. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x5a73b Process Information: Process ID: 5416 Process Creation Time: 2025-11-30T07:52:19.1683058Z Cryptographic Parameters: Provider Name: Microsoft Software Key Storage Provider Algorithm Name: ECDSA_P256 Key Name: Microsoft Connected Devices Platform device certificate Key Type: %%2500 Additional Information: Operation: %%2464 Return Code: 0x0
|
| | Security | Audit Success | 12292 | 2025-11-29 23:52:19 | | Microsoft-Windows-Security-Auditing | 5058: Key file operation. Subject: Security ID: S-1-5-19 Account Name: LOCAL SERVICE Account Domain: NT AUTHORITY Logon ID: 0x3e5 Process Information: Process ID: 6072 Process Creation Time: 2025-11-30T07:52:19.4036029Z Cryptographic Parameters: Provider Name: Microsoft Software Key Storage Provider Algorithm Name: UNKNOWN Key Name: Microsoft Connected Devices Platform device certificate Key Type: %%2500 Key File Operation Information: File Path: C:\WINDOWS\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Crypto\Keys\de7cf8a7901d2ad13e5c67c29e5d1662_9ee7012e-fa60-42be-b8b4-8dc8b4e1280d Operation: %%2458 Return Code: 0x0
|
| | Security | Audit Success | 12292 | 2025-11-29 23:52:19 | | Microsoft-Windows-Security-Auditing | 5059: Key migration operation. Subject: Security ID: S-1-5-19 Account Name: LOCAL SERVICE Account Domain: NT AUTHORITY Logon ID: 0x3e5 Process Information: Process ID: 6072 Process Creation Time: 2025-11-30T07:52:19.4036029Z Cryptographic Parameters: Provider Name: Microsoft Software Key Storage Provider Algorithm Name: ECDSA_P256 Key Name: Microsoft Connected Devices Platform device certificate Key Type: %%2500 Additional Information: Operation: %%2464 Return Code: 0x0
|
| | Security | Audit Success | 12544 | 2025-11-29 23:52:19 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4f8 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-29 23:52:19 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4f8 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12548 | 2025-11-29 23:52:19 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-29 23:52:19 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12544 | 2025-11-29 23:52:21 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4f8 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-29 23:52:21 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4f8 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12548 | 2025-11-29 23:52:21 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-29 23:52:21 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 13824 | 2025-11-29 23:52:21 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 23:52:21 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 23:52:21 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 23:52:21 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x5a73b Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 23:52:21 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x5a73b Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 23:52:21 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x5a73b Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 23:52:21 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x5a73b Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 23:52:21 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x5a73b Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 23:52:21 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x5a73b Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 23:52:21 | | Microsoft-Windows-Security-Auditing | 4798: A user's local group membership was enumerated. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x5a73b User: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Process Information: Process ID: 0x1808 Process Name: C:\Windows\explorer.exe
|
| | Security | Audit Success | 13824 | 2025-11-29 23:52:21 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x5a73b Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13826 | 2025-11-29 23:52:21 | | Microsoft-Windows-Security-Auditing | 4799: A security-enabled local group membership was enumerated. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Group: Security ID: S-1-5-32-544 Group Name: Administrators Group Domain: Builtin Process Information: Process ID: 0x1d00 Process Name: C:\Windows\System32\SearchIndexer.exe
|
| | Security | Audit Success | 13826 | 2025-11-29 23:52:21 | | Microsoft-Windows-Security-Auditing | 4799: A security-enabled local group membership was enumerated. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Group: Security ID: S-1-5-32-551 Group Name: Backup Operators Group Domain: Builtin Process Information: Process ID: 0x1d00 Process Name: C:\Windows\System32\SearchIndexer.exe
|
| | Security | Audit Success | 13824 | 2025-11-29 23:52:22 | | Microsoft-Windows-Security-Auditing | 4798: A user's local group membership was enumerated. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x5a73b User: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Process Information: Process ID: 0x1808 Process Name: C:\Windows\explorer.exe
|
| | Security | Audit Success | 13824 | 2025-11-29 23:52:22 | | Microsoft-Windows-Security-Auditing | 4798: A user's local group membership was enumerated. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x5a702 User: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Process Information: Process ID: 0x1624 Process Name: C:\Program Files\AMD\CIM\Bin64\InstallManagerApp.exe
|
| | Security | Audit Success | 12544 | 2025-11-29 23:52:23 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4f8 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12548 | 2025-11-29 23:52:23 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 13826 | 2025-11-29 23:52:29 | | Microsoft-Windows-Security-Auditing | 4799: A security-enabled local group membership was enumerated. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Group: Security ID: S-1-5-32-544 Group Name: Administrators Group Domain: Builtin Process Information: Process ID: 0x10d8 Process Name: C:\Windows\System32\svchost.exe
|
| | Security | Audit Success | 13826 | 2025-11-29 23:52:29 | | Microsoft-Windows-Security-Auditing | 4799: A security-enabled local group membership was enumerated. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Group: Security ID: S-1-5-32-551 Group Name: Backup Operators Group Domain: Builtin Process Information: Process ID: 0x10d8 Process Name: C:\Windows\System32\svchost.exe
|
| | Security | Audit Success | 12544 | 2025-11-29 23:52:30 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4f8 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-29 23:52:30 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4f8 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12548 | 2025-11-29 23:52:30 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-29 23:52:30 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 13824 | 2025-11-29 23:52:32 | | Microsoft-Windows-Security-Auditing | 4798: A user's local group membership was enumerated. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x5a73b User: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Process Information: Process ID: 0x1808 Process Name: C:\Windows\explorer.exe
|
| | Security | Audit Success | 12544 | 2025-11-29 23:52:42 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4f8 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12548 | 2025-11-29 23:52:42 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12544 | 2025-11-29 23:52:43 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4f8 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12548 | 2025-11-29 23:52:43 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12544 | 2025-11-29 23:52:48 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4f8 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12548 | 2025-11-29 23:52:48 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12544 | 2025-11-29 23:53:02 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4f8 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-29 23:53:02 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4f8 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12548 | 2025-11-29 23:53:02 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-29 23:53:02 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12544 | 2025-11-29 23:53:04 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4f8 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12548 | 2025-11-29 23:53:04 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12544 | 2025-11-29 23:53:13 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4f8 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12548 | 2025-11-29 23:53:13 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 13824 | 2025-11-29 23:53:13 | | Microsoft-Windows-Security-Auditing | 4798: A user's local group membership was enumerated. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x5a73b User: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Process Information: Process ID: 0x1808 Process Name: C:\Windows\explorer.exe
|
| | Security | Audit Success | 13824 | 2025-11-29 23:53:17 | | Microsoft-Windows-Security-Auditing | 4798: A user's local group membership was enumerated. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x5a73b User: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Process Information: Process ID: 0x1808 Process Name: C:\Windows\explorer.exe
|
| | Security | Audit Success | 13824 | 2025-11-29 23:53:21 | | Microsoft-Windows-Security-Auditing | 4798: A user's local group membership was enumerated. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x5a73b User: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Process Information: Process ID: 0x1808 Process Name: C:\Windows\explorer.exe
|
| | Security | Audit Success | 12544 | 2025-11-29 23:53:23 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4f8 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12548 | 2025-11-29 23:53:23 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12544 | 2025-11-29 23:54:16 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4f8 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-29 23:54:16 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4f8 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-29 23:54:16 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4f8 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12548 | 2025-11-29 23:54:16 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-29 23:54:16 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-29 23:54:16 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12544 | 2025-11-29 23:54:17 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4f8 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12548 | 2025-11-29 23:54:17 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 13826 | 2025-11-29 23:54:17 | | Microsoft-Windows-Security-Auditing | 4799: A security-enabled local group membership was enumerated. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Group: Security ID: S-1-5-32-545 Group Name: Users Group Domain: Builtin Process Information: Process ID: 0x1e38 Process Name: C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{0EA78A2B-5012-4887-A25D-92E7F0D8C610}\EDGEMITMP_B0AAC.tmp\setup.exe
|
| | Security | Audit Success | 12544 | 2025-11-29 23:54:20 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4f8 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-29 23:54:20 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4f8 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12548 | 2025-11-29 23:54:20 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-29 23:54:20 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 13824 | 2025-11-29 23:54:46 | | Microsoft-Windows-Security-Auditing | 4798: A user's local group membership was enumerated. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x5a73b User: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Process Information: Process ID: 0x1808 Process Name: C:\Windows\explorer.exe
|
| | Security | Audit Success | 12544 | 2025-11-29 23:57:19 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4f8 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12548 | 2025-11-29 23:57:19 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12544 | 2025-11-29 23:57:20 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4f8 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12548 | 2025-11-29 23:57:20 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12544 | 2025-11-29 23:57:51 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4f8 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12548 | 2025-11-29 23:57:51 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 13824 | 2025-11-29 23:57:51 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Read Operation: %%8099 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-29 23:57:51 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x5a73b Read Operation: %%8099 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 12544 | 2025-11-30 00:01:05 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4f8 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12548 | 2025-11-30 00:01:05 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12544 | 2025-11-30 00:01:10 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4f8 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12548 | 2025-11-30 00:01:10 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12544 | 2025-11-30 00:02:23 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4f8 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12548 | 2025-11-30 00:02:23 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12544 | 2025-11-30 00:02:31 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4f8 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12548 | 2025-11-30 00:02:31 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12544 | 2025-11-30 00:07:12 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4f8 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12548 | 2025-11-30 00:07:12 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12544 | 2025-11-30 00:07:20 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4f8 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12548 | 2025-11-30 00:07:20 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12544 | 2025-11-30 00:18:16 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4f8 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-30 00:18:16 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4f8 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12545 | 2025-11-30 00:18:16 | | Microsoft-Windows-Security-Auditing | 4647: User initiated logoff: Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x5a73b This event is generated when a logoff is initiated. No further user-initiated activity can occur. This event can be interpreted as a logoff event.
|
| | Security | Audit Success | 12548 | 2025-11-30 00:18:16 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-30 00:18:16 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12544 | 2025-11-30 00:18:18 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4f8 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12548 | 2025-11-30 00:18:18 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 103 | 2025-11-30 00:18:19 | | Microsoft-Windows-Eventlog | 1100: The event logging service has shut down.
|
| | Security | Audit Success | 13312 | 2025-11-30 00:18:25 | | Microsoft-Windows-Security-Auditing | 4688: A new process has been created. Creator Subject: Security ID: S-1-5-18 Account Name: - Account Domain: - Logon ID: 0x3e7 Target Subject: Security ID: S-1-0-0 Account Name: - Account Domain: - Logon ID: 0x0 Process Information: New Process ID: 0x170 New Process Name: R Token Elevation Type: %%1936 Mandatory Label: S-1-16-16384 Creator Process ID: 0x4 Creator Process Name: Process Command Line: Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
|
| | Security | Audit Success | 13312 | 2025-11-30 00:18:25 | | Microsoft-Windows-Security-Auditing | 4696: A primary token was assigned to process. Subject: Security ID: S-1-5-18 Account Name: - Account Domain: - Logon ID: 0x3e7 Process Information: Process ID: 0x4 Process Name: Target Process: Target Process ID: 0x170 Target Process Name: Registry New Token Information: Security ID: S-1-0-0 Account Name: - Account Domain: - Logon ID: 0x3e7
|
| | Security | Audit Success | 13312 | 2025-11-30 00:18:25 | | Microsoft-Windows-Security-Auditing | 4688: A new process has been created. Creator Subject: Security ID: S-1-5-18 Account Name: - Account Domain: - Logon ID: 0x3e7 Target Subject: Security ID: S-1-0-0 Account Name: - Account Domain: - Logon ID: 0x0 Process Information: New Process ID: 0x370 New Process Name: C Token Elevation Type: %%1936 Mandatory Label: S-1-16-16384 Creator Process ID: 0x4 Creator Process Name: Process Command Line: Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
|
| | Security | Audit Success | 13573 | 2025-11-30 00:18:25 | | Microsoft-Windows-Security-Auditing | 4826: Boot Configuration Data loaded. Subject: Security ID: S-1-5-18 Account Name: - Account Domain: - Logon ID: 0x3e7 General Settings: Load Options: - Advanced Options: %%1843 Configuration Access Policy: %%1846 System Event Logging: %%1843 Kernel Debugging: %%1843 VSM Launch Type: %%1848 Signature Settings: Test Signing: %%1843 Flight Signing: %%1843 Disable Integrity Checks: %%1843 HyperVisor Settings: HyperVisor Load Options: - HyperVisor Launch Type: %%1848 HyperVisor Debugging: %%1843
|
| | Security | Audit Success | 13312 | 2025-11-30 00:18:26 | | Microsoft-Windows-Security-Auditing | 4688: A new process has been created. Creator Subject: Security ID: S-1-5-18 Account Name: - Account Domain: - Logon ID: 0x3e7 Target Subject: Security ID: S-1-0-0 Account Name: - Account Domain: - Logon ID: 0x0 Process Information: New Process ID: 0x38c New Process Name: C Token Elevation Type: %%1936 Mandatory Label: S-1-16-16384 Creator Process ID: 0x370 Creator Process Name: C Process Command Line: Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
|
| | Security | Audit Success | 13312 | 2025-11-30 00:18:37 | | Microsoft-Windows-Security-Auditing | 4688: A new process has been created. Creator Subject: Security ID: S-1-5-18 Account Name: - Account Domain: - Logon ID: 0x3e7 Target Subject: Security ID: S-1-0-0 Account Name: - Account Domain: - Logon ID: 0x0 Process Information: New Process ID: 0x3b0 New Process Name: C Token Elevation Type: %%1936 Mandatory Label: S-1-16-16384 Creator Process ID: 0x370 Creator Process Name: C Process Command Line: Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
|
| | Security | Audit Success | 13312 | 2025-11-30 00:18:39 | | Microsoft-Windows-Security-Auditing | 4688: A new process has been created. Creator Subject: Security ID: S-1-5-18 Account Name: - Account Domain: - Logon ID: 0x3e7 Target Subject: Security ID: S-1-0-0 Account Name: - Account Domain: - Logon ID: 0x0 Process Information: New Process ID: 0x3bc New Process Name: C Token Elevation Type: %%1936 Mandatory Label: S-1-16-16384 Creator Process ID: 0x3b0 Creator Process Name: C Process Command Line: Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
|
| | Security | Audit Success | 12288 | 2025-11-30 00:18:41 | | Microsoft-Windows-Security-Auditing | 4608: Windows is starting up. This event is logged when LSASS.EXE starts and the auditing subsystem is initialized.
|
| | Security | Audit Success | 12290 | 2025-11-30 00:18:41 | | Microsoft-Windows-Security-Auditing | 6417: The FIPS mode crypto selftests succeeded. Process ID: 0x50c Process Name: C:\Windows\System32\lsass.exe
|
| | Security | Audit Success | 12544 | 2025-11-30 00:18:41 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-0-0 Account Name: - Account Domain: - Logon ID: 0x0 Logon Information: Logon Type: 0 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: - New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4 Process Name: Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: - Authentication Package: - Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 13312 | 2025-11-30 00:18:41 | | Microsoft-Windows-Security-Auditing | 4688: A new process has been created. Creator Subject: Security ID: S-1-5-18 Account Name: - Account Domain: - Logon ID: 0x3e7 Target Subject: Security ID: S-1-0-0 Account Name: - Account Domain: - Logon ID: 0x0 Process Information: New Process ID: 0x49c New Process Name: C Token Elevation Type: %%1936 Mandatory Label: S-1-16-16384 Creator Process ID: 0x370 Creator Process Name: C Process Command Line: Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
|
| | Security | Audit Success | 13312 | 2025-11-30 00:18:41 | | Microsoft-Windows-Security-Auditing | 4688: A new process has been created. Creator Subject: Security ID: S-1-5-18 Account Name: - Account Domain: - Logon ID: 0x3e7 Target Subject: Security ID: S-1-0-0 Account Name: - Account Domain: - Logon ID: 0x0 Process Information: New Process ID: 0x4a4 New Process Name: C Token Elevation Type: %%1936 Mandatory Label: S-1-16-16384 Creator Process ID: 0x3b0 Creator Process Name: C Process Command Line: Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
|
| | Security | Audit Success | 13312 | 2025-11-30 00:18:41 | | Microsoft-Windows-Security-Auditing | 4688: A new process has been created. Creator Subject: Security ID: S-1-5-18 Account Name: - Account Domain: - Logon ID: 0x3e7 Target Subject: Security ID: S-1-0-0 Account Name: - Account Domain: - Logon ID: 0x0 Process Information: New Process ID: 0x4ac New Process Name: C Token Elevation Type: %%1936 Mandatory Label: S-1-16-16384 Creator Process ID: 0x49c Creator Process Name: C Process Command Line: Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
|
| | Security | Audit Success | 13312 | 2025-11-30 00:18:41 | | Microsoft-Windows-Security-Auditing | 4688: A new process has been created. Creator Subject: Security ID: S-1-5-18 Account Name: - Account Domain: - Logon ID: 0x3e7 Target Subject: Security ID: S-1-0-0 Account Name: - Account Domain: - Logon ID: 0x0 Process Information: New Process ID: 0x4f8 New Process Name: C Token Elevation Type: %%1936 Mandatory Label: S-1-16-16384 Creator Process ID: 0x4a4 Creator Process Name: C Process Command Line: Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
|
| | Security | Audit Success | 13312 | 2025-11-30 00:18:41 | | Microsoft-Windows-Security-Auditing | 4688: A new process has been created. Creator Subject: Security ID: S-1-5-18 Account Name: - Account Domain: - Logon ID: 0x3e7 Target Subject: Security ID: S-1-0-0 Account Name: - Account Domain: - Logon ID: 0x0 Process Information: New Process ID: 0x50c New Process Name: C Token Elevation Type: %%1936 Mandatory Label: S-1-16-16384 Creator Process ID: 0x4a4 Creator Process Name: C Process Command Line: Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
|
| | Security | Audit Success | 13312 | 2025-11-30 00:18:41 | | Microsoft-Windows-Security-Auditing | 4688: A new process has been created. Creator Subject: Security ID: S-1-5-18 Account Name: - Account Domain: - Logon ID: 0x3e7 Target Subject: Security ID: S-1-0-0 Account Name: - Account Domain: - Logon ID: 0x0 Process Information: New Process ID: 0x530 New Process Name: C Token Elevation Type: %%1936 Mandatory Label: S-1-16-16384 Creator Process ID: 0x49c Creator Process Name: C Process Command Line: Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
|
| | Security | Audit Success | 13568 | 2025-11-30 00:18:41 | | Microsoft-Windows-Security-Auditing | 4902: The Per-user audit policy table was created. Number of Elements: 0 Policy ID: 0xfae0
|
| | Security | Audit Success | 12544 | 2025-11-30 00:18:42 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4f8 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-30 00:18:42 | | Microsoft-Windows-Security-Auditing | 4648: A logon was attempted using explicit credentials. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon GUID: {00000000-0000-0000-0000-000000000000} Account Whose Credentials Were Used: Account Name: UMFD-0 Account Domain: Font Driver Host Logon GUID: {00000000-0000-0000-0000-000000000000} Target Server: Target Server Name: localhost Additional Information: localhost Process Information: Process ID: 0x4a4 Process Name: C:\Windows\System32\wininit.exe Network Information: Network Address: - Port: - This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
|
| | Security | Audit Success | 12544 | 2025-11-30 00:18:42 | | Microsoft-Windows-Security-Auditing | 4648: A logon was attempted using explicit credentials. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon GUID: {00000000-0000-0000-0000-000000000000} Account Whose Credentials Were Used: Account Name: UMFD-1 Account Domain: Font Driver Host Logon GUID: {00000000-0000-0000-0000-000000000000} Target Server: Target Server Name: localhost Additional Information: localhost Process Information: Process ID: 0x530 Process Name: C:\Windows\System32\winlogon.exe Network Information: Network Address: - Port: - This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
|
| | Security | Audit Success | 12544 | 2025-11-30 00:18:42 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 2 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1842 Elevated Token: %%1843 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-96-0-1 Account Name: UMFD-1 Account Domain: Font Driver Host Logon ID: 0xff25 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x530 Process Name: C:\Windows\System32\winlogon.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-30 00:18:42 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 2 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1842 Elevated Token: %%1843 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-96-0-0 Account Name: UMFD-0 Account Domain: Font Driver Host Logon ID: 0xff2a Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4a4 Process Name: C:\Windows\System32\wininit.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-30 00:18:42 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-20 Account Name: NETWORK SERVICE Account Domain: NT AUTHORITY Logon ID: 0x3e4 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4f8 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-30 00:18:42 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4f8 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-30 00:18:42 | | Microsoft-Windows-Security-Auditing | 4648: A logon was attempted using explicit credentials. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon GUID: {00000000-0000-0000-0000-000000000000} Account Whose Credentials Were Used: Account Name: DWM-1 Account Domain: Window Manager Logon GUID: {00000000-0000-0000-0000-000000000000} Target Server: Target Server Name: localhost Additional Information: localhost Process Information: Process ID: 0x530 Process Name: C:\Windows\System32\winlogon.exe Network Information: Network Address: - Port: - This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
|
| | Security | Audit Success | 12544 | 2025-11-30 00:18:42 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 2 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1842 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-90-0-1 Account Name: DWM-1 Account Domain: Window Manager Logon ID: 0x16af8 Linked Logon ID: 0x16b44 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x530 Process Name: C:\Windows\System32\winlogon.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-30 00:18:42 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 2 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1842 Elevated Token: %%1843 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-90-0-1 Account Name: DWM-1 Account Domain: Window Manager Logon ID: 0x16b44 Linked Logon ID: 0x16af8 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x530 Process Name: C:\Windows\System32\winlogon.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-30 00:18:42 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4f8 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-30 00:18:42 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4f8 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-30 00:18:42 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-19 Account Name: LOCAL SERVICE Account Domain: NT AUTHORITY Logon ID: 0x3e5 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4f8 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-30 00:18:42 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4f8 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-30 00:18:42 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4f8 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-30 00:18:42 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4f8 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-30 00:18:42 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4f8 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-30 00:18:42 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4f8 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-30 00:18:42 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4f8 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-30 00:18:42 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4f8 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-30 00:18:42 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4f8 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-30 00:18:42 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4f8 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-30 00:18:42 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4f8 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-30 00:18:42 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4f8 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-30 00:18:42 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4f8 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-30 00:18:42 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4f8 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-30 00:18:42 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4f8 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-30 00:18:42 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4f8 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12548 | 2025-11-30 00:18:42 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-30 00:18:42 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-20 Account Name: NETWORK SERVICE Account Domain: NT AUTHORITY Logon ID: 0x3e4 Privileges: SeAssignPrimaryTokenPrivilege SeAuditPrivilege SeImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-30 00:18:42 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-30 00:18:42 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-90-0-1 Account Name: DWM-1 Account Domain: Window Manager Logon ID: 0x16af8 Privileges: SeAssignPrimaryTokenPrivilege SeAuditPrivilege SeImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-30 00:18:42 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-90-0-1 Account Name: DWM-1 Account Domain: Window Manager Logon ID: 0x16b44 Privileges: SeAssignPrimaryTokenPrivilege SeAuditPrivilege
|
| | Security | Audit Success | 12548 | 2025-11-30 00:18:42 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-30 00:18:42 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-30 00:18:42 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-19 Account Name: LOCAL SERVICE Account Domain: NT AUTHORITY Logon ID: 0x3e5 Privileges: SeAssignPrimaryTokenPrivilege SeAuditPrivilege SeImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-30 00:18:42 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-30 00:18:42 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-30 00:18:42 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-30 00:18:42 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-30 00:18:42 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-30 00:18:42 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-30 00:18:42 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-30 00:18:42 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-30 00:18:42 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-30 00:18:42 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-30 00:18:42 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-30 00:18:42 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-30 00:18:42 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-30 00:18:42 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-30 00:18:42 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 13826 | 2025-11-30 00:18:42 | | Microsoft-Windows-Security-Auditing | 4799: A security-enabled local group membership was enumerated. Subject: Security ID: S-1-5-20 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e4 Group: Security ID: S-1-5-32-544 Group Name: Administrators Group Domain: Builtin Process Information: Process ID: 0x74c Process Name: C:\Windows\System32\svchost.exe
|
| | Security | Audit Success | 13826 | 2025-11-30 00:18:42 | | Microsoft-Windows-Security-Auditing | 4799: A security-enabled local group membership was enumerated. Subject: Security ID: S-1-5-20 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e4 Group: Security ID: S-1-5-32-551 Group Name: Backup Operators Group Domain: Builtin Process Information: Process ID: 0x74c Process Name: C:\Windows\System32\svchost.exe
|
| | Security | Audit Success | 12292 | 2025-11-30 00:18:43 | | Microsoft-Windows-Security-Auditing | 5033: The Windows Firewall Driver started successfully.
|
| | Security | Audit Success | 12544 | 2025-11-30 00:18:43 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4f8 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-30 00:18:43 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4f8 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-30 00:18:43 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4f8 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-30 00:18:43 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4f8 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-30 00:18:43 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4f8 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-30 00:18:43 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4f8 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-30 00:18:43 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4f8 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-30 00:18:43 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4f8 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-30 00:18:43 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4f8 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12548 | 2025-11-30 00:18:43 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-30 00:18:43 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-30 00:18:43 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-30 00:18:43 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-30 00:18:43 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-30 00:18:43 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-30 00:18:43 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-30 00:18:43 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-30 00:18:43 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12288 | 2025-11-30 00:41:10 | | Microsoft-Windows-Security-Auditing | 4616: The system time was changed. Subject: Security ID: S-1-5-19 Account Name: LOCAL SERVICE Account Domain: NT AUTHORITY Logon ID: 0x3e5 Process Information: Process ID: 0x13a4 Name: C:\Windows\System32\svchost.exe Previous Time: 2025-11-30T08:18:45.6385850Z New Time: 2025-11-30T08:41:10.6608202Z This event is generated when the system time is changed. It is normal for the Windows Time Service, which runs with System privilege, to change the system time on a regular basis. Other system time changes may be indicative of attempts to tamper with the computer.
|
| | Security | Audit Success | 12288 | 2025-11-30 00:41:10 | | Microsoft-Windows-Security-Auditing | 4616: The system time was changed. Subject: Security ID: S-1-5-19 Account Name: LOCAL SERVICE Account Domain: NT AUTHORITY Logon ID: 0x3e5 Process Information: Process ID: 0x13a4 Name: C:\Windows\System32\svchost.exe Previous Time: 2025-11-30T08:41:10.6608202Z New Time: 2025-11-30T08:41:10.6613678Z This event is generated when the system time is changed. It is normal for the Windows Time Service, which runs with System privilege, to change the system time on a regular basis. Other system time changes may be indicative of attempts to tamper with the computer.
|
| | Security | Audit Success | 12544 | 2025-11-30 00:41:10 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4f8 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12548 | 2025-11-30 00:41:10 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12544 | 2025-11-30 00:41:11 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4f8 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-30 00:41:11 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4f8 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-30 00:41:11 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4f8 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12548 | 2025-11-30 00:41:11 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-30 00:41:11 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-30 00:41:11 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 13824 | 2025-11-30 00:41:11 | | Microsoft-Windows-Security-Auditing | 4798: A user's local group membership was enumerated. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 User: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Process Information: Process ID: 0x6e0 Process Name: C:\Windows\System32\LogonUI.exe
|
| | Security | Audit Success | 13824 | 2025-11-30 00:41:11 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-30 00:41:11 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-30 00:41:11 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-30 00:41:11 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-30 00:41:11 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-30 00:41:11 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 12288 | 2025-11-30 00:41:12 | | Microsoft-Windows-Security-Auditing | 4616: The system time was changed. Subject: Security ID: S-1-5-19 Account Name: LOCAL SERVICE Account Domain: NT AUTHORITY Logon ID: 0x3e5 Process Information: Process ID: 0x13a4 Name: C:\Windows\System32\svchost.exe Previous Time: 2025-11-30T08:41:12.2462367Z New Time: 2025-11-30T08:41:12.2495755Z This event is generated when the system time is changed. It is normal for the Windows Time Service, which runs with System privilege, to change the system time on a regular basis. Other system time changes may be indicative of attempts to tamper with the computer.
|
| | Security | Audit Success | 12544 | 2025-11-30 00:41:12 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4f8 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-30 00:41:12 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4f8 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12548 | 2025-11-30 00:41:12 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-30 00:41:12 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12290 | 2025-11-30 00:41:13 | | Microsoft-Windows-Security-Auditing | 5061: Cryptographic operation. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Cryptographic Parameters: Provider Name: Microsoft Software Key Storage Provider Algorithm Name: RSA Key Name: f8df15d9-56fa-0cb3-682b-838ed74af121 Key Type: %%2500 Cryptographic Operation: Operation: %%2480 Return Code: 0x0
|
| | Security | Audit Success | 12292 | 2025-11-30 00:41:13 | | Microsoft-Windows-Security-Auditing | 5024: The Windows Firewall service started successfully.
|
| | Security | Audit Success | 12292 | 2025-11-30 00:41:13 | | Microsoft-Windows-Security-Auditing | 5058: Key file operation. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Process Information: Process ID: 5444 Process Creation Time: 2025-11-30T08:41:11.1650941Z Cryptographic Parameters: Provider Name: Microsoft Software Key Storage Provider Algorithm Name: UNKNOWN Key Name: f8df15d9-56fa-0cb3-682b-838ed74af121 Key Type: %%2500 Key File Operation Information: File Path: C:\ProgramData\Microsoft\Crypto\SystemKeys\8bb43a3e92c2eb4c420c9abd6e278936_9ee7012e-fa60-42be-b8b4-8dc8b4e1280d Operation: %%2458 Return Code: 0x0
|
| | Security | Audit Success | 13824 | 2025-11-30 00:41:13 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-30 00:41:13 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Read Operation: %%8099 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-30 00:41:13 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-30 00:41:13 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-30 00:41:13 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-30 00:41:13 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-30 00:41:13 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-30 00:41:13 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-30 00:41:13 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-30 00:41:13 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-30 00:41:13 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-30 00:41:13 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-30 00:41:13 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-30 00:41:13 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-30 00:41:13 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-30 00:41:13 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-30 00:41:13 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 12290 | 2025-11-30 00:41:14 | | Microsoft-Windows-Security-Auditing | 5061: Cryptographic operation. Subject: Security ID: S-1-5-19 Account Name: LOCAL SERVICE Account Domain: NT AUTHORITY Logon ID: 0x3e5 Cryptographic Parameters: Provider Name: Microsoft Software Key Storage Provider Algorithm Name: ECDSA_P256 Key Name: Microsoft Connected Devices Platform device certificate Key Type: %%2500 Cryptographic Operation: Operation: %%2480 Return Code: 0x0
|
| | Security | Audit Success | 12292 | 2025-11-30 00:41:14 | | Microsoft-Windows-Security-Auditing | 5058: Key file operation. Subject: Security ID: S-1-5-19 Account Name: LOCAL SERVICE Account Domain: NT AUTHORITY Logon ID: 0x3e5 Process Information: Process ID: 5056 Process Creation Time: 2025-11-30T08:41:14.8952203Z Cryptographic Parameters: Provider Name: Microsoft Software Key Storage Provider Algorithm Name: UNKNOWN Key Name: Microsoft Connected Devices Platform device certificate Key Type: %%2500 Key File Operation Information: File Path: C:\WINDOWS\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Crypto\Keys\de7cf8a7901d2ad13e5c67c29e5d1662_9ee7012e-fa60-42be-b8b4-8dc8b4e1280d Operation: %%2458 Return Code: 0x0
|
| | Security | Audit Success | 12292 | 2025-11-30 00:41:14 | | Microsoft-Windows-Security-Auditing | 5059: Key migration operation. Subject: Security ID: S-1-5-19 Account Name: LOCAL SERVICE Account Domain: NT AUTHORITY Logon ID: 0x3e5 Process Information: Process ID: 5056 Process Creation Time: 2025-11-30T08:41:14.8952203Z Cryptographic Parameters: Provider Name: Microsoft Software Key Storage Provider Algorithm Name: ECDSA_P256 Key Name: Microsoft Connected Devices Platform device certificate Key Type: %%2500 Additional Information: Operation: %%2464 Return Code: 0x0
|
| | Security | Audit Success | 13824 | 2025-11-30 00:41:14 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-30 00:41:14 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-30 00:41:14 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-30 00:41:14 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-30 00:41:14 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-30 00:41:14 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-30 00:41:14 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-30 00:41:14 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 12544 | 2025-11-30 00:41:15 | | Microsoft-Windows-Security-Auditing | 4648: A logon was attempted using explicit credentials. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon GUID: {00000000-0000-0000-0000-000000000000} Account Whose Credentials Were Used: Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon GUID: {00000000-0000-0000-0000-000000000000} Target Server: Target Server Name: localhost Additional Information: localhost Process Information: Process ID: 0x96c Process Name: C:\Windows\System32\svchost.exe Network Information: Network Address: 127.0.0.1 Port: 0 This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
|
| | Security | Audit Success | 12544 | 2025-11-30 00:41:15 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 2 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x6e1ed Linked Logon ID: 0x6e225 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x96c Process Name: C:\Windows\System32\svchost.exe Network Information: Workstation Name: DESKTOP-0JV7HJV Source Network Address: 127.0.0.1 Source Port: 0 Detailed Authentication Information: Logon Process: User32 Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-30 00:41:15 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 2 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1843 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x6e225 Linked Logon ID: 0x6e1ed Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x96c Process Name: C:\Windows\System32\svchost.exe Network Information: Workstation Name: DESKTOP-0JV7HJV Source Network Address: 127.0.0.1 Source Port: 0 Detailed Authentication Information: Logon Process: User32 Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12548 | 2025-11-30 00:41:15 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x6e1ed Privileges: SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 13824 | 2025-11-30 00:41:15 | | Microsoft-Windows-Security-Auditing | 4798: A user's local group membership was enumerated. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 User: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Process Information: Process ID: 0x50c Process Name: C:\Windows\System32\lsass.exe
|
| | Security | Audit Success | 12290 | 2025-11-30 00:41:16 | | Microsoft-Windows-Security-Auditing | 5061: Cryptographic operation. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x6e225 Cryptographic Parameters: Provider Name: Microsoft Software Key Storage Provider Algorithm Name: ECDSA_P256 Key Name: Microsoft Connected Devices Platform device certificate Key Type: %%2500 Cryptographic Operation: Operation: %%2480 Return Code: 0x0
|
| | Security | Audit Success | 12292 | 2025-11-30 00:41:16 | | Microsoft-Windows-Security-Auditing | 5058: Key file operation. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x6e225 Process Information: Process ID: 2328 Process Creation Time: 2025-11-30T08:41:16.4719803Z Cryptographic Parameters: Provider Name: Microsoft Software Key Storage Provider Algorithm Name: UNKNOWN Key Name: Microsoft Connected Devices Platform device certificate Key Type: %%2500 Key File Operation Information: File Path: C:\Users\CogiArt\AppData\Roaming\Microsoft\Crypto\Keys\de7cf8a7901d2ad13e5c67c29e5d1662_9ee7012e-fa60-42be-b8b4-8dc8b4e1280d Operation: %%2458 Return Code: 0x0
|
| | Security | Audit Success | 12292 | 2025-11-30 00:41:16 | | Microsoft-Windows-Security-Auditing | 5059: Key migration operation. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x6e225 Process Information: Process ID: 2328 Process Creation Time: 2025-11-30T08:41:16.4719803Z Cryptographic Parameters: Provider Name: Microsoft Software Key Storage Provider Algorithm Name: ECDSA_P256 Key Name: Microsoft Connected Devices Platform device certificate Key Type: %%2500 Additional Information: Operation: %%2464 Return Code: 0x0
|
| | Security | Audit Success | 12544 | 2025-11-30 00:41:16 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4f8 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-30 00:41:16 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4f8 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12548 | 2025-11-30 00:41:16 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-30 00:41:16 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 13824 | 2025-11-30 00:41:16 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x6e225 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-30 00:41:16 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x6e225 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-30 00:41:16 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x6e225 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13826 | 2025-11-30 00:41:16 | | Microsoft-Windows-Security-Auditing | 4799: A security-enabled local group membership was enumerated. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Group: Security ID: S-1-5-32-544 Group Name: Administrators Group Domain: Builtin Process Information: Process ID: 0x860 Process Name: C:\Windows\System32\svchost.exe
|
| | Security | Audit Success | 12544 | 2025-11-30 00:41:17 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4f8 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12548 | 2025-11-30 00:41:17 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12544 | 2025-11-30 00:41:18 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4f8 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12548 | 2025-11-30 00:41:18 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 13824 | 2025-11-30 00:41:18 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x6e225 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-30 00:41:18 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x6e225 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-30 00:41:18 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x6e225 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-30 00:41:18 | | Microsoft-Windows-Security-Auditing | 4798: A user's local group membership was enumerated. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x6e225 User: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Process Information: Process ID: 0x19d8 Process Name: C:\Windows\explorer.exe
|
| | Security | Audit Success | 13824 | 2025-11-30 00:41:19 | | Microsoft-Windows-Security-Auditing | 4798: A user's local group membership was enumerated. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x6e225 User: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Process Information: Process ID: 0x19d8 Process Name: C:\Windows\explorer.exe
|
| | Security | Audit Success | 13824 | 2025-11-30 00:41:19 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x6e225 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-30 00:41:19 | | Microsoft-Windows-Security-Auditing | 4798: A user's local group membership was enumerated. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x6e1ed User: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Process Information: Process ID: 0x1404 Process Name: C:\Program Files\AMD\CIM\Bin64\InstallManagerApp.exe
|
| | Security | Audit Success | 13826 | 2025-11-30 00:41:19 | | Microsoft-Windows-Security-Auditing | 4799: A security-enabled local group membership was enumerated. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Group: Security ID: S-1-5-32-544 Group Name: Administrators Group Domain: Builtin Process Information: Process ID: 0x1fec Process Name: C:\Windows\System32\SearchIndexer.exe
|
| | Security | Audit Success | 13826 | 2025-11-30 00:41:19 | | Microsoft-Windows-Security-Auditing | 4799: A security-enabled local group membership was enumerated. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Group: Security ID: S-1-5-32-551 Group Name: Backup Operators Group Domain: Builtin Process Information: Process ID: 0x1fec Process Name: C:\Windows\System32\SearchIndexer.exe
|
| | Security | Audit Success | 12544 | 2025-11-30 00:41:21 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4f8 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12548 | 2025-11-30 00:41:21 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12544 | 2025-11-30 00:41:25 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4f8 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12548 | 2025-11-30 00:41:25 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 13826 | 2025-11-30 00:41:25 | | Microsoft-Windows-Security-Auditing | 4799: A security-enabled local group membership was enumerated. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Group: Security ID: S-1-5-32-544 Group Name: Administrators Group Domain: Builtin Process Information: Process ID: 0x10b0 Process Name: C:\Windows\System32\svchost.exe
|
| | Security | Audit Success | 13826 | 2025-11-30 00:41:25 | | Microsoft-Windows-Security-Auditing | 4799: A security-enabled local group membership was enumerated. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Group: Security ID: S-1-5-32-551 Group Name: Backup Operators Group Domain: Builtin Process Information: Process ID: 0x10b0 Process Name: C:\Windows\System32\svchost.exe
|
| | Security | Audit Success | 13824 | 2025-11-30 00:41:31 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x6e225 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 12544 | 2025-11-30 00:41:45 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4f8 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12548 | 2025-11-30 00:41:45 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12544 | 2025-11-30 00:42:28 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4f8 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12548 | 2025-11-30 00:42:28 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 13826 | 2025-11-30 00:42:33 | | Microsoft-Windows-Security-Auditing | 4799: A security-enabled local group membership was enumerated. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Group: Security ID: S-1-5-32-544 Group Name: Administrators Group Domain: Builtin Process Information: Process ID: 0x1694 Process Name: C:\Windows\System32\svchost.exe
|
| | Security | Audit Success | 13826 | 2025-11-30 00:42:33 | | Microsoft-Windows-Security-Auditing | 4799: A security-enabled local group membership was enumerated. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Group: Security ID: S-1-5-32-551 Group Name: Backup Operators Group Domain: Builtin Process Information: Process ID: 0x1694 Process Name: C:\Windows\System32\svchost.exe
|
| | Security | Audit Success | 12544 | 2025-11-30 00:42:41 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4f8 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12548 | 2025-11-30 00:42:41 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12544 | 2025-11-30 00:43:13 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4f8 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-30 00:43:13 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4f8 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-30 00:43:13 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4f8 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-30 00:43:13 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4f8 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12548 | 2025-11-30 00:43:13 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-30 00:43:13 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-30 00:43:13 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-30 00:43:13 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12544 | 2025-11-30 00:43:14 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4f8 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12548 | 2025-11-30 00:43:14 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12544 | 2025-11-30 00:46:17 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4f8 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-30 00:46:17 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4f8 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12548 | 2025-11-30 00:46:17 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-30 00:46:17 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12544 | 2025-11-30 00:47:14 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4f8 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-30 00:47:14 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4f8 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12548 | 2025-11-30 00:47:14 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-30 00:47:14 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12544 | 2025-11-30 00:49:29 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4f8 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12545 | 2025-11-30 00:49:29 | | Microsoft-Windows-Security-Auditing | 4647: User initiated logoff: Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x6e225 This event is generated when a logoff is initiated. No further user-initiated activity can occur. This event can be interpreted as a logoff event.
|
| | Security | Audit Success | 12548 | 2025-11-30 00:49:29 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 103 | 2025-11-30 00:49:30 | | Microsoft-Windows-Eventlog | 1100: The event logging service has shut down.
|
| | Security | Audit Success | 13312 | 2025-11-30 00:49:35 | | Microsoft-Windows-Security-Auditing | 4688: A new process has been created. Creator Subject: Security ID: S-1-5-18 Account Name: - Account Domain: - Logon ID: 0x3e7 Target Subject: Security ID: S-1-0-0 Account Name: - Account Domain: - Logon ID: 0x0 Process Information: New Process ID: 0x110 New Process Name: R Token Elevation Type: %%1936 Mandatory Label: S-1-16-16384 Creator Process ID: 0x4 Creator Process Name: Process Command Line: Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
|
| | Security | Audit Success | 13312 | 2025-11-30 00:49:35 | | Microsoft-Windows-Security-Auditing | 4696: A primary token was assigned to process. Subject: Security ID: S-1-5-18 Account Name: - Account Domain: - Logon ID: 0x3e7 Process Information: Process ID: 0x4 Process Name: Target Process: Target Process ID: 0x110 Target Process Name: Registry New Token Information: Security ID: S-1-0-0 Account Name: - Account Domain: - Logon ID: 0x3e7
|
| | Security | Audit Success | 13312 | 2025-11-30 00:49:35 | | Microsoft-Windows-Security-Auditing | 4688: A new process has been created. Creator Subject: Security ID: S-1-5-18 Account Name: - Account Domain: - Logon ID: 0x3e7 Target Subject: Security ID: S-1-0-0 Account Name: - Account Domain: - Logon ID: 0x0 Process Information: New Process ID: 0x2cc New Process Name: C Token Elevation Type: %%1936 Mandatory Label: S-1-16-16384 Creator Process ID: 0x4 Creator Process Name: Process Command Line: Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
|
| | Security | Audit Success | 13573 | 2025-11-30 00:49:35 | | Microsoft-Windows-Security-Auditing | 4826: Boot Configuration Data loaded. Subject: Security ID: S-1-5-18 Account Name: - Account Domain: - Logon ID: 0x3e7 General Settings: Load Options: - Advanced Options: %%1843 Configuration Access Policy: %%1846 System Event Logging: %%1843 Kernel Debugging: %%1843 VSM Launch Type: %%1848 Signature Settings: Test Signing: %%1843 Flight Signing: %%1843 Disable Integrity Checks: %%1843 HyperVisor Settings: HyperVisor Load Options: - HyperVisor Launch Type: %%1848 HyperVisor Debugging: %%1843
|
| | Security | Audit Success | 13312 | 2025-11-30 00:49:37 | | Microsoft-Windows-Security-Auditing | 4688: A new process has been created. Creator Subject: Security ID: S-1-5-18 Account Name: - Account Domain: - Logon ID: 0x3e7 Target Subject: Security ID: S-1-0-0 Account Name: - Account Domain: - Logon ID: 0x0 Process Information: New Process ID: 0x2ec New Process Name: C Token Elevation Type: %%1936 Mandatory Label: S-1-16-16384 Creator Process ID: 0x2cc Creator Process Name: C Process Command Line: Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
|
| | Security | Audit Success | 13312 | 2025-11-30 00:49:42 | | Microsoft-Windows-Security-Auditing | 4688: A new process has been created. Creator Subject: Security ID: S-1-5-18 Account Name: - Account Domain: - Logon ID: 0x3e7 Target Subject: Security ID: S-1-0-0 Account Name: - Account Domain: - Logon ID: 0x0 Process Information: New Process ID: 0x35c New Process Name: C Token Elevation Type: %%1936 Mandatory Label: S-1-16-16384 Creator Process ID: 0x2cc Creator Process Name: C Process Command Line: Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
|
| | Security | Audit Success | 13312 | 2025-11-30 00:49:43 | | Microsoft-Windows-Security-Auditing | 4688: A new process has been created. Creator Subject: Security ID: S-1-5-18 Account Name: - Account Domain: - Logon ID: 0x3e7 Target Subject: Security ID: S-1-0-0 Account Name: - Account Domain: - Logon ID: 0x0 Process Information: New Process ID: 0x394 New Process Name: C Token Elevation Type: %%1936 Mandatory Label: S-1-16-16384 Creator Process ID: 0x35c Creator Process Name: C Process Command Line: Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
|
| | Security | Audit Success | 12288 | 2025-11-30 00:49:46 | | Microsoft-Windows-Security-Auditing | 4608: Windows is starting up. This event is logged when LSASS.EXE starts and the auditing subsystem is initialized.
|
| | Security | Audit Success | 12290 | 2025-11-30 00:49:46 | | Microsoft-Windows-Security-Auditing | 6417: The FIPS mode crypto selftests succeeded. Process ID: 0x494 Process Name: C:\Windows\System32\lsass.exe
|
| | Security | Audit Success | 12544 | 2025-11-30 00:49:46 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-0-0 Account Name: - Account Domain: - Logon ID: 0x0 Logon Information: Logon Type: 0 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: - New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4 Process Name: Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: - Authentication Package: - Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-30 00:49:46 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x454 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-30 00:49:46 | | Microsoft-Windows-Security-Auditing | 4648: A logon was attempted using explicit credentials. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon GUID: {00000000-0000-0000-0000-000000000000} Account Whose Credentials Were Used: Account Name: UMFD-1 Account Domain: Font Driver Host Logon GUID: {00000000-0000-0000-0000-000000000000} Target Server: Target Server Name: localhost Additional Information: localhost Process Information: Process ID: 0x470 Process Name: C:\Windows\System32\winlogon.exe Network Information: Network Address: - Port: - This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
|
| | Security | Audit Success | 12544 | 2025-11-30 00:49:46 | | Microsoft-Windows-Security-Auditing | 4648: A logon was attempted using explicit credentials. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon GUID: {00000000-0000-0000-0000-000000000000} Account Whose Credentials Were Used: Account Name: UMFD-0 Account Domain: Font Driver Host Logon GUID: {00000000-0000-0000-0000-000000000000} Target Server: Target Server Name: localhost Additional Information: localhost Process Information: Process ID: 0x3cc Process Name: C:\Windows\System32\wininit.exe Network Information: Network Address: - Port: - This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
|
| | Security | Audit Success | 12544 | 2025-11-30 00:49:46 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 2 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1842 Elevated Token: %%1843 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-96-0-0 Account Name: UMFD-0 Account Domain: Font Driver Host Logon ID: 0x112a4 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x3cc Process Name: C:\Windows\System32\wininit.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-30 00:49:46 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 2 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1842 Elevated Token: %%1843 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-96-0-1 Account Name: UMFD-1 Account Domain: Font Driver Host Logon ID: 0x1128f Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x470 Process Name: C:\Windows\System32\winlogon.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-30 00:49:46 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-20 Account Name: NETWORK SERVICE Account Domain: NT AUTHORITY Logon ID: 0x3e4 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x454 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-30 00:49:46 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x454 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12548 | 2025-11-30 00:49:46 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-30 00:49:46 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-20 Account Name: NETWORK SERVICE Account Domain: NT AUTHORITY Logon ID: 0x3e4 Privileges: SeAssignPrimaryTokenPrivilege SeAuditPrivilege SeImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-30 00:49:46 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 13312 | 2025-11-30 00:49:46 | | Microsoft-Windows-Security-Auditing | 4688: A new process has been created. Creator Subject: Security ID: S-1-5-18 Account Name: - Account Domain: - Logon ID: 0x3e7 Target Subject: Security ID: S-1-0-0 Account Name: - Account Domain: - Logon ID: 0x0 Process Information: New Process ID: 0x324 New Process Name: C Token Elevation Type: %%1936 Mandatory Label: S-1-16-16384 Creator Process ID: 0x2cc Creator Process Name: C Process Command Line: Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
|
| | Security | Audit Success | 13312 | 2025-11-30 00:49:46 | | Microsoft-Windows-Security-Auditing | 4688: A new process has been created. Creator Subject: Security ID: S-1-5-18 Account Name: - Account Domain: - Logon ID: 0x3e7 Target Subject: Security ID: S-1-0-0 Account Name: - Account Domain: - Logon ID: 0x0 Process Information: New Process ID: 0x3cc New Process Name: C Token Elevation Type: %%1936 Mandatory Label: S-1-16-16384 Creator Process ID: 0x35c Creator Process Name: C Process Command Line: Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
|
| | Security | Audit Success | 13312 | 2025-11-30 00:49:46 | | Microsoft-Windows-Security-Auditing | 4688: A new process has been created. Creator Subject: Security ID: S-1-5-18 Account Name: - Account Domain: - Logon ID: 0x3e7 Target Subject: Security ID: S-1-0-0 Account Name: - Account Domain: - Logon ID: 0x0 Process Information: New Process ID: 0x408 New Process Name: C Token Elevation Type: %%1936 Mandatory Label: S-1-16-16384 Creator Process ID: 0x324 Creator Process Name: C Process Command Line: Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
|
| | Security | Audit Success | 13312 | 2025-11-30 00:49:46 | | Microsoft-Windows-Security-Auditing | 4688: A new process has been created. Creator Subject: Security ID: S-1-5-18 Account Name: - Account Domain: - Logon ID: 0x3e7 Target Subject: Security ID: S-1-0-0 Account Name: - Account Domain: - Logon ID: 0x0 Process Information: New Process ID: 0x454 New Process Name: C Token Elevation Type: %%1936 Mandatory Label: S-1-16-16384 Creator Process ID: 0x3cc Creator Process Name: C Process Command Line: Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
|
| | Security | Audit Success | 13312 | 2025-11-30 00:49:46 | | Microsoft-Windows-Security-Auditing | 4688: A new process has been created. Creator Subject: Security ID: S-1-5-18 Account Name: - Account Domain: - Logon ID: 0x3e7 Target Subject: Security ID: S-1-0-0 Account Name: - Account Domain: - Logon ID: 0x0 Process Information: New Process ID: 0x470 New Process Name: C Token Elevation Type: %%1936 Mandatory Label: S-1-16-16384 Creator Process ID: 0x324 Creator Process Name: C Process Command Line: Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
|
| | Security | Audit Success | 13312 | 2025-11-30 00:49:46 | | Microsoft-Windows-Security-Auditing | 4688: A new process has been created. Creator Subject: Security ID: S-1-5-18 Account Name: - Account Domain: - Logon ID: 0x3e7 Target Subject: Security ID: S-1-0-0 Account Name: - Account Domain: - Logon ID: 0x0 Process Information: New Process ID: 0x494 New Process Name: C Token Elevation Type: %%1936 Mandatory Label: S-1-16-16384 Creator Process ID: 0x3cc Creator Process Name: C Process Command Line: Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
|
| | Security | Audit Success | 13568 | 2025-11-30 00:49:46 | | Microsoft-Windows-Security-Auditing | 4902: The Per-user audit policy table was created. Number of Elements: 0 Policy ID: 0x10e61
|
| | Security | Audit Success | 12544 | 2025-11-30 00:49:47 | | Microsoft-Windows-Security-Auditing | 4648: A logon was attempted using explicit credentials. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon GUID: {00000000-0000-0000-0000-000000000000} Account Whose Credentials Were Used: Account Name: DWM-1 Account Domain: Window Manager Logon GUID: {00000000-0000-0000-0000-000000000000} Target Server: Target Server Name: localhost Additional Information: localhost Process Information: Process ID: 0x470 Process Name: C:\Windows\System32\winlogon.exe Network Information: Network Address: - Port: - This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
|
| | Security | Audit Success | 12544 | 2025-11-30 00:49:47 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 2 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1842 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-90-0-1 Account Name: DWM-1 Account Domain: Window Manager Logon ID: 0x1817a Linked Logon ID: 0x181c4 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x470 Process Name: C:\Windows\System32\winlogon.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-30 00:49:47 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 2 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1842 Elevated Token: %%1843 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-90-0-1 Account Name: DWM-1 Account Domain: Window Manager Logon ID: 0x181c4 Linked Logon ID: 0x1817a Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x470 Process Name: C:\Windows\System32\winlogon.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-30 00:49:47 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x454 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-30 00:49:47 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x454 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-30 00:49:47 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x454 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-30 00:49:47 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-19 Account Name: LOCAL SERVICE Account Domain: NT AUTHORITY Logon ID: 0x3e5 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x454 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-30 00:49:47 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x454 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-30 00:49:47 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x454 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-30 00:49:47 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x454 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-30 00:49:47 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x454 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-30 00:49:47 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x454 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-30 00:49:47 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x454 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-30 00:49:47 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x454 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-30 00:49:47 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x454 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-30 00:49:47 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x454 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-30 00:49:47 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x454 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-30 00:49:47 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x454 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-30 00:49:47 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x454 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12548 | 2025-11-30 00:49:47 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-90-0-1 Account Name: DWM-1 Account Domain: Window Manager Logon ID: 0x1817a Privileges: SeAssignPrimaryTokenPrivilege SeAuditPrivilege SeImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-30 00:49:47 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-90-0-1 Account Name: DWM-1 Account Domain: Window Manager Logon ID: 0x181c4 Privileges: SeAssignPrimaryTokenPrivilege SeAuditPrivilege
|
| | Security | Audit Success | 12548 | 2025-11-30 00:49:47 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-30 00:49:47 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-30 00:49:47 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-30 00:49:47 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-19 Account Name: LOCAL SERVICE Account Domain: NT AUTHORITY Logon ID: 0x3e5 Privileges: SeAssignPrimaryTokenPrivilege SeAuditPrivilege SeImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-30 00:49:47 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-30 00:49:47 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-30 00:49:47 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-30 00:49:47 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-30 00:49:47 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-30 00:49:47 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-30 00:49:47 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-30 00:49:47 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-30 00:49:47 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-30 00:49:47 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-30 00:49:47 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-30 00:49:47 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12544 | 2025-11-30 00:49:52 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x454 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-30 00:49:52 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x454 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-30 00:49:52 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x454 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-30 00:49:52 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x454 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12548 | 2025-11-30 00:49:52 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-30 00:49:52 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-30 00:49:52 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-30 00:49:52 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 13826 | 2025-11-30 00:49:52 | | Microsoft-Windows-Security-Auditing | 4799: A security-enabled local group membership was enumerated. Subject: Security ID: S-1-5-20 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e4 Group: Security ID: S-1-5-32-544 Group Name: Administrators Group Domain: Builtin Process Information: Process ID: 0x6a0 Process Name: C:\Windows\System32\svchost.exe
|
| | Security | Audit Success | 13826 | 2025-11-30 00:49:52 | | Microsoft-Windows-Security-Auditing | 4799: A security-enabled local group membership was enumerated. Subject: Security ID: S-1-5-20 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e4 Group: Security ID: S-1-5-32-551 Group Name: Backup Operators Group Domain: Builtin Process Information: Process ID: 0x6a0 Process Name: C:\Windows\System32\svchost.exe
|
| | Security | Audit Success | 12292 | 2025-11-30 00:49:53 | | Microsoft-Windows-Security-Auditing | 5033: The Windows Firewall Driver started successfully.
|
| | Security | Audit Success | 12544 | 2025-11-30 00:49:53 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x454 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-30 00:49:53 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x454 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-30 00:49:53 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x454 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-30 00:49:53 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x454 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-30 00:49:53 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x454 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-30 00:49:53 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x454 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-30 00:49:53 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x454 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-30 00:49:53 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x454 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12548 | 2025-11-30 00:49:53 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-30 00:49:53 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-30 00:49:53 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-30 00:49:53 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-30 00:49:53 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-30 00:49:53 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-30 00:49:53 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-30 00:49:53 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12288 | 2025-11-30 00:56:13 | | Microsoft-Windows-Security-Auditing | 4616: The system time was changed. Subject: Security ID: S-1-5-19 Account Name: LOCAL SERVICE Account Domain: NT AUTHORITY Logon ID: 0x3e5 Process Information: Process ID: 0xef8 Name: C:\Windows\System32\svchost.exe Previous Time: 2025-11-30T08:49:53.7861821Z New Time: 2025-11-30T08:56:13.7574716Z This event is generated when the system time is changed. It is normal for the Windows Time Service, which runs with System privilege, to change the system time on a regular basis. Other system time changes may be indicative of attempts to tamper with the computer.
|
| | Security | Audit Success | 12288 | 2025-11-30 00:56:13 | | Microsoft-Windows-Security-Auditing | 4616: The system time was changed. Subject: Security ID: S-1-5-19 Account Name: LOCAL SERVICE Account Domain: NT AUTHORITY Logon ID: 0x3e5 Process Information: Process ID: 0xef8 Name: C:\Windows\System32\svchost.exe Previous Time: 2025-11-30T08:56:13.7574716Z New Time: 2025-11-30T08:56:13.7581581Z This event is generated when the system time is changed. It is normal for the Windows Time Service, which runs with System privilege, to change the system time on a regular basis. Other system time changes may be indicative of attempts to tamper with the computer.
|
| | Security | Audit Success | 12544 | 2025-11-30 00:56:14 | | Microsoft-Windows-Security-Auditing | 4648: A logon was attempted using explicit credentials. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon GUID: {00000000-0000-0000-0000-000000000000} Account Whose Credentials Were Used: Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon GUID: {00000000-0000-0000-0000-000000000000} Target Server: Target Server Name: localhost Additional Information: localhost Process Information: Process ID: 0x8f0 Process Name: C:\Windows\System32\svchost.exe Network Information: Network Address: 127.0.0.1 Port: 0 This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
|
| | Security | Audit Success | 12544 | 2025-11-30 00:56:14 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 2 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x4153b Linked Logon ID: 0x41633 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x8f0 Process Name: C:\Windows\System32\svchost.exe Network Information: Workstation Name: DESKTOP-0JV7HJV Source Network Address: 127.0.0.1 Source Port: 0 Detailed Authentication Information: Logon Process: User32 Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-30 00:56:14 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 2 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1843 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x41633 Linked Logon ID: 0x4153b Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x8f0 Process Name: C:\Windows\System32\svchost.exe Network Information: Workstation Name: DESKTOP-0JV7HJV Source Network Address: 127.0.0.1 Source Port: 0 Detailed Authentication Information: Logon Process: User32 Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12548 | 2025-11-30 00:56:14 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x4153b Privileges: SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 13824 | 2025-11-30 00:56:14 | | Microsoft-Windows-Security-Auditing | 4798: A user's local group membership was enumerated. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 User: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Process Information: Process ID: 0x494 Process Name: C:\Windows\System32\lsass.exe
|
| | Security | Audit Success | 13826 | 2025-11-30 00:56:14 | | Microsoft-Windows-Security-Auditing | 4799: A security-enabled local group membership was enumerated. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Group: Security ID: S-1-5-32-544 Group Name: Administrators Group Domain: Builtin Process Information: Process ID: 0x7ac Process Name: C:\Windows\System32\svchost.exe
|
| | Security | Audit Success | 12288 | 2025-11-30 00:56:15 | | Microsoft-Windows-Security-Auditing | 4616: The system time was changed. Subject: Security ID: S-1-5-19 Account Name: LOCAL SERVICE Account Domain: NT AUTHORITY Logon ID: 0x3e5 Process Information: Process ID: 0xef8 Name: C:\Windows\System32\svchost.exe Previous Time: 2025-11-30T08:56:15.2212547Z New Time: 2025-11-30T08:56:15.2239968Z This event is generated when the system time is changed. It is normal for the Windows Time Service, which runs with System privilege, to change the system time on a regular basis. Other system time changes may be indicative of attempts to tamper with the computer.
|
| | Security | Audit Success | 12544 | 2025-11-30 00:56:16 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x454 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-30 00:56:16 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x454 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12548 | 2025-11-30 00:56:16 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-30 00:56:16 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12290 | 2025-11-30 00:56:17 | | Microsoft-Windows-Security-Auditing | 5061: Cryptographic operation. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x41633 Cryptographic Parameters: Provider Name: Microsoft Software Key Storage Provider Algorithm Name: ECDSA_P256 Key Name: Microsoft Connected Devices Platform device certificate Key Type: %%2500 Cryptographic Operation: Operation: %%2480 Return Code: 0x0
|
| | Security | Audit Success | 12290 | 2025-11-30 00:56:17 | | Microsoft-Windows-Security-Auditing | 5061: Cryptographic operation. Subject: Security ID: S-1-5-19 Account Name: LOCAL SERVICE Account Domain: NT AUTHORITY Logon ID: 0x3e5 Cryptographic Parameters: Provider Name: Microsoft Software Key Storage Provider Algorithm Name: ECDSA_P256 Key Name: Microsoft Connected Devices Platform device certificate Key Type: %%2500 Cryptographic Operation: Operation: %%2480 Return Code: 0x0
|
| | Security | Audit Success | 12292 | 2025-11-30 00:56:17 | | Microsoft-Windows-Security-Auditing | 5024: The Windows Firewall service started successfully.
|
| | Security | Audit Success | 12292 | 2025-11-30 00:56:17 | | Microsoft-Windows-Security-Auditing | 5058: Key file operation. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x41633 Process Information: Process ID: 4768 Process Creation Time: 2025-11-30T08:56:17.4101163Z Cryptographic Parameters: Provider Name: Microsoft Software Key Storage Provider Algorithm Name: UNKNOWN Key Name: Microsoft Connected Devices Platform device certificate Key Type: %%2500 Key File Operation Information: File Path: C:\Users\CogiArt\AppData\Roaming\Microsoft\Crypto\Keys\de7cf8a7901d2ad13e5c67c29e5d1662_9ee7012e-fa60-42be-b8b4-8dc8b4e1280d Operation: %%2458 Return Code: 0x0
|
| | Security | Audit Success | 12292 | 2025-11-30 00:56:17 | | Microsoft-Windows-Security-Auditing | 5059: Key migration operation. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x41633 Process Information: Process ID: 4768 Process Creation Time: 2025-11-30T08:56:17.4101163Z Cryptographic Parameters: Provider Name: Microsoft Software Key Storage Provider Algorithm Name: ECDSA_P256 Key Name: Microsoft Connected Devices Platform device certificate Key Type: %%2500 Additional Information: Operation: %%2464 Return Code: 0x0
|
| | Security | Audit Success | 12292 | 2025-11-30 00:56:17 | | Microsoft-Windows-Security-Auditing | 5058: Key file operation. Subject: Security ID: S-1-5-19 Account Name: LOCAL SERVICE Account Domain: NT AUTHORITY Logon ID: 0x3e5 Process Information: Process ID: 1216 Process Creation Time: 2025-11-30T08:56:17.7446723Z Cryptographic Parameters: Provider Name: Microsoft Software Key Storage Provider Algorithm Name: UNKNOWN Key Name: Microsoft Connected Devices Platform device certificate Key Type: %%2500 Key File Operation Information: File Path: C:\WINDOWS\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Crypto\Keys\de7cf8a7901d2ad13e5c67c29e5d1662_9ee7012e-fa60-42be-b8b4-8dc8b4e1280d Operation: %%2458 Return Code: 0x0
|
| | Security | Audit Success | 12292 | 2025-11-30 00:56:17 | | Microsoft-Windows-Security-Auditing | 5059: Key migration operation. Subject: Security ID: S-1-5-19 Account Name: LOCAL SERVICE Account Domain: NT AUTHORITY Logon ID: 0x3e5 Process Information: Process ID: 1216 Process Creation Time: 2025-11-30T08:56:17.7446723Z Cryptographic Parameters: Provider Name: Microsoft Software Key Storage Provider Algorithm Name: ECDSA_P256 Key Name: Microsoft Connected Devices Platform device certificate Key Type: %%2500 Additional Information: Operation: %%2464 Return Code: 0x0
|
| | Security | Audit Success | 12544 | 2025-11-30 00:56:17 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x454 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-30 00:56:17 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x454 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12548 | 2025-11-30 00:56:17 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-30 00:56:17 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12544 | 2025-11-30 00:56:18 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x454 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-30 00:56:18 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x454 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12548 | 2025-11-30 00:56:18 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-30 00:56:18 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 13824 | 2025-11-30 00:56:18 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-30 00:56:18 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-30 00:56:18 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-30 00:56:18 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-30 00:56:18 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-30 00:56:18 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-30 00:56:18 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x41633 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-30 00:56:18 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x41633 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-30 00:56:18 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x41633 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-30 00:56:18 | | Microsoft-Windows-Security-Auditing | 4798: A user's local group membership was enumerated. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 User: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Process Information: Process ID: 0x630 Process Name: C:\Windows\System32\LogonUI.exe
|
| | Security | Audit Success | 13824 | 2025-11-30 00:56:18 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-30 00:56:18 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-30 00:56:18 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-30 00:56:18 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-30 00:56:19 | | Microsoft-Windows-Security-Auditing | 4798: A user's local group membership was enumerated. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x41633 User: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Process Information: Process ID: 0x808 Process Name: C:\Windows\explorer.exe
|
| | Security | Audit Success | 12544 | 2025-11-30 00:56:20 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x454 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12548 | 2025-11-30 00:56:20 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 13824 | 2025-11-30 00:56:20 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x41633 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-30 00:56:20 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x41633 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-30 00:56:20 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x41633 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-30 00:56:20 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x41633 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-30 00:56:20 | | Microsoft-Windows-Security-Auditing | 4798: A user's local group membership was enumerated. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x4153b User: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Process Information: Process ID: 0x14f0 Process Name: C:\Program Files\AMD\CIM\Bin64\InstallManagerApp.exe
|
| | Security | Audit Success | 13826 | 2025-11-30 00:56:20 | | Microsoft-Windows-Security-Auditing | 4799: A security-enabled local group membership was enumerated. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Group: Security ID: S-1-5-32-544 Group Name: Administrators Group Domain: Builtin Process Information: Process ID: 0x19bc Process Name: C:\Windows\System32\SearchIndexer.exe
|
| | Security | Audit Success | 13826 | 2025-11-30 00:56:20 | | Microsoft-Windows-Security-Auditing | 4799: A security-enabled local group membership was enumerated. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Group: Security ID: S-1-5-32-551 Group Name: Backup Operators Group Domain: Builtin Process Information: Process ID: 0x19bc Process Name: C:\Windows\System32\SearchIndexer.exe
|
| | Security | Audit Success | 13824 | 2025-11-30 00:56:21 | | Microsoft-Windows-Security-Auditing | 4798: A user's local group membership was enumerated. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x41633 User: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Process Information: Process ID: 0x808 Process Name: C:\Windows\explorer.exe
|
| | Security | Audit Success | 12544 | 2025-11-30 00:56:23 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x454 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12548 | 2025-11-30 00:56:23 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12544 | 2025-11-30 00:56:29 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x454 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12548 | 2025-11-30 00:56:29 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 13826 | 2025-11-30 00:56:30 | | Microsoft-Windows-Security-Auditing | 4799: A security-enabled local group membership was enumerated. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Group: Security ID: S-1-5-32-544 Group Name: Administrators Group Domain: Builtin Process Information: Process ID: 0x1100 Process Name: C:\Windows\System32\svchost.exe
|
| | Security | Audit Success | 13826 | 2025-11-30 00:56:30 | | Microsoft-Windows-Security-Auditing | 4799: A security-enabled local group membership was enumerated. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Group: Security ID: S-1-5-32-551 Group Name: Backup Operators Group Domain: Builtin Process Information: Process ID: 0x1100 Process Name: C:\Windows\System32\svchost.exe
|
| | Security | Audit Success | 12544 | 2025-11-30 00:56:32 | | Microsoft-Windows-Security-Auditing | 4648: A logon was attempted using explicit credentials. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon GUID: {00000000-0000-0000-0000-000000000000} Account Whose Credentials Were Used: Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon GUID: {00000000-0000-0000-0000-000000000000} Target Server: Target Server Name: localhost Additional Information: localhost Process Information: Process ID: 0x8f0 Process Name: C:\Windows\System32\svchost.exe Network Information: Network Address: 127.0.0.1 Port: 0 This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
|
| | Security | Audit Success | 12544 | 2025-11-30 00:56:32 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 2 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x108ff4 Linked Logon ID: 0x10906e Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x8f0 Process Name: C:\Windows\System32\svchost.exe Network Information: Workstation Name: DESKTOP-0JV7HJV Source Network Address: 127.0.0.1 Source Port: 0 Detailed Authentication Information: Logon Process: User32 Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-30 00:56:32 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 2 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1843 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x10906e Linked Logon ID: 0x108ff4 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x8f0 Process Name: C:\Windows\System32\svchost.exe Network Information: Workstation Name: DESKTOP-0JV7HJV Source Network Address: 127.0.0.1 Source Port: 0 Detailed Authentication Information: Logon Process: User32 Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12545 | 2025-11-30 00:56:32 | | Microsoft-Windows-Security-Auditing | 4634: An account was logged off. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x10906e Logon Type: 2 This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
|
| | Security | Audit Success | 12545 | 2025-11-30 00:56:32 | | Microsoft-Windows-Security-Auditing | 4634: An account was logged off. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x108ff4 Logon Type: 2 This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
|
| | Security | Audit Success | 12548 | 2025-11-30 00:56:32 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x108ff4 Privileges: SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 13824 | 2025-11-30 00:56:32 | | Microsoft-Windows-Security-Auditing | 4798: A user's local group membership was enumerated. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 User: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Process Information: Process ID: 0x494 Process Name: C:\Windows\System32\lsass.exe
|
| | Security | Audit Success | 13824 | 2025-11-30 00:56:32 | | Microsoft-Windows-Security-Auditing | 4798: A user's local group membership was enumerated. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x4153b User: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Process Information: Process ID: 0x2990 Process Name: C:\Program Files\AMD\CIM\Bin64\InstallManagerApp.exe
|
| | Security | Audit Success | 12544 | 2025-11-30 00:56:47 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x454 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12548 | 2025-11-30 00:56:47 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12544 | 2025-11-30 00:57:12 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x454 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12548 | 2025-11-30 00:57:12 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12544 | 2025-11-30 00:58:09 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x454 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12548 | 2025-11-30 00:58:09 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12544 | 2025-11-30 00:58:17 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x454 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-30 00:58:17 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x454 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12548 | 2025-11-30 00:58:17 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-30 00:58:17 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12544 | 2025-11-30 00:58:18 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x454 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-30 00:58:18 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x454 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-30 00:58:18 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x454 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-30 00:58:18 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x454 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12548 | 2025-11-30 00:58:18 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-30 00:58:18 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-30 00:58:18 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-30 00:58:18 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12544 | 2025-11-30 01:00:13 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x454 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12545 | 2025-11-30 01:00:13 | | Microsoft-Windows-Security-Auditing | 4647: User initiated logoff: Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x41633 This event is generated when a logoff is initiated. No further user-initiated activity can occur. This event can be interpreted as a logoff event.
|
| | Security | Audit Success | 12548 | 2025-11-30 01:00:13 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 103 | 2025-11-30 01:00:15 | | Microsoft-Windows-Eventlog | 1100: The event logging service has shut down.
|
| | Security | Audit Success | 13312 | 2025-11-30 01:00:20 | | Microsoft-Windows-Security-Auditing | 4688: A new process has been created. Creator Subject: Security ID: S-1-5-18 Account Name: - Account Domain: - Logon ID: 0x3e7 Target Subject: Security ID: S-1-0-0 Account Name: - Account Domain: - Logon ID: 0x0 Process Information: New Process ID: 0x110 New Process Name: R Token Elevation Type: %%1936 Mandatory Label: S-1-16-16384 Creator Process ID: 0x4 Creator Process Name: Process Command Line: Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
|
| | Security | Audit Success | 13312 | 2025-11-30 01:00:20 | | Microsoft-Windows-Security-Auditing | 4696: A primary token was assigned to process. Subject: Security ID: S-1-5-18 Account Name: - Account Domain: - Logon ID: 0x3e7 Process Information: Process ID: 0x4 Process Name: Target Process: Target Process ID: 0x110 Target Process Name: Registry New Token Information: Security ID: S-1-0-0 Account Name: - Account Domain: - Logon ID: 0x3e7
|
| | Security | Audit Success | 13312 | 2025-11-30 01:00:20 | | Microsoft-Windows-Security-Auditing | 4688: A new process has been created. Creator Subject: Security ID: S-1-5-18 Account Name: - Account Domain: - Logon ID: 0x3e7 Target Subject: Security ID: S-1-0-0 Account Name: - Account Domain: - Logon ID: 0x0 Process Information: New Process ID: 0x2d4 New Process Name: C Token Elevation Type: %%1936 Mandatory Label: S-1-16-16384 Creator Process ID: 0x4 Creator Process Name: Process Command Line: Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
|
| | Security | Audit Success | 13573 | 2025-11-30 01:00:20 | | Microsoft-Windows-Security-Auditing | 4826: Boot Configuration Data loaded. Subject: Security ID: S-1-5-18 Account Name: - Account Domain: - Logon ID: 0x3e7 General Settings: Load Options: - Advanced Options: %%1843 Configuration Access Policy: %%1846 System Event Logging: %%1843 Kernel Debugging: %%1843 VSM Launch Type: %%1848 Signature Settings: Test Signing: %%1843 Flight Signing: %%1843 Disable Integrity Checks: %%1843 HyperVisor Settings: HyperVisor Load Options: - HyperVisor Launch Type: %%1848 HyperVisor Debugging: %%1843
|
| | Security | Audit Success | 13312 | 2025-11-30 01:00:21 | | Microsoft-Windows-Security-Auditing | 4688: A new process has been created. Creator Subject: Security ID: S-1-5-18 Account Name: - Account Domain: - Logon ID: 0x3e7 Target Subject: Security ID: S-1-0-0 Account Name: - Account Domain: - Logon ID: 0x0 Process Information: New Process ID: 0x2f0 New Process Name: C Token Elevation Type: %%1936 Mandatory Label: S-1-16-16384 Creator Process ID: 0x2d4 Creator Process Name: C Process Command Line: Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
|
| | Security | Audit Success | 13312 | 2025-11-30 01:00:21 | | Microsoft-Windows-Security-Auditing | 4688: A new process has been created. Creator Subject: Security ID: S-1-5-18 Account Name: - Account Domain: - Logon ID: 0x3e7 Target Subject: Security ID: S-1-0-0 Account Name: - Account Domain: - Logon ID: 0x0 Process Information: New Process ID: 0x344 New Process Name: C Token Elevation Type: %%1936 Mandatory Label: S-1-16-16384 Creator Process ID: 0x2d4 Creator Process Name: C Process Command Line: Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
|
| | Security | Audit Success | 13312 | 2025-11-30 01:00:23 | | Microsoft-Windows-Security-Auditing | 4688: A new process has been created. Creator Subject: Security ID: S-1-5-18 Account Name: - Account Domain: - Logon ID: 0x3e7 Target Subject: Security ID: S-1-0-0 Account Name: - Account Domain: - Logon ID: 0x0 Process Information: New Process ID: 0x390 New Process Name: C Token Elevation Type: %%1936 Mandatory Label: S-1-16-16384 Creator Process ID: 0x344 Creator Process Name: C Process Command Line: Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
|
| | Security | Audit Success | 13312 | 2025-11-30 01:00:25 | | Microsoft-Windows-Security-Auditing | 4688: A new process has been created. Creator Subject: Security ID: S-1-5-18 Account Name: - Account Domain: - Logon ID: 0x3e7 Target Subject: Security ID: S-1-0-0 Account Name: - Account Domain: - Logon ID: 0x0 Process Information: New Process ID: 0x3b0 New Process Name: C Token Elevation Type: %%1936 Mandatory Label: S-1-16-16384 Creator Process ID: 0x2d4 Creator Process Name: C Process Command Line: Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
|
| | Security | Audit Success | 13312 | 2025-11-30 01:00:25 | | Microsoft-Windows-Security-Auditing | 4688: A new process has been created. Creator Subject: Security ID: S-1-5-18 Account Name: - Account Domain: - Logon ID: 0x3e7 Target Subject: Security ID: S-1-0-0 Account Name: - Account Domain: - Logon ID: 0x0 Process Information: New Process ID: 0x8 New Process Name: C Token Elevation Type: %%1936 Mandatory Label: S-1-16-16384 Creator Process ID: 0x344 Creator Process Name: C Process Command Line: Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
|
| | Security | Audit Success | 13312 | 2025-11-30 01:00:25 | | Microsoft-Windows-Security-Auditing | 4688: A new process has been created. Creator Subject: Security ID: S-1-5-18 Account Name: - Account Domain: - Logon ID: 0x3e7 Target Subject: Security ID: S-1-0-0 Account Name: - Account Domain: - Logon ID: 0x0 Process Information: New Process ID: 0x408 New Process Name: C Token Elevation Type: %%1936 Mandatory Label: S-1-16-16384 Creator Process ID: 0x3b0 Creator Process Name: C Process Command Line: Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
|
| | Security | Audit Success | 12288 | 2025-11-30 01:00:26 | | Microsoft-Windows-Security-Auditing | 4608: Windows is starting up. This event is logged when LSASS.EXE starts and the auditing subsystem is initialized.
|
| | Security | Audit Success | 12290 | 2025-11-30 01:00:26 | | Microsoft-Windows-Security-Auditing | 6417: The FIPS mode crypto selftests succeeded. Process ID: 0x494 Process Name: C:\Windows\System32\lsass.exe
|
| | Security | Audit Success | 12544 | 2025-11-30 01:00:26 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-0-0 Account Name: - Account Domain: - Logon ID: 0x0 Logon Information: Logon Type: 0 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: - New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4 Process Name: Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: - Authentication Package: - Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-30 01:00:26 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x454 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-30 01:00:26 | | Microsoft-Windows-Security-Auditing | 4648: A logon was attempted using explicit credentials. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon GUID: {00000000-0000-0000-0000-000000000000} Account Whose Credentials Were Used: Account Name: UMFD-0 Account Domain: Font Driver Host Logon GUID: {00000000-0000-0000-0000-000000000000} Target Server: Target Server Name: localhost Additional Information: localhost Process Information: Process ID: 0x8 Process Name: C:\Windows\System32\wininit.exe Network Information: Network Address: - Port: - This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
|
| | Security | Audit Success | 12544 | 2025-11-30 01:00:26 | | Microsoft-Windows-Security-Auditing | 4648: A logon was attempted using explicit credentials. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon GUID: {00000000-0000-0000-0000-000000000000} Account Whose Credentials Were Used: Account Name: UMFD-1 Account Domain: Font Driver Host Logon GUID: {00000000-0000-0000-0000-000000000000} Target Server: Target Server Name: localhost Additional Information: localhost Process Information: Process ID: 0x470 Process Name: C:\Windows\System32\winlogon.exe Network Information: Network Address: - Port: - This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
|
| | Security | Audit Success | 12544 | 2025-11-30 01:00:26 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 2 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1842 Elevated Token: %%1843 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-96-0-0 Account Name: UMFD-0 Account Domain: Font Driver Host Logon ID: 0xfb40 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x8 Process Name: C:\Windows\System32\wininit.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-30 01:00:26 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 2 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1842 Elevated Token: %%1843 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-96-0-1 Account Name: UMFD-1 Account Domain: Font Driver Host Logon ID: 0xfb45 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x470 Process Name: C:\Windows\System32\winlogon.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-30 01:00:26 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-20 Account Name: NETWORK SERVICE Account Domain: NT AUTHORITY Logon ID: 0x3e4 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x454 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12548 | 2025-11-30 01:00:26 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-30 01:00:26 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-20 Account Name: NETWORK SERVICE Account Domain: NT AUTHORITY Logon ID: 0x3e4 Privileges: SeAssignPrimaryTokenPrivilege SeAuditPrivilege SeImpersonatePrivilege
|
| | Security | Audit Success | 13312 | 2025-11-30 01:00:26 | | Microsoft-Windows-Security-Auditing | 4688: A new process has been created. Creator Subject: Security ID: S-1-5-18 Account Name: - Account Domain: - Logon ID: 0x3e7 Target Subject: Security ID: S-1-0-0 Account Name: - Account Domain: - Logon ID: 0x0 Process Information: New Process ID: 0x454 New Process Name: C Token Elevation Type: %%1936 Mandatory Label: S-1-16-16384 Creator Process ID: 0x8 Creator Process Name: C Process Command Line: Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
|
| | Security | Audit Success | 13312 | 2025-11-30 01:00:26 | | Microsoft-Windows-Security-Auditing | 4688: A new process has been created. Creator Subject: Security ID: S-1-5-18 Account Name: - Account Domain: - Logon ID: 0x3e7 Target Subject: Security ID: S-1-0-0 Account Name: - Account Domain: - Logon ID: 0x0 Process Information: New Process ID: 0x470 New Process Name: C Token Elevation Type: %%1936 Mandatory Label: S-1-16-16384 Creator Process ID: 0x3b0 Creator Process Name: C Process Command Line: Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
|
| | Security | Audit Success | 13312 | 2025-11-30 01:00:26 | | Microsoft-Windows-Security-Auditing | 4688: A new process has been created. Creator Subject: Security ID: S-1-5-18 Account Name: - Account Domain: - Logon ID: 0x3e7 Target Subject: Security ID: S-1-0-0 Account Name: - Account Domain: - Logon ID: 0x0 Process Information: New Process ID: 0x494 New Process Name: C Token Elevation Type: %%1936 Mandatory Label: S-1-16-16384 Creator Process ID: 0x8 Creator Process Name: C Process Command Line: Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
|
| | Security | Audit Success | 13568 | 2025-11-30 01:00:26 | | Microsoft-Windows-Security-Auditing | 4902: The Per-user audit policy table was created. Number of Elements: 0 Policy ID: 0xf711
|
| | Security | Audit Success | 12544 | 2025-11-30 01:00:27 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x454 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-30 01:00:27 | | Microsoft-Windows-Security-Auditing | 4648: A logon was attempted using explicit credentials. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon GUID: {00000000-0000-0000-0000-000000000000} Account Whose Credentials Were Used: Account Name: DWM-1 Account Domain: Window Manager Logon GUID: {00000000-0000-0000-0000-000000000000} Target Server: Target Server Name: localhost Additional Information: localhost Process Information: Process ID: 0x470 Process Name: C:\Windows\System32\winlogon.exe Network Information: Network Address: - Port: - This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
|
| | Security | Audit Success | 12544 | 2025-11-30 01:00:27 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 2 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1842 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-90-0-1 Account Name: DWM-1 Account Domain: Window Manager Logon ID: 0x16988 Linked Logon ID: 0x169c7 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x470 Process Name: C:\Windows\System32\winlogon.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-30 01:00:27 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 2 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1842 Elevated Token: %%1843 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-90-0-1 Account Name: DWM-1 Account Domain: Window Manager Logon ID: 0x169c7 Linked Logon ID: 0x16988 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x470 Process Name: C:\Windows\System32\winlogon.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-30 01:00:27 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x454 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-30 01:00:27 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x454 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-30 01:00:27 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-19 Account Name: LOCAL SERVICE Account Domain: NT AUTHORITY Logon ID: 0x3e5 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x454 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-30 01:00:27 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x454 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-30 01:00:27 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x454 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-30 01:00:27 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x454 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-30 01:00:27 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x454 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-30 01:00:27 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x454 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-30 01:00:27 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x454 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-30 01:00:27 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x454 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-30 01:00:27 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x454 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12548 | 2025-11-30 01:00:27 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-30 01:00:27 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-90-0-1 Account Name: DWM-1 Account Domain: Window Manager Logon ID: 0x16988 Privileges: SeAssignPrimaryTokenPrivilege SeAuditPrivilege SeImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-30 01:00:27 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-90-0-1 Account Name: DWM-1 Account Domain: Window Manager Logon ID: 0x169c7 Privileges: SeAssignPrimaryTokenPrivilege SeAuditPrivilege
|
| | Security | Audit Success | 12548 | 2025-11-30 01:00:27 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-30 01:00:27 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-30 01:00:27 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-19 Account Name: LOCAL SERVICE Account Domain: NT AUTHORITY Logon ID: 0x3e5 Privileges: SeAssignPrimaryTokenPrivilege SeAuditPrivilege SeImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-30 01:00:27 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-30 01:00:27 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-30 01:00:27 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-30 01:00:27 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-30 01:00:27 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-30 01:00:27 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-30 01:00:27 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-30 01:00:27 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12292 | 2025-11-30 01:00:28 | | Microsoft-Windows-Security-Auditing | 5033: The Windows Firewall Driver started successfully.
|
| | Security | Audit Success | 12544 | 2025-11-30 01:00:28 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x454 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-30 01:00:28 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x454 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-30 01:00:28 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x454 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-30 01:00:28 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x454 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-30 01:00:28 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x454 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-30 01:00:28 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x454 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-30 01:00:28 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x454 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-30 01:00:28 | | Microsoft-Windows-Security-Auditing | 4648: A logon was attempted using explicit credentials. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon GUID: {00000000-0000-0000-0000-000000000000} Account Whose Credentials Were Used: Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon GUID: {00000000-0000-0000-0000-000000000000} Target Server: Target Server Name: localhost Additional Information: localhost Process Information: Process ID: 0x8b0 Process Name: C:\Windows\System32\svchost.exe Network Information: Network Address: 127.0.0.1 Port: 0 This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
|
| | Security | Audit Success | 12544 | 2025-11-30 01:00:28 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 2 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x2ae62 Linked Logon ID: 0x2b205 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x8b0 Process Name: C:\Windows\System32\svchost.exe Network Information: Workstation Name: DESKTOP-0JV7HJV Source Network Address: 127.0.0.1 Source Port: 0 Detailed Authentication Information: Logon Process: User32 Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-30 01:00:28 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 2 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1843 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x2b205 Linked Logon ID: 0x2ae62 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x8b0 Process Name: C:\Windows\System32\svchost.exe Network Information: Workstation Name: DESKTOP-0JV7HJV Source Network Address: 127.0.0.1 Source Port: 0 Detailed Authentication Information: Logon Process: User32 Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-30 01:00:28 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x454 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12548 | 2025-11-30 01:00:28 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-30 01:00:28 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-30 01:00:28 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-30 01:00:28 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-30 01:00:28 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-30 01:00:28 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-30 01:00:28 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-30 01:00:28 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x2ae62 Privileges: SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-30 01:00:28 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 13824 | 2025-11-30 01:00:28 | | Microsoft-Windows-Security-Auditing | 4798: A user's local group membership was enumerated. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 User: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Process Information: Process ID: 0x494 Process Name: C:\Windows\System32\lsass.exe
|
| | Security | Audit Success | 13826 | 2025-11-30 01:00:28 | | Microsoft-Windows-Security-Auditing | 4799: A security-enabled local group membership was enumerated. Subject: Security ID: S-1-5-20 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e4 Group: Security ID: S-1-5-32-544 Group Name: Administrators Group Domain: Builtin Process Information: Process ID: 0x6cc Process Name: C:\Windows\System32\svchost.exe
|
| | Security | Audit Success | 13826 | 2025-11-30 01:00:28 | | Microsoft-Windows-Security-Auditing | 4799: A security-enabled local group membership was enumerated. Subject: Security ID: S-1-5-20 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e4 Group: Security ID: S-1-5-32-551 Group Name: Backup Operators Group Domain: Builtin Process Information: Process ID: 0x6cc Process Name: C:\Windows\System32\svchost.exe
|
| | Security | Audit Success | 12288 | 2025-11-30 01:01:09 | | Microsoft-Windows-Security-Auditing | 4616: The system time was changed. Subject: Security ID: S-1-5-19 Account Name: LOCAL SERVICE Account Domain: NT AUTHORITY Logon ID: 0x3e5 Process Information: Process ID: 0xf38 Name: C:\Windows\System32\svchost.exe Previous Time: 2025-11-30T09:00:28.7323699Z New Time: 2025-11-30T09:01:09.8556449Z This event is generated when the system time is changed. It is normal for the Windows Time Service, which runs with System privilege, to change the system time on a regular basis. Other system time changes may be indicative of attempts to tamper with the computer.
|
| | Security | Audit Success | 12288 | 2025-11-30 01:01:09 | | Microsoft-Windows-Security-Auditing | 4616: The system time was changed. Subject: Security ID: S-1-5-19 Account Name: LOCAL SERVICE Account Domain: NT AUTHORITY Logon ID: 0x3e5 Process Information: Process ID: 0xf38 Name: C:\Windows\System32\svchost.exe Previous Time: 2025-11-30T09:01:09.8556449Z New Time: 2025-11-30T09:01:09.8565743Z This event is generated when the system time is changed. It is normal for the Windows Time Service, which runs with System privilege, to change the system time on a regular basis. Other system time changes may be indicative of attempts to tamper with the computer.
|
| | Security | Audit Success | 12544 | 2025-11-30 01:01:09 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x454 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-30 01:01:09 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x454 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-30 01:01:09 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x454 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-30 01:01:09 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x454 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-30 01:01:09 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x454 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-30 01:01:09 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x454 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-30 01:01:09 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x454 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12548 | 2025-11-30 01:01:09 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-30 01:01:09 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-30 01:01:09 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-30 01:01:09 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-30 01:01:09 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-30 01:01:09 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-30 01:01:09 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12544 | 2025-11-30 01:01:10 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x454 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12548 | 2025-11-30 01:01:10 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 13826 | 2025-11-30 01:01:10 | | Microsoft-Windows-Security-Auditing | 4799: A security-enabled local group membership was enumerated. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Group: Security ID: S-1-5-32-544 Group Name: Administrators Group Domain: Builtin Process Information: Process ID: 0x2c4 Process Name: C:\Windows\System32\svchost.exe
|
| | Security | Audit Success | 12288 | 2025-11-30 01:01:11 | | Microsoft-Windows-Security-Auditing | 4616: The system time was changed. Subject: Security ID: S-1-5-19 Account Name: LOCAL SERVICE Account Domain: NT AUTHORITY Logon ID: 0x3e5 Process Information: Process ID: 0xf38 Name: C:\Windows\System32\svchost.exe Previous Time: 2025-11-30T09:01:10.9994542Z New Time: 2025-11-30T09:01:11.0029536Z This event is generated when the system time is changed. It is normal for the Windows Time Service, which runs with System privilege, to change the system time on a regular basis. Other system time changes may be indicative of attempts to tamper with the computer.
|
| | Security | Audit Success | 12292 | 2025-11-30 01:01:13 | | Microsoft-Windows-Security-Auditing | 5024: The Windows Firewall service started successfully.
|
| | Security | Audit Success | 12544 | 2025-11-30 01:01:13 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x454 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-30 01:01:13 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x454 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-30 01:01:13 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x454 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-30 01:01:13 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x454 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12548 | 2025-11-30 01:01:13 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-30 01:01:13 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-30 01:01:13 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-30 01:01:13 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12290 | 2025-11-30 01:01:14 | | Microsoft-Windows-Security-Auditing | 5061: Cryptographic operation. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x2b205 Cryptographic Parameters: Provider Name: Microsoft Software Key Storage Provider Algorithm Name: ECDSA_P256 Key Name: Microsoft Connected Devices Platform device certificate Key Type: %%2500 Cryptographic Operation: Operation: %%2480 Return Code: 0x0
|
| | Security | Audit Success | 12290 | 2025-11-30 01:01:14 | | Microsoft-Windows-Security-Auditing | 5061: Cryptographic operation. Subject: Security ID: S-1-5-19 Account Name: LOCAL SERVICE Account Domain: NT AUTHORITY Logon ID: 0x3e5 Cryptographic Parameters: Provider Name: Microsoft Software Key Storage Provider Algorithm Name: ECDSA_P256 Key Name: Microsoft Connected Devices Platform device certificate Key Type: %%2500 Cryptographic Operation: Operation: %%2480 Return Code: 0x0
|
| | Security | Audit Success | 12292 | 2025-11-30 01:01:14 | | Microsoft-Windows-Security-Auditing | 5058: Key file operation. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x2b205 Process Information: Process ID: 4168 Process Creation Time: 2025-11-30T09:01:13.8704751Z Cryptographic Parameters: Provider Name: Microsoft Software Key Storage Provider Algorithm Name: UNKNOWN Key Name: Microsoft Connected Devices Platform device certificate Key Type: %%2500 Key File Operation Information: File Path: C:\Users\CogiArt\AppData\Roaming\Microsoft\Crypto\Keys\de7cf8a7901d2ad13e5c67c29e5d1662_9ee7012e-fa60-42be-b8b4-8dc8b4e1280d Operation: %%2458 Return Code: 0x0
|
| | Security | Audit Success | 12292 | 2025-11-30 01:01:14 | | Microsoft-Windows-Security-Auditing | 5059: Key migration operation. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x2b205 Process Information: Process ID: 4168 Process Creation Time: 2025-11-30T09:01:13.8704751Z Cryptographic Parameters: Provider Name: Microsoft Software Key Storage Provider Algorithm Name: ECDSA_P256 Key Name: Microsoft Connected Devices Platform device certificate Key Type: %%2500 Additional Information: Operation: %%2464 Return Code: 0x0
|
| | Security | Audit Success | 12292 | 2025-11-30 01:01:14 | | Microsoft-Windows-Security-Auditing | 5058: Key file operation. Subject: Security ID: S-1-5-19 Account Name: LOCAL SERVICE Account Domain: NT AUTHORITY Logon ID: 0x3e5 Process Information: Process ID: 5564 Process Creation Time: 2025-11-30T09:01:14.2159177Z Cryptographic Parameters: Provider Name: Microsoft Software Key Storage Provider Algorithm Name: UNKNOWN Key Name: Microsoft Connected Devices Platform device certificate Key Type: %%2500 Key File Operation Information: File Path: C:\WINDOWS\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Crypto\Keys\de7cf8a7901d2ad13e5c67c29e5d1662_9ee7012e-fa60-42be-b8b4-8dc8b4e1280d Operation: %%2458 Return Code: 0x0
|
| | Security | Audit Success | 12292 | 2025-11-30 01:01:14 | | Microsoft-Windows-Security-Auditing | 5059: Key migration operation. Subject: Security ID: S-1-5-19 Account Name: LOCAL SERVICE Account Domain: NT AUTHORITY Logon ID: 0x3e5 Process Information: Process ID: 5564 Process Creation Time: 2025-11-30T09:01:14.2159177Z Cryptographic Parameters: Provider Name: Microsoft Software Key Storage Provider Algorithm Name: ECDSA_P256 Key Name: Microsoft Connected Devices Platform device certificate Key Type: %%2500 Additional Information: Operation: %%2464 Return Code: 0x0
|
| | Security | Audit Success | 12544 | 2025-11-30 01:01:14 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x454 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12548 | 2025-11-30 01:01:14 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 13824 | 2025-11-30 01:01:15 | | Microsoft-Windows-Security-Auditing | 4798: A user's local group membership was enumerated. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 User: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Process Information: Process ID: 0x62c Process Name: C:\Windows\System32\LogonUI.exe
|
| | Security | Audit Success | 12544 | 2025-11-30 01:01:16 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x454 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-30 01:01:16 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x454 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12548 | 2025-11-30 01:01:16 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-30 01:01:16 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 13824 | 2025-11-30 01:01:16 | | Microsoft-Windows-Security-Auditing | 4798: A user's local group membership was enumerated. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x2b205 User: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Process Information: Process ID: 0x1684 Process Name: C:\Windows\explorer.exe
|
| | Security | Audit Success | 13824 | 2025-11-30 01:01:17 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-30 01:01:17 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-30 01:01:17 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-30 01:01:17 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x2b205 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-30 01:01:17 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x2b205 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-30 01:01:17 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x2b205 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-30 01:01:17 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x2b205 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-30 01:01:17 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x2b205 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-30 01:01:17 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x2b205 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-30 01:01:17 | | Microsoft-Windows-Security-Auditing | 4798: A user's local group membership was enumerated. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x2ae62 User: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Process Information: Process ID: 0x142c Process Name: C:\Program Files\AMD\CIM\Bin64\InstallManagerApp.exe
|
| | Security | Audit Success | 13824 | 2025-11-30 01:01:17 | | Microsoft-Windows-Security-Auditing | 4798: A user's local group membership was enumerated. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x2b205 User: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Process Information: Process ID: 0x1684 Process Name: C:\Windows\explorer.exe
|
| | Security | Audit Success | 13824 | 2025-11-30 01:01:17 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x2b205 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13826 | 2025-11-30 01:01:17 | | Microsoft-Windows-Security-Auditing | 4799: A security-enabled local group membership was enumerated. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Group: Security ID: S-1-5-32-544 Group Name: Administrators Group Domain: Builtin Process Information: Process ID: 0x1b90 Process Name: C:\Windows\System32\SearchIndexer.exe
|
| | Security | Audit Success | 13826 | 2025-11-30 01:01:17 | | Microsoft-Windows-Security-Auditing | 4799: A security-enabled local group membership was enumerated. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Group: Security ID: S-1-5-32-551 Group Name: Backup Operators Group Domain: Builtin Process Information: Process ID: 0x1b90 Process Name: C:\Windows\System32\SearchIndexer.exe
|
| | Security | Audit Success | 12544 | 2025-11-30 01:01:18 | | Microsoft-Windows-Security-Auditing | 4648: A logon was attempted using explicit credentials. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon GUID: {00000000-0000-0000-0000-000000000000} Account Whose Credentials Were Used: Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon GUID: {00000000-0000-0000-0000-000000000000} Target Server: Target Server Name: localhost Additional Information: localhost Process Information: Process ID: 0x8b0 Process Name: C:\Windows\System32\svchost.exe Network Information: Network Address: 127.0.0.1 Port: 0 This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
|
| | Security | Audit Success | 12544 | 2025-11-30 01:01:18 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 2 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0xa712b Linked Logon ID: 0xa7395 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x8b0 Process Name: C:\Windows\System32\svchost.exe Network Information: Workstation Name: DESKTOP-0JV7HJV Source Network Address: 127.0.0.1 Source Port: 0 Detailed Authentication Information: Logon Process: User32 Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-30 01:01:18 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 2 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1843 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0xa7395 Linked Logon ID: 0xa712b Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x8b0 Process Name: C:\Windows\System32\svchost.exe Network Information: Workstation Name: DESKTOP-0JV7HJV Source Network Address: 127.0.0.1 Source Port: 0 Detailed Authentication Information: Logon Process: User32 Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12545 | 2025-11-30 01:01:18 | | Microsoft-Windows-Security-Auditing | 4634: An account was logged off. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0xa7395 Logon Type: 2 This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
|
| | Security | Audit Success | 12545 | 2025-11-30 01:01:18 | | Microsoft-Windows-Security-Auditing | 4634: An account was logged off. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0xa712b Logon Type: 2 This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
|
| | Security | Audit Success | 12548 | 2025-11-30 01:01:18 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0xa712b Privileges: SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 13824 | 2025-11-30 01:01:18 | | Microsoft-Windows-Security-Auditing | 4798: A user's local group membership was enumerated. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 User: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Process Information: Process ID: 0x494 Process Name: C:\Windows\System32\lsass.exe
|
| | Security | Audit Success | 13824 | 2025-11-30 01:01:18 | | Microsoft-Windows-Security-Auditing | 4798: A user's local group membership was enumerated. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x2ae62 User: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Process Information: Process ID: 0x1ef4 Process Name: C:\Program Files\AMD\CIM\Bin64\InstallManagerApp.exe
|
| | Security | Audit Success | 12544 | 2025-11-30 01:01:19 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x454 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12548 | 2025-11-30 01:01:19 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12544 | 2025-11-30 01:01:27 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x454 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12548 | 2025-11-30 01:01:27 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12288 | 2025-11-30 01:01:28 | | Microsoft-Windows-Security-Auditing | 4616: The system time was changed. Subject: Security ID: S-1-5-19 Account Name: LOCAL SERVICE Account Domain: NT AUTHORITY Logon ID: 0x3e5 Process Information: Process ID: 0x24fc Name: C:\Windows\System32\svchost.exe Previous Time: 2025-11-30T09:01:28.5974605Z New Time: 2025-11-30T09:01:28.5983439Z This event is generated when the system time is changed. It is normal for the Windows Time Service, which runs with System privilege, to change the system time on a regular basis. Other system time changes may be indicative of attempts to tamper with the computer.
|
| | Security | Audit Success | 12544 | 2025-11-30 01:01:28 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x454 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12548 | 2025-11-30 01:01:28 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 13826 | 2025-11-30 01:01:28 | | Microsoft-Windows-Security-Auditing | 4799: A security-enabled local group membership was enumerated. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Group: Security ID: S-1-5-32-544 Group Name: Administrators Group Domain: Builtin Process Information: Process ID: 0x10b4 Process Name: C:\Windows\System32\svchost.exe
|
| | Security | Audit Success | 13826 | 2025-11-30 01:01:28 | | Microsoft-Windows-Security-Auditing | 4799: A security-enabled local group membership was enumerated. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Group: Security ID: S-1-5-32-551 Group Name: Backup Operators Group Domain: Builtin Process Information: Process ID: 0x10b4 Process Name: C:\Windows\System32\svchost.exe
|
| | Security | Audit Success | 12544 | 2025-11-30 01:01:57 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x454 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12548 | 2025-11-30 01:01:57 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12544 | 2025-11-30 01:07:13 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x454 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12548 | 2025-11-30 01:07:13 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12544 | 2025-11-30 01:07:17 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x454 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12548 | 2025-11-30 01:07:17 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12544 | 2025-11-30 01:07:23 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x454 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12548 | 2025-11-30 01:07:23 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12544 | 2025-11-30 01:08:04 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x454 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12548 | 2025-11-30 01:08:04 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12544 | 2025-11-30 01:08:10 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x454 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12548 | 2025-11-30 01:08:10 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 13826 | 2025-11-30 01:08:25 | | Microsoft-Windows-Security-Auditing | 4799: A security-enabled local group membership was enumerated. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Group: Security ID: S-1-5-32-544 Group Name: Administrators Group Domain: Builtin Process Information: Process ID: 0x788 Process Name: C:\Windows\System32\svchost.exe
|
| | Security | Audit Success | 13826 | 2025-11-30 01:08:25 | | Microsoft-Windows-Security-Auditing | 4799: A security-enabled local group membership was enumerated. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Group: Security ID: S-1-5-32-551 Group Name: Backup Operators Group Domain: Builtin Process Information: Process ID: 0x788 Process Name: C:\Windows\System32\svchost.exe
|
| | Security | Audit Success | 12544 | 2025-11-30 01:09:01 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x454 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12548 | 2025-11-30 01:09:01 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 13312 | 2025-11-30 01:09:46 | | Microsoft-Windows-Security-Auditing | 4688: A new process has been created. Creator Subject: Security ID: S-1-5-18 Account Name: - Account Domain: - Logon ID: 0x3e7 Target Subject: Security ID: S-1-0-0 Account Name: - Account Domain: - Logon ID: 0x0 Process Information: New Process ID: 0x110 New Process Name: R Token Elevation Type: %%1936 Mandatory Label: S-1-16-16384 Creator Process ID: 0x4 Creator Process Name: Process Command Line: Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
|
| | Security | Audit Success | 13312 | 2025-11-30 01:09:46 | | Microsoft-Windows-Security-Auditing | 4696: A primary token was assigned to process. Subject: Security ID: S-1-5-18 Account Name: - Account Domain: - Logon ID: 0x3e7 Process Information: Process ID: 0x4 Process Name: Target Process: Target Process ID: 0x110 Target Process Name: Registry New Token Information: Security ID: S-1-0-0 Account Name: - Account Domain: - Logon ID: 0x3e7
|
| | Security | Audit Success | 13312 | 2025-11-30 01:09:46 | | Microsoft-Windows-Security-Auditing | 4688: A new process has been created. Creator Subject: Security ID: S-1-5-18 Account Name: - Account Domain: - Logon ID: 0x3e7 Target Subject: Security ID: S-1-0-0 Account Name: - Account Domain: - Logon ID: 0x0 Process Information: New Process ID: 0x2d4 New Process Name: C Token Elevation Type: %%1936 Mandatory Label: S-1-16-16384 Creator Process ID: 0x4 Creator Process Name: Process Command Line: Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
|
| | Security | Audit Success | 13573 | 2025-11-30 01:09:46 | | Microsoft-Windows-Security-Auditing | 4826: Boot Configuration Data loaded. Subject: Security ID: S-1-5-18 Account Name: - Account Domain: - Logon ID: 0x3e7 General Settings: Load Options: - Advanced Options: %%1843 Configuration Access Policy: %%1846 System Event Logging: %%1843 Kernel Debugging: %%1843 VSM Launch Type: %%1848 Signature Settings: Test Signing: %%1843 Flight Signing: %%1843 Disable Integrity Checks: %%1843 HyperVisor Settings: HyperVisor Load Options: - HyperVisor Launch Type: %%1848 HyperVisor Debugging: %%1843
|
| | Security | Audit Success | 13312 | 2025-11-30 01:09:47 | | Microsoft-Windows-Security-Auditing | 4688: A new process has been created. Creator Subject: Security ID: S-1-5-18 Account Name: - Account Domain: - Logon ID: 0x3e7 Target Subject: Security ID: S-1-0-0 Account Name: - Account Domain: - Logon ID: 0x0 Process Information: New Process ID: 0x2e4 New Process Name: C Token Elevation Type: %%1936 Mandatory Label: S-1-16-16384 Creator Process ID: 0x2d4 Creator Process Name: C Process Command Line: Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
|
| | Security | Audit Success | 13312 | 2025-11-30 01:09:47 | | Microsoft-Windows-Security-Auditing | 4688: A new process has been created. Creator Subject: Security ID: S-1-5-18 Account Name: - Account Domain: - Logon ID: 0x3e7 Target Subject: Security ID: S-1-0-0 Account Name: - Account Domain: - Logon ID: 0x0 Process Information: New Process ID: 0x338 New Process Name: C Token Elevation Type: %%1936 Mandatory Label: S-1-16-16384 Creator Process ID: 0x2d4 Creator Process Name: C Process Command Line: Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
|
| | Security | Audit Success | 13312 | 2025-11-30 01:09:49 | | Microsoft-Windows-Security-Auditing | 4688: A new process has been created. Creator Subject: Security ID: S-1-5-18 Account Name: - Account Domain: - Logon ID: 0x3e7 Target Subject: Security ID: S-1-0-0 Account Name: - Account Domain: - Logon ID: 0x0 Process Information: New Process ID: 0x390 New Process Name: C Token Elevation Type: %%1936 Mandatory Label: S-1-16-16384 Creator Process ID: 0x338 Creator Process Name: C Process Command Line: Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
|
| | Security | Audit Success | 13312 | 2025-11-30 01:09:51 | | Microsoft-Windows-Security-Auditing | 4688: A new process has been created. Creator Subject: Security ID: S-1-5-18 Account Name: - Account Domain: - Logon ID: 0x3e7 Target Subject: Security ID: S-1-0-0 Account Name: - Account Domain: - Logon ID: 0x0 Process Information: New Process ID: 0x31c New Process Name: C Token Elevation Type: %%1936 Mandatory Label: S-1-16-16384 Creator Process ID: 0x2d4 Creator Process Name: C Process Command Line: Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
|
| | Security | Audit Success | 13312 | 2025-11-30 01:09:51 | | Microsoft-Windows-Security-Auditing | 4688: A new process has been created. Creator Subject: Security ID: S-1-5-18 Account Name: - Account Domain: - Logon ID: 0x3e7 Target Subject: Security ID: S-1-0-0 Account Name: - Account Domain: - Logon ID: 0x0 Process Information: New Process ID: 0x318 New Process Name: C Token Elevation Type: %%1936 Mandatory Label: S-1-16-16384 Creator Process ID: 0x338 Creator Process Name: C Process Command Line: Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
|
| | Security | Audit Success | 13312 | 2025-11-30 01:09:51 | | Microsoft-Windows-Security-Auditing | 4688: A new process has been created. Creator Subject: Security ID: S-1-5-18 Account Name: - Account Domain: - Logon ID: 0x3e7 Target Subject: Security ID: S-1-0-0 Account Name: - Account Domain: - Logon ID: 0x0 Process Information: New Process ID: 0x314 New Process Name: C Token Elevation Type: %%1936 Mandatory Label: S-1-16-16384 Creator Process ID: 0x31c Creator Process Name: C Process Command Line: Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
|
| | Security | Audit Success | 12288 | 2025-11-30 01:09:52 | | Microsoft-Windows-Security-Auditing | 4608: Windows is starting up. This event is logged when LSASS.EXE starts and the auditing subsystem is initialized.
|
| | Security | Audit Success | 12290 | 2025-11-30 01:09:52 | | Microsoft-Windows-Security-Auditing | 6417: The FIPS mode crypto selftests succeeded. Process ID: 0x470 Process Name: C:\Windows\System32\lsass.exe
|
| | Security | Audit Success | 12544 | 2025-11-30 01:09:52 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-0-0 Account Name: - Account Domain: - Logon ID: 0x0 Logon Information: Logon Type: 0 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: - New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4 Process Name: Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: - Authentication Package: - Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-30 01:09:52 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x430 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-30 01:09:52 | | Microsoft-Windows-Security-Auditing | 4648: A logon was attempted using explicit credentials. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon GUID: {00000000-0000-0000-0000-000000000000} Account Whose Credentials Were Used: Account Name: UMFD-0 Account Domain: Font Driver Host Logon GUID: {00000000-0000-0000-0000-000000000000} Target Server: Target Server Name: localhost Additional Information: localhost Process Information: Process ID: 0x318 Process Name: C:\Windows\System32\wininit.exe Network Information: Network Address: - Port: - This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
|
| | Security | Audit Success | 12544 | 2025-11-30 01:09:52 | | Microsoft-Windows-Security-Auditing | 4648: A logon was attempted using explicit credentials. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon GUID: {00000000-0000-0000-0000-000000000000} Account Whose Credentials Were Used: Account Name: UMFD-1 Account Domain: Font Driver Host Logon GUID: {00000000-0000-0000-0000-000000000000} Target Server: Target Server Name: localhost Additional Information: localhost Process Information: Process ID: 0x44c Process Name: C:\Windows\System32\winlogon.exe Network Information: Network Address: - Port: - This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
|
| | Security | Audit Success | 12544 | 2025-11-30 01:09:52 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 2 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1842 Elevated Token: %%1843 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-96-0-0 Account Name: UMFD-0 Account Domain: Font Driver Host Logon ID: 0xfbf3 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x318 Process Name: C:\Windows\System32\wininit.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-30 01:09:52 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 2 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1842 Elevated Token: %%1843 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-96-0-1 Account Name: UMFD-1 Account Domain: Font Driver Host Logon ID: 0xfbe4 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x44c Process Name: C:\Windows\System32\winlogon.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12548 | 2025-11-30 01:09:52 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 13312 | 2025-11-30 01:09:52 | | Microsoft-Windows-Security-Auditing | 4688: A new process has been created. Creator Subject: Security ID: S-1-5-18 Account Name: - Account Domain: - Logon ID: 0x3e7 Target Subject: Security ID: S-1-0-0 Account Name: - Account Domain: - Logon ID: 0x0 Process Information: New Process ID: 0x430 New Process Name: C Token Elevation Type: %%1936 Mandatory Label: S-1-16-16384 Creator Process ID: 0x318 Creator Process Name: C Process Command Line: Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
|
| | Security | Audit Success | 13312 | 2025-11-30 01:09:52 | | Microsoft-Windows-Security-Auditing | 4688: A new process has been created. Creator Subject: Security ID: S-1-5-18 Account Name: - Account Domain: - Logon ID: 0x3e7 Target Subject: Security ID: S-1-0-0 Account Name: - Account Domain: - Logon ID: 0x0 Process Information: New Process ID: 0x44c New Process Name: C Token Elevation Type: %%1936 Mandatory Label: S-1-16-16384 Creator Process ID: 0x31c Creator Process Name: C Process Command Line: Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
|
| | Security | Audit Success | 13312 | 2025-11-30 01:09:52 | | Microsoft-Windows-Security-Auditing | 4688: A new process has been created. Creator Subject: Security ID: S-1-5-18 Account Name: - Account Domain: - Logon ID: 0x3e7 Target Subject: Security ID: S-1-0-0 Account Name: - Account Domain: - Logon ID: 0x0 Process Information: New Process ID: 0x470 New Process Name: C Token Elevation Type: %%1936 Mandatory Label: S-1-16-16384 Creator Process ID: 0x318 Creator Process Name: C Process Command Line: Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
|
| | Security | Audit Success | 13568 | 2025-11-30 01:09:52 | | Microsoft-Windows-Security-Auditing | 4902: The Per-user audit policy table was created. Number of Elements: 0 Policy ID: 0xf7bc
|
| | Security | Audit Success | 12544 | 2025-11-30 01:09:53 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-20 Account Name: NETWORK SERVICE Account Domain: NT AUTHORITY Logon ID: 0x3e4 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x430 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-30 01:09:53 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x430 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-30 01:09:53 | | Microsoft-Windows-Security-Auditing | 4648: A logon was attempted using explicit credentials. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon GUID: {00000000-0000-0000-0000-000000000000} Account Whose Credentials Were Used: Account Name: DWM-1 Account Domain: Window Manager Logon GUID: {00000000-0000-0000-0000-000000000000} Target Server: Target Server Name: localhost Additional Information: localhost Process Information: Process ID: 0x44c Process Name: C:\Windows\System32\winlogon.exe Network Information: Network Address: - Port: - This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
|
| | Security | Audit Success | 12544 | 2025-11-30 01:09:53 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 2 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1842 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-90-0-1 Account Name: DWM-1 Account Domain: Window Manager Logon ID: 0x16aab Linked Logon ID: 0x16aec Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x44c Process Name: C:\Windows\System32\winlogon.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-30 01:09:53 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 2 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1842 Elevated Token: %%1843 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-90-0-1 Account Name: DWM-1 Account Domain: Window Manager Logon ID: 0x16aec Linked Logon ID: 0x16aab Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x44c Process Name: C:\Windows\System32\winlogon.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-30 01:09:53 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x430 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-30 01:09:53 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x430 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-30 01:09:53 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-19 Account Name: LOCAL SERVICE Account Domain: NT AUTHORITY Logon ID: 0x3e5 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x430 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-30 01:09:53 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x430 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12548 | 2025-11-30 01:09:53 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-20 Account Name: NETWORK SERVICE Account Domain: NT AUTHORITY Logon ID: 0x3e4 Privileges: SeAssignPrimaryTokenPrivilege SeAuditPrivilege SeImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-30 01:09:53 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-30 01:09:53 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-90-0-1 Account Name: DWM-1 Account Domain: Window Manager Logon ID: 0x16aab Privileges: SeAssignPrimaryTokenPrivilege SeAuditPrivilege SeImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-30 01:09:53 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-90-0-1 Account Name: DWM-1 Account Domain: Window Manager Logon ID: 0x16aec Privileges: SeAssignPrimaryTokenPrivilege SeAuditPrivilege
|
| | Security | Audit Success | 12548 | 2025-11-30 01:09:53 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-30 01:09:53 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-30 01:09:53 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-19 Account Name: LOCAL SERVICE Account Domain: NT AUTHORITY Logon ID: 0x3e5 Privileges: SeAssignPrimaryTokenPrivilege SeAuditPrivilege SeImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-30 01:09:53 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 101 | 2025-11-30 01:09:54 | | Microsoft-Windows-Eventlog | 1101: Audit events have been dropped by the transport. 0
|
| | Security | Audit Success | 12292 | 2025-11-30 01:09:54 | | Microsoft-Windows-Security-Auditing | 5033: The Windows Firewall Driver started successfully.
|
| | Security | Audit Success | 12544 | 2025-11-30 01:09:54 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x430 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-30 01:09:54 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x430 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-30 01:09:54 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x430 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-30 01:09:54 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x430 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-30 01:09:54 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x430 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-30 01:09:54 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x430 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-30 01:09:54 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x430 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-30 01:09:54 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x430 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-30 01:09:54 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x430 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-30 01:09:54 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x430 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-30 01:09:54 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x430 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-30 01:09:54 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x430 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-30 01:09:54 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x430 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-30 01:09:54 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x430 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-30 01:09:54 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x430 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12548 | 2025-11-30 01:09:54 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-30 01:09:54 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-30 01:09:54 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-30 01:09:54 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-30 01:09:54 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-30 01:09:54 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-30 01:09:54 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-30 01:09:54 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-30 01:09:54 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-30 01:09:54 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-30 01:09:54 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-30 01:09:54 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-30 01:09:54 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-30 01:09:54 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-30 01:09:54 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 13826 | 2025-11-30 01:09:54 | | Microsoft-Windows-Security-Auditing | 4799: A security-enabled local group membership was enumerated. Subject: Security ID: S-1-5-20 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e4 Group: Security ID: S-1-5-32-544 Group Name: Administrators Group Domain: Builtin Process Information: Process ID: 0x674 Process Name: C:\Windows\System32\svchost.exe
|
| | Security | Audit Success | 13826 | 2025-11-30 01:09:54 | | Microsoft-Windows-Security-Auditing | 4799: A security-enabled local group membership was enumerated. Subject: Security ID: S-1-5-20 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e4 Group: Security ID: S-1-5-32-551 Group Name: Backup Operators Group Domain: Builtin Process Information: Process ID: 0x674 Process Name: C:\Windows\System32\svchost.exe
|
| | Security | Audit Success | 12544 | 2025-11-30 01:09:55 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x430 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-30 01:09:55 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x430 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-30 01:09:55 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x430 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-30 01:09:55 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x430 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-30 01:09:55 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x430 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-30 01:09:55 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x430 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-30 01:09:55 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x430 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-30 01:09:55 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x430 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12548 | 2025-11-30 01:09:55 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-30 01:09:55 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-30 01:09:55 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-30 01:09:55 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-30 01:09:55 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-30 01:09:55 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-30 01:09:55 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-30 01:09:55 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12288 | 2025-11-30 01:11:03 | | Microsoft-Windows-Security-Auditing | 4616: The system time was changed. Subject: Security ID: S-1-5-19 Account Name: LOCAL SERVICE Account Domain: NT AUTHORITY Logon ID: 0x3e5 Process Information: Process ID: 0xc74 Name: C:\Windows\System32\svchost.exe Previous Time: 2025-11-30T09:09:55.8424147Z New Time: 2025-11-30T09:11:03.6986410Z This event is generated when the system time is changed. It is normal for the Windows Time Service, which runs with System privilege, to change the system time on a regular basis. Other system time changes may be indicative of attempts to tamper with the computer.
|
| | Security | Audit Success | 12288 | 2025-11-30 01:11:03 | | Microsoft-Windows-Security-Auditing | 4616: The system time was changed. Subject: Security ID: S-1-5-19 Account Name: LOCAL SERVICE Account Domain: NT AUTHORITY Logon ID: 0x3e5 Process Information: Process ID: 0xc74 Name: C:\Windows\System32\svchost.exe Previous Time: 2025-11-30T09:11:03.6986410Z New Time: 2025-11-30T09:11:03.6992765Z This event is generated when the system time is changed. It is normal for the Windows Time Service, which runs with System privilege, to change the system time on a regular basis. Other system time changes may be indicative of attempts to tamper with the computer.
|
| | Security | Audit Success | 13824 | 2025-11-30 01:11:04 | | Microsoft-Windows-Security-Auditing | 4798: A user's local group membership was enumerated. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 User: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Process Information: Process ID: 0x604 Process Name: C:\Windows\System32\LogonUI.exe
|
| | Security | Audit Success | 12288 | 2025-11-30 01:11:05 | | Microsoft-Windows-Security-Auditing | 4616: The system time was changed. Subject: Security ID: S-1-5-19 Account Name: LOCAL SERVICE Account Domain: NT AUTHORITY Logon ID: 0x3e5 Process Information: Process ID: 0xc74 Name: C:\Windows\System32\svchost.exe Previous Time: 2025-11-30T09:11:05.2259851Z New Time: 2025-11-30T09:11:05.2312785Z This event is generated when the system time is changed. It is normal for the Windows Time Service, which runs with System privilege, to change the system time on a regular basis. Other system time changes may be indicative of attempts to tamper with the computer.
|
| | Security | Audit Success | 12544 | 2025-11-30 01:11:06 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x430 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-30 01:11:06 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x430 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12548 | 2025-11-30 01:11:06 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-30 01:11:06 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12292 | 2025-11-30 01:11:07 | | Microsoft-Windows-Security-Auditing | 5024: The Windows Firewall service started successfully.
|
| | Security | Audit Success | 12544 | 2025-11-30 01:11:10 | | Microsoft-Windows-Security-Auditing | 4648: A logon was attempted using explicit credentials. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon GUID: {00000000-0000-0000-0000-000000000000} Account Whose Credentials Were Used: Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon GUID: {00000000-0000-0000-0000-000000000000} Target Server: Target Server Name: localhost Additional Information: localhost Process Information: Process ID: 0x88c Process Name: C:\Windows\System32\svchost.exe Network Information: Network Address: 127.0.0.1 Port: 0 This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
|
| | Security | Audit Success | 12544 | 2025-11-30 01:11:10 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 2 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x5d2c2 Linked Logon ID: 0x5d342 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x88c Process Name: C:\Windows\System32\svchost.exe Network Information: Workstation Name: DESKTOP-0JV7HJV Source Network Address: 127.0.0.1 Source Port: 0 Detailed Authentication Information: Logon Process: User32 Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-30 01:11:10 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 2 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1843 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x5d342 Linked Logon ID: 0x5d2c2 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x88c Process Name: C:\Windows\System32\svchost.exe Network Information: Workstation Name: DESKTOP-0JV7HJV Source Network Address: 127.0.0.1 Source Port: 0 Detailed Authentication Information: Logon Process: User32 Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12548 | 2025-11-30 01:11:10 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x5d2c2 Privileges: SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 13824 | 2025-11-30 01:11:10 | | Microsoft-Windows-Security-Auditing | 4798: A user's local group membership was enumerated. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 User: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Process Information: Process ID: 0x470 Process Name: C:\Windows\System32\lsass.exe
|
| | Security | Audit Success | 13826 | 2025-11-30 01:11:10 | | Microsoft-Windows-Security-Auditing | 4799: A security-enabled local group membership was enumerated. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Group: Security ID: S-1-5-32-544 Group Name: Administrators Group Domain: Builtin Process Information: Process ID: 0x334 Process Name: C:\Windows\System32\svchost.exe
|
| | Security | Audit Success | 12290 | 2025-11-30 01:11:11 | | Microsoft-Windows-Security-Auditing | 5061: Cryptographic operation. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x5d342 Cryptographic Parameters: Provider Name: Microsoft Software Key Storage Provider Algorithm Name: ECDSA_P256 Key Name: Microsoft Connected Devices Platform device certificate Key Type: %%2500 Cryptographic Operation: Operation: %%2480 Return Code: 0x0
|
| | Security | Audit Success | 12292 | 2025-11-30 01:11:11 | | Microsoft-Windows-Security-Auditing | 5058: Key file operation. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x5d342 Process Information: Process ID: 5212 Process Creation Time: 2025-11-30T09:11:11.5865764Z Cryptographic Parameters: Provider Name: Microsoft Software Key Storage Provider Algorithm Name: UNKNOWN Key Name: Microsoft Connected Devices Platform device certificate Key Type: %%2500 Key File Operation Information: File Path: C:\Users\CogiArt\AppData\Roaming\Microsoft\Crypto\Keys\de7cf8a7901d2ad13e5c67c29e5d1662_9ee7012e-fa60-42be-b8b4-8dc8b4e1280d Operation: %%2458 Return Code: 0x0
|
| | Security | Audit Success | 12292 | 2025-11-30 01:11:11 | | Microsoft-Windows-Security-Auditing | 5059: Key migration operation. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x5d342 Process Information: Process ID: 5212 Process Creation Time: 2025-11-30T09:11:11.5865764Z Cryptographic Parameters: Provider Name: Microsoft Software Key Storage Provider Algorithm Name: ECDSA_P256 Key Name: Microsoft Connected Devices Platform device certificate Key Type: %%2500 Additional Information: Operation: %%2464 Return Code: 0x0
|
| | Security | Audit Success | 12292 | 2025-11-30 01:11:11 | | Microsoft-Windows-Security-Auditing | 5058: Key file operation. Subject: Security ID: S-1-5-19 Account Name: LOCAL SERVICE Account Domain: NT AUTHORITY Logon ID: 0x3e5 Process Information: Process ID: 5852 Process Creation Time: 2025-11-30T09:11:11.9034130Z Cryptographic Parameters: Provider Name: Microsoft Software Key Storage Provider Algorithm Name: UNKNOWN Key Name: Microsoft Connected Devices Platform device certificate Key Type: %%2500 Key File Operation Information: File Path: C:\WINDOWS\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Crypto\Keys\de7cf8a7901d2ad13e5c67c29e5d1662_9ee7012e-fa60-42be-b8b4-8dc8b4e1280d Operation: %%2458 Return Code: 0x0
|
| | Security | Audit Success | 12544 | 2025-11-30 01:11:11 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x430 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-30 01:11:11 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x430 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12548 | 2025-11-30 01:11:11 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-30 01:11:11 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12290 | 2025-11-30 01:11:12 | | Microsoft-Windows-Security-Auditing | 5061: Cryptographic operation. Subject: Security ID: S-1-5-19 Account Name: LOCAL SERVICE Account Domain: NT AUTHORITY Logon ID: 0x3e5 Cryptographic Parameters: Provider Name: Microsoft Software Key Storage Provider Algorithm Name: ECDSA_P256 Key Name: Microsoft Connected Devices Platform device certificate Key Type: %%2500 Cryptographic Operation: Operation: %%2480 Return Code: 0x0
|
| | Security | Audit Success | 12292 | 2025-11-30 01:11:12 | | Microsoft-Windows-Security-Auditing | 5059: Key migration operation. Subject: Security ID: S-1-5-19 Account Name: LOCAL SERVICE Account Domain: NT AUTHORITY Logon ID: 0x3e5 Process Information: Process ID: 5852 Process Creation Time: 2025-11-30T09:11:11.9034130Z Cryptographic Parameters: Provider Name: Microsoft Software Key Storage Provider Algorithm Name: ECDSA_P256 Key Name: Microsoft Connected Devices Platform device certificate Key Type: %%2500 Additional Information: Operation: %%2464 Return Code: 0x0
|
| | Security | Audit Success | 12544 | 2025-11-30 01:11:12 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x430 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12548 | 2025-11-30 01:11:12 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12544 | 2025-11-30 01:11:14 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x430 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-30 01:11:14 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x430 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12548 | 2025-11-30 01:11:14 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-30 01:11:14 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 13824 | 2025-11-30 01:11:14 | | Microsoft-Windows-Security-Auditing | 4798: A user's local group membership was enumerated. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x5d342 User: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Process Information: Process ID: 0x1870 Process Name: C:\Windows\explorer.exe
|
| | Security | Audit Success | 13824 | 2025-11-30 01:11:14 | | Microsoft-Windows-Security-Auditing | 4798: A user's local group membership was enumerated. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x5d2c2 User: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Process Information: Process ID: 0x1540 Process Name: C:\Program Files\AMD\CIM\Bin64\InstallManagerApp.exe
|
| | Security | Audit Success | 13824 | 2025-11-30 01:11:14 | | Microsoft-Windows-Security-Auditing | 4798: A user's local group membership was enumerated. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x5d342 User: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Process Information: Process ID: 0x1870 Process Name: C:\Windows\explorer.exe
|
| | Security | Audit Success | 13824 | 2025-11-30 01:11:14 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-30 01:11:14 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-30 01:11:14 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-30 01:11:14 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x5d342 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-30 01:11:14 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x5d342 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-30 01:11:14 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x5d342 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-30 01:11:14 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x5d342 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-30 01:11:14 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x5d342 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-30 01:11:14 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x5d342 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13826 | 2025-11-30 01:11:14 | | Microsoft-Windows-Security-Auditing | 4799: A security-enabled local group membership was enumerated. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Group: Security ID: S-1-5-32-544 Group Name: Administrators Group Domain: Builtin Process Information: Process ID: 0x1c24 Process Name: C:\Windows\System32\SearchIndexer.exe
|
| | Security | Audit Success | 13826 | 2025-11-30 01:11:14 | | Microsoft-Windows-Security-Auditing | 4799: A security-enabled local group membership was enumerated. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Group: Security ID: S-1-5-32-551 Group Name: Backup Operators Group Domain: Builtin Process Information: Process ID: 0x1c24 Process Name: C:\Windows\System32\SearchIndexer.exe
|
| | Security | Audit Success | 13824 | 2025-11-30 01:11:15 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x5d342 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 12544 | 2025-11-30 01:11:17 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x430 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12548 | 2025-11-30 01:11:17 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 13826 | 2025-11-30 01:11:23 | | Microsoft-Windows-Security-Auditing | 4799: A security-enabled local group membership was enumerated. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Group: Security ID: S-1-5-32-544 Group Name: Administrators Group Domain: Builtin Process Information: Process ID: 0x10a4 Process Name: C:\Windows\System32\svchost.exe
|
| | Security | Audit Success | 13826 | 2025-11-30 01:11:23 | | Microsoft-Windows-Security-Auditing | 4799: A security-enabled local group membership was enumerated. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Group: Security ID: S-1-5-32-551 Group Name: Backup Operators Group Domain: Builtin Process Information: Process ID: 0x10a4 Process Name: C:\Windows\System32\svchost.exe
|
| | Security | Audit Success | 12544 | 2025-11-30 01:11:26 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x430 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12548 | 2025-11-30 01:11:26 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12544 | 2025-11-30 01:11:28 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x430 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12548 | 2025-11-30 01:11:28 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12544 | 2025-11-30 01:12:52 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x430 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12548 | 2025-11-30 01:12:52 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12544 | 2025-11-30 01:13:06 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x430 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12548 | 2025-11-30 01:13:06 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12544 | 2025-11-30 01:13:07 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x430 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-30 01:13:07 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x430 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-30 01:13:07 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x430 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12548 | 2025-11-30 01:13:07 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-30 01:13:07 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-30 01:13:07 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12544 | 2025-11-30 01:13:08 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x430 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-30 01:13:08 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x430 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12548 | 2025-11-30 01:13:08 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-30 01:13:08 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12544 | 2025-11-30 01:15:35 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x430 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12548 | 2025-11-30 01:15:35 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 13824 | 2025-11-30 01:16:10 | | Microsoft-Windows-Security-Auditing | 4798: A user's local group membership was enumerated. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x5d342 User: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Process Information: Process ID: 0x1870 Process Name: C:\Windows\explorer.exe
|
| | Security | Audit Success | 12544 | 2025-11-30 01:16:12 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x430 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-30 01:16:12 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x430 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12548 | 2025-11-30 01:16:12 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-30 01:16:12 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 13824 | 2025-11-30 01:16:34 | | Microsoft-Windows-Security-Auditing | 4798: A user's local group membership was enumerated. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x5d342 User: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Process Information: Process ID: 0x1870 Process Name: C:\Windows\explorer.exe
|
| | Security | Audit Success | 13824 | 2025-11-30 01:17:16 | | Microsoft-Windows-Security-Auditing | 4798: A user's local group membership was enumerated. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x5d342 User: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Process Information: Process ID: 0x1870 Process Name: C:\Windows\explorer.exe
|
| | Security | Audit Success | 13824 | 2025-11-30 01:17:17 | | Microsoft-Windows-Security-Auditing | 4798: A user's local group membership was enumerated. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x5d342 User: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Process Information: Process ID: 0x1870 Process Name: C:\Windows\explorer.exe
|
| | Security | Audit Success | 13824 | 2025-11-30 01:17:29 | | Microsoft-Windows-Security-Auditing | 4798: A user's local group membership was enumerated. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x5d342 User: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Process Information: Process ID: 0x1870 Process Name: C:\Windows\explorer.exe
|
| | Security | Audit Success | 12544 | 2025-11-30 01:17:30 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x430 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12548 | 2025-11-30 01:17:30 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12544 | 2025-11-30 01:19:16 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x430 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12548 | 2025-11-30 01:19:16 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12544 | 2025-11-30 01:19:17 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x430 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12548 | 2025-11-30 01:19:17 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12544 | 2025-11-30 01:19:39 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x430 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12545 | 2025-11-30 01:19:39 | | Microsoft-Windows-Security-Auditing | 4647: User initiated logoff: Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x5d342 This event is generated when a logoff is initiated. No further user-initiated activity can occur. This event can be interpreted as a logoff event.
|
| | Security | Audit Success | 12548 | 2025-11-30 01:19:39 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 103 | 2025-11-30 01:19:40 | | Microsoft-Windows-Eventlog | 1100: The event logging service has shut down.
|
| | Security | Audit Success | 13312 | 2025-11-30 01:19:46 | | Microsoft-Windows-Security-Auditing | 4688: A new process has been created. Creator Subject: Security ID: S-1-5-18 Account Name: - Account Domain: - Logon ID: 0x3e7 Target Subject: Security ID: S-1-0-0 Account Name: - Account Domain: - Logon ID: 0x0 Process Information: New Process ID: 0x170 New Process Name: R Token Elevation Type: %%1936 Mandatory Label: S-1-16-16384 Creator Process ID: 0x4 Creator Process Name: Process Command Line: Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
|
| | Security | Audit Success | 13312 | 2025-11-30 01:19:46 | | Microsoft-Windows-Security-Auditing | 4696: A primary token was assigned to process. Subject: Security ID: S-1-5-18 Account Name: - Account Domain: - Logon ID: 0x3e7 Process Information: Process ID: 0x4 Process Name: Target Process: Target Process ID: 0x170 Target Process Name: Registry New Token Information: Security ID: S-1-0-0 Account Name: - Account Domain: - Logon ID: 0x3e7
|
| | Security | Audit Success | 13312 | 2025-11-30 01:19:46 | | Microsoft-Windows-Security-Auditing | 4688: A new process has been created. Creator Subject: Security ID: S-1-5-18 Account Name: - Account Domain: - Logon ID: 0x3e7 Target Subject: Security ID: S-1-0-0 Account Name: - Account Domain: - Logon ID: 0x0 Process Information: New Process ID: 0x368 New Process Name: C Token Elevation Type: %%1936 Mandatory Label: S-1-16-16384 Creator Process ID: 0x4 Creator Process Name: Process Command Line: Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
|
| | Security | Audit Success | 13573 | 2025-11-30 01:19:46 | | Microsoft-Windows-Security-Auditing | 4826: Boot Configuration Data loaded. Subject: Security ID: S-1-5-18 Account Name: - Account Domain: - Logon ID: 0x3e7 General Settings: Load Options: - Advanced Options: %%1843 Configuration Access Policy: %%1846 System Event Logging: %%1843 Kernel Debugging: %%1843 VSM Launch Type: %%1848 Signature Settings: Test Signing: %%1843 Flight Signing: %%1843 Disable Integrity Checks: %%1843 HyperVisor Settings: HyperVisor Load Options: - HyperVisor Launch Type: %%1848 HyperVisor Debugging: %%1843
|
| | Security | Audit Success | 13312 | 2025-11-30 01:19:47 | | Microsoft-Windows-Security-Auditing | 4688: A new process has been created. Creator Subject: Security ID: S-1-5-18 Account Name: - Account Domain: - Logon ID: 0x3e7 Target Subject: Security ID: S-1-0-0 Account Name: - Account Domain: - Logon ID: 0x0 Process Information: New Process ID: 0x388 New Process Name: C Token Elevation Type: %%1936 Mandatory Label: S-1-16-16384 Creator Process ID: 0x368 Creator Process Name: C Process Command Line: Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
|
| | Security | Audit Success | 13312 | 2025-11-30 01:19:57 | | Microsoft-Windows-Security-Auditing | 4688: A new process has been created. Creator Subject: Security ID: S-1-5-18 Account Name: - Account Domain: - Logon ID: 0x3e7 Target Subject: Security ID: S-1-0-0 Account Name: - Account Domain: - Logon ID: 0x0 Process Information: New Process ID: 0x3a8 New Process Name: C Token Elevation Type: %%1936 Mandatory Label: S-1-16-16384 Creator Process ID: 0x368 Creator Process Name: C Process Command Line: Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
|
| | Security | Audit Success | 13312 | 2025-11-30 01:19:58 | | Microsoft-Windows-Security-Auditing | 4688: A new process has been created. Creator Subject: Security ID: S-1-5-18 Account Name: - Account Domain: - Logon ID: 0x3e7 Target Subject: Security ID: S-1-0-0 Account Name: - Account Domain: - Logon ID: 0x0 Process Information: New Process ID: 0x3b8 New Process Name: C Token Elevation Type: %%1936 Mandatory Label: S-1-16-16384 Creator Process ID: 0x3a8 Creator Process Name: C Process Command Line: Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
|
| | Security | Audit Success | 12288 | 2025-11-30 01:20:01 | | Microsoft-Windows-Security-Auditing | 4608: Windows is starting up. This event is logged when LSASS.EXE starts and the auditing subsystem is initialized.
|
| | Security | Audit Success | 12290 | 2025-11-30 01:20:01 | | Microsoft-Windows-Security-Auditing | 6417: The FIPS mode crypto selftests succeeded. Process ID: 0x544 Process Name: C:\Windows\System32\lsass.exe
|
| | Security | Audit Success | 12544 | 2025-11-30 01:20:01 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-0-0 Account Name: - Account Domain: - Logon ID: 0x0 Logon Information: Logon Type: 0 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: - New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4 Process Name: Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: - Authentication Package: - Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 13312 | 2025-11-30 01:20:01 | | Microsoft-Windows-Security-Auditing | 4688: A new process has been created. Creator Subject: Security ID: S-1-5-18 Account Name: - Account Domain: - Logon ID: 0x3e7 Target Subject: Security ID: S-1-0-0 Account Name: - Account Domain: - Logon ID: 0x0 Process Information: New Process ID: 0x49c New Process Name: C Token Elevation Type: %%1936 Mandatory Label: S-1-16-16384 Creator Process ID: 0x368 Creator Process Name: C Process Command Line: Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
|
| | Security | Audit Success | 13312 | 2025-11-30 01:20:01 | | Microsoft-Windows-Security-Auditing | 4688: A new process has been created. Creator Subject: Security ID: S-1-5-18 Account Name: - Account Domain: - Logon ID: 0x3e7 Target Subject: Security ID: S-1-0-0 Account Name: - Account Domain: - Logon ID: 0x0 Process Information: New Process ID: 0x4a4 New Process Name: C Token Elevation Type: %%1936 Mandatory Label: S-1-16-16384 Creator Process ID: 0x3a8 Creator Process Name: C Process Command Line: Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
|
| | Security | Audit Success | 13312 | 2025-11-30 01:20:01 | | Microsoft-Windows-Security-Auditing | 4688: A new process has been created. Creator Subject: Security ID: S-1-5-18 Account Name: - Account Domain: - Logon ID: 0x3e7 Target Subject: Security ID: S-1-0-0 Account Name: - Account Domain: - Logon ID: 0x0 Process Information: New Process ID: 0x4ac New Process Name: C Token Elevation Type: %%1936 Mandatory Label: S-1-16-16384 Creator Process ID: 0x49c Creator Process Name: C Process Command Line: Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
|
| | Security | Audit Success | 13312 | 2025-11-30 01:20:01 | | Microsoft-Windows-Security-Auditing | 4688: A new process has been created. Creator Subject: Security ID: S-1-5-18 Account Name: - Account Domain: - Logon ID: 0x3e7 Target Subject: Security ID: S-1-0-0 Account Name: - Account Domain: - Logon ID: 0x0 Process Information: New Process ID: 0x504 New Process Name: C Token Elevation Type: %%1936 Mandatory Label: S-1-16-16384 Creator Process ID: 0x4a4 Creator Process Name: C Process Command Line: Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
|
| | Security | Audit Success | 13312 | 2025-11-30 01:20:01 | | Microsoft-Windows-Security-Auditing | 4688: A new process has been created. Creator Subject: Security ID: S-1-5-18 Account Name: - Account Domain: - Logon ID: 0x3e7 Target Subject: Security ID: S-1-0-0 Account Name: - Account Domain: - Logon ID: 0x0 Process Information: New Process ID: 0x524 New Process Name: C Token Elevation Type: %%1936 Mandatory Label: S-1-16-16384 Creator Process ID: 0x49c Creator Process Name: C Process Command Line: Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
|
| | Security | Audit Success | 13312 | 2025-11-30 01:20:01 | | Microsoft-Windows-Security-Auditing | 4688: A new process has been created. Creator Subject: Security ID: S-1-5-18 Account Name: - Account Domain: - Logon ID: 0x3e7 Target Subject: Security ID: S-1-0-0 Account Name: - Account Domain: - Logon ID: 0x0 Process Information: New Process ID: 0x544 New Process Name: C Token Elevation Type: %%1936 Mandatory Label: S-1-16-16384 Creator Process ID: 0x4a4 Creator Process Name: C Process Command Line: Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
|
| | Security | Audit Success | 12544 | 2025-11-30 01:20:02 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x504 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-30 01:20:02 | | Microsoft-Windows-Security-Auditing | 4648: A logon was attempted using explicit credentials. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon GUID: {00000000-0000-0000-0000-000000000000} Account Whose Credentials Were Used: Account Name: UMFD-0 Account Domain: Font Driver Host Logon GUID: {00000000-0000-0000-0000-000000000000} Target Server: Target Server Name: localhost Additional Information: localhost Process Information: Process ID: 0x4a4 Process Name: C:\Windows\System32\wininit.exe Network Information: Network Address: - Port: - This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
|
| | Security | Audit Success | 12544 | 2025-11-30 01:20:02 | | Microsoft-Windows-Security-Auditing | 4648: A logon was attempted using explicit credentials. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon GUID: {00000000-0000-0000-0000-000000000000} Account Whose Credentials Were Used: Account Name: UMFD-1 Account Domain: Font Driver Host Logon GUID: {00000000-0000-0000-0000-000000000000} Target Server: Target Server Name: localhost Additional Information: localhost Process Information: Process ID: 0x524 Process Name: C:\Windows\System32\winlogon.exe Network Information: Network Address: - Port: - This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
|
| | Security | Audit Success | 12544 | 2025-11-30 01:20:02 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 2 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1842 Elevated Token: %%1843 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-96-0-0 Account Name: UMFD-0 Account Domain: Font Driver Host Logon ID: 0x10035 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4a4 Process Name: C:\Windows\System32\wininit.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-30 01:20:02 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 2 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1842 Elevated Token: %%1843 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-96-0-1 Account Name: UMFD-1 Account Domain: Font Driver Host Logon ID: 0x1003f Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x524 Process Name: C:\Windows\System32\winlogon.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-30 01:20:02 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-20 Account Name: NETWORK SERVICE Account Domain: NT AUTHORITY Logon ID: 0x3e4 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x504 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-30 01:20:02 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x504 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12548 | 2025-11-30 01:20:02 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-30 01:20:02 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-20 Account Name: NETWORK SERVICE Account Domain: NT AUTHORITY Logon ID: 0x3e4 Privileges: SeAssignPrimaryTokenPrivilege SeAuditPrivilege SeImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-30 01:20:02 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 13568 | 2025-11-30 01:20:02 | | Microsoft-Windows-Security-Auditing | 4902: The Per-user audit policy table was created. Number of Elements: 0 Policy ID: 0xfc05
|
| | Security | Audit Success | 12292 | 2025-11-30 01:20:03 | | Microsoft-Windows-Security-Auditing | 5033: The Windows Firewall Driver started successfully.
|
| | Security | Audit Success | 12544 | 2025-11-30 01:20:03 | | Microsoft-Windows-Security-Auditing | 4648: A logon was attempted using explicit credentials. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon GUID: {00000000-0000-0000-0000-000000000000} Account Whose Credentials Were Used: Account Name: DWM-1 Account Domain: Window Manager Logon GUID: {00000000-0000-0000-0000-000000000000} Target Server: Target Server Name: localhost Additional Information: localhost Process Information: Process ID: 0x524 Process Name: C:\Windows\System32\winlogon.exe Network Information: Network Address: - Port: - This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
|
| | Security | Audit Success | 12544 | 2025-11-30 01:20:03 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 2 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1842 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-90-0-1 Account Name: DWM-1 Account Domain: Window Manager Logon ID: 0x16bd3 Linked Logon ID: 0x16c18 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x524 Process Name: C:\Windows\System32\winlogon.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-30 01:20:03 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 2 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1842 Elevated Token: %%1843 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-90-0-1 Account Name: DWM-1 Account Domain: Window Manager Logon ID: 0x16c18 Linked Logon ID: 0x16bd3 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x524 Process Name: C:\Windows\System32\winlogon.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-30 01:20:03 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x504 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-30 01:20:03 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x504 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-30 01:20:03 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-19 Account Name: LOCAL SERVICE Account Domain: NT AUTHORITY Logon ID: 0x3e5 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x504 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-30 01:20:03 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x504 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-30 01:20:03 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x504 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-30 01:20:03 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x504 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-30 01:20:03 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x504 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-30 01:20:03 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x504 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-30 01:20:03 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x504 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-30 01:20:03 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x504 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-30 01:20:03 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x504 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-30 01:20:03 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x504 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-30 01:20:03 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x504 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-30 01:20:03 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x504 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-30 01:20:03 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x504 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-30 01:20:03 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x504 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-30 01:20:03 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x504 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-30 01:20:03 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x504 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-30 01:20:03 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x504 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-30 01:20:03 | | Microsoft-Windows-Security-Auditing | 4648: A logon was attempted using explicit credentials. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon GUID: {00000000-0000-0000-0000-000000000000} Account Whose Credentials Were Used: Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon GUID: {00000000-0000-0000-0000-000000000000} Target Server: Target Server Name: localhost Additional Information: localhost Process Information: Process ID: 0x970 Process Name: C:\Windows\System32\svchost.exe Network Information: Network Address: 127.0.0.1 Port: 0 This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
|
| | Security | Audit Success | 12544 | 2025-11-30 01:20:03 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 2 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x3007d Linked Logon ID: 0x3021d Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x970 Process Name: C:\Windows\System32\svchost.exe Network Information: Workstation Name: DESKTOP-0JV7HJV Source Network Address: 127.0.0.1 Source Port: 0 Detailed Authentication Information: Logon Process: User32 Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-30 01:20:03 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 2 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1843 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x3021d Linked Logon ID: 0x3007d Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x970 Process Name: C:\Windows\System32\svchost.exe Network Information: Workstation Name: DESKTOP-0JV7HJV Source Network Address: 127.0.0.1 Source Port: 0 Detailed Authentication Information: Logon Process: User32 Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-30 01:20:03 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x504 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-30 01:20:03 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x504 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-30 01:20:03 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x504 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-30 01:20:03 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x504 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-30 01:20:03 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x504 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-30 01:20:03 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x504 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-30 01:20:03 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x504 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12548 | 2025-11-30 01:20:03 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-90-0-1 Account Name: DWM-1 Account Domain: Window Manager Logon ID: 0x16bd3 Privileges: SeAssignPrimaryTokenPrivilege SeAuditPrivilege SeImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-30 01:20:03 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-90-0-1 Account Name: DWM-1 Account Domain: Window Manager Logon ID: 0x16c18 Privileges: SeAssignPrimaryTokenPrivilege SeAuditPrivilege
|
| | Security | Audit Success | 12548 | 2025-11-30 01:20:03 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-30 01:20:03 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-30 01:20:03 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-19 Account Name: LOCAL SERVICE Account Domain: NT AUTHORITY Logon ID: 0x3e5 Privileges: SeAssignPrimaryTokenPrivilege SeAuditPrivilege SeImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-30 01:20:03 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-30 01:20:03 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-30 01:20:03 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-30 01:20:03 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-30 01:20:03 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-30 01:20:03 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-30 01:20:03 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-30 01:20:03 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-30 01:20:03 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-30 01:20:03 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-30 01:20:03 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-30 01:20:03 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-30 01:20:03 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-30 01:20:03 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-30 01:20:03 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-30 01:20:03 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-30 01:20:03 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x3007d Privileges: SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-30 01:20:03 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-30 01:20:03 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-30 01:20:03 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-30 01:20:03 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-30 01:20:03 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-30 01:20:03 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-30 01:20:03 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 13824 | 2025-11-30 01:20:03 | | Microsoft-Windows-Security-Auditing | 4798: A user's local group membership was enumerated. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 User: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Process Information: Process ID: 0x544 Process Name: C:\Windows\System32\lsass.exe
|
| | Security | Audit Success | 13826 | 2025-11-30 01:20:03 | | Microsoft-Windows-Security-Auditing | 4799: A security-enabled local group membership was enumerated. Subject: Security ID: S-1-5-20 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e4 Group: Security ID: S-1-5-32-544 Group Name: Administrators Group Domain: Builtin Process Information: Process ID: 0x760 Process Name: C:\Windows\System32\svchost.exe
|
| | Security | Audit Success | 13826 | 2025-11-30 01:20:03 | | Microsoft-Windows-Security-Auditing | 4799: A security-enabled local group membership was enumerated. Subject: Security ID: S-1-5-20 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e4 Group: Security ID: S-1-5-32-551 Group Name: Backup Operators Group Domain: Builtin Process Information: Process ID: 0x760 Process Name: C:\Windows\System32\svchost.exe
|
| | Security | Audit Success | 12544 | 2025-11-30 01:20:04 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x504 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12548 | 2025-11-30 01:20:04 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 13826 | 2025-11-30 01:20:04 | | Microsoft-Windows-Security-Auditing | 4799: A security-enabled local group membership was enumerated. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Group: Security ID: S-1-5-32-544 Group Name: Administrators Group Domain: Builtin Process Information: Process ID: 0x86c Process Name: C:\Windows\System32\svchost.exe
|
| | Security | Audit Success | 12288 | 2025-11-30 01:24:00 | | Microsoft-Windows-Security-Auditing | 4616: The system time was changed. Subject: Security ID: S-1-5-19 Account Name: LOCAL SERVICE Account Domain: NT AUTHORITY Logon ID: 0x3e5 Process Information: Process ID: 0x13b4 Name: C:\Windows\System32\svchost.exe Previous Time: 2025-11-30T09:20:04.5745366Z New Time: 2025-11-30T09:24:00.2842578Z This event is generated when the system time is changed. It is normal for the Windows Time Service, which runs with System privilege, to change the system time on a regular basis. Other system time changes may be indicative of attempts to tamper with the computer.
|
| | Security | Audit Success | 12288 | 2025-11-30 01:24:00 | | Microsoft-Windows-Security-Auditing | 4616: The system time was changed. Subject: Security ID: S-1-5-19 Account Name: LOCAL SERVICE Account Domain: NT AUTHORITY Logon ID: 0x3e5 Process Information: Process ID: 0x13b4 Name: C:\Windows\System32\svchost.exe Previous Time: 2025-11-30T09:24:00.2842578Z New Time: 2025-11-30T09:24:00.2854232Z This event is generated when the system time is changed. It is normal for the Windows Time Service, which runs with System privilege, to change the system time on a regular basis. Other system time changes may be indicative of attempts to tamper with the computer.
|
| | Security | Audit Success | 12288 | 2025-11-30 01:24:01 | | Microsoft-Windows-Security-Auditing | 4616: The system time was changed. Subject: Security ID: S-1-5-19 Account Name: LOCAL SERVICE Account Domain: NT AUTHORITY Logon ID: 0x3e5 Process Information: Process ID: 0x13b4 Name: C:\Windows\System32\svchost.exe Previous Time: 2025-11-30T09:24:01.3665405Z New Time: 2025-11-30T09:24:01.3712793Z This event is generated when the system time is changed. It is normal for the Windows Time Service, which runs with System privilege, to change the system time on a regular basis. Other system time changes may be indicative of attempts to tamper with the computer.
|
| | Security | Audit Success | 12292 | 2025-11-30 01:24:02 | | Microsoft-Windows-Security-Auditing | 5024: The Windows Firewall service started successfully.
|
| | Security | Audit Success | 12544 | 2025-11-30 01:24:02 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x504 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-30 01:24:02 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x504 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-30 01:24:02 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x504 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12548 | 2025-11-30 01:24:02 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-30 01:24:02 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-30 01:24:02 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12290 | 2025-11-30 01:24:03 | | Microsoft-Windows-Security-Auditing | 5061: Cryptographic operation. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x3021d Cryptographic Parameters: Provider Name: Microsoft Software Key Storage Provider Algorithm Name: ECDSA_P256 Key Name: Microsoft Connected Devices Platform device certificate Key Type: %%2500 Cryptographic Operation: Operation: %%2480 Return Code: 0x0
|
| | Security | Audit Success | 12290 | 2025-11-30 01:24:03 | | Microsoft-Windows-Security-Auditing | 5061: Cryptographic operation. Subject: Security ID: S-1-5-19 Account Name: LOCAL SERVICE Account Domain: NT AUTHORITY Logon ID: 0x3e5 Cryptographic Parameters: Provider Name: Microsoft Software Key Storage Provider Algorithm Name: ECDSA_P256 Key Name: Microsoft Connected Devices Platform device certificate Key Type: %%2500 Cryptographic Operation: Operation: %%2480 Return Code: 0x0
|
| | Security | Audit Success | 12292 | 2025-11-30 01:24:03 | | Microsoft-Windows-Security-Auditing | 5058: Key file operation. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x3021d Process Information: Process ID: 5080 Process Creation Time: 2025-11-30T09:24:02.9795436Z Cryptographic Parameters: Provider Name: Microsoft Software Key Storage Provider Algorithm Name: UNKNOWN Key Name: Microsoft Connected Devices Platform device certificate Key Type: %%2500 Key File Operation Information: File Path: C:\Users\CogiArt\AppData\Roaming\Microsoft\Crypto\Keys\de7cf8a7901d2ad13e5c67c29e5d1662_9ee7012e-fa60-42be-b8b4-8dc8b4e1280d Operation: %%2458 Return Code: 0x0
|
| | Security | Audit Success | 12292 | 2025-11-30 01:24:03 | | Microsoft-Windows-Security-Auditing | 5059: Key migration operation. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x3021d Process Information: Process ID: 5080 Process Creation Time: 2025-11-30T09:24:02.9795436Z Cryptographic Parameters: Provider Name: Microsoft Software Key Storage Provider Algorithm Name: ECDSA_P256 Key Name: Microsoft Connected Devices Platform device certificate Key Type: %%2500 Additional Information: Operation: %%2464 Return Code: 0x0
|
| | Security | Audit Success | 12292 | 2025-11-30 01:24:03 | | Microsoft-Windows-Security-Auditing | 5058: Key file operation. Subject: Security ID: S-1-5-19 Account Name: LOCAL SERVICE Account Domain: NT AUTHORITY Logon ID: 0x3e5 Process Information: Process ID: 5720 Process Creation Time: 2025-11-30T09:24:03.2207980Z Cryptographic Parameters: Provider Name: Microsoft Software Key Storage Provider Algorithm Name: UNKNOWN Key Name: Microsoft Connected Devices Platform device certificate Key Type: %%2500 Key File Operation Information: File Path: C:\WINDOWS\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Crypto\Keys\de7cf8a7901d2ad13e5c67c29e5d1662_9ee7012e-fa60-42be-b8b4-8dc8b4e1280d Operation: %%2458 Return Code: 0x0
|
| | Security | Audit Success | 12292 | 2025-11-30 01:24:03 | | Microsoft-Windows-Security-Auditing | 5059: Key migration operation. Subject: Security ID: S-1-5-19 Account Name: LOCAL SERVICE Account Domain: NT AUTHORITY Logon ID: 0x3e5 Process Information: Process ID: 5720 Process Creation Time: 2025-11-30T09:24:03.2207980Z Cryptographic Parameters: Provider Name: Microsoft Software Key Storage Provider Algorithm Name: ECDSA_P256 Key Name: Microsoft Connected Devices Platform device certificate Key Type: %%2500 Additional Information: Operation: %%2464 Return Code: 0x0
|
| | Security | Audit Success | 12544 | 2025-11-30 01:24:03 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x504 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-30 01:24:03 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x504 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-30 01:24:03 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x504 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12548 | 2025-11-30 01:24:03 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-30 01:24:03 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-30 01:24:03 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 13824 | 2025-11-30 01:24:03 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-30 01:24:03 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-30 01:24:03 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-30 01:24:03 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-30 01:24:03 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-30 01:24:03 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-30 01:24:03 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x3021d Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-30 01:24:03 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x3021d Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-30 01:24:03 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x3021d Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-30 01:24:04 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-30 01:24:04 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-30 01:24:04 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-30 01:24:04 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-30 01:24:04 | | Microsoft-Windows-Security-Auditing | 4798: A user's local group membership was enumerated. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 User: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Process Information: Process ID: 0x6e0 Process Name: C:\Windows\System32\LogonUI.exe
|
| | Security | Audit Success | 13824 | 2025-11-30 01:24:04 | | Microsoft-Windows-Security-Auditing | 4798: A user's local group membership was enumerated. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x3021d User: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Process Information: Process ID: 0x1688 Process Name: C:\Windows\explorer.exe
|
| | Security | Audit Success | 12544 | 2025-11-30 01:24:05 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x504 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12548 | 2025-11-30 01:24:05 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 13824 | 2025-11-30 01:24:05 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x3021d Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-30 01:24:05 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x3021d Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-30 01:24:05 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x3021d Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13824 | 2025-11-30 01:24:05 | | Microsoft-Windows-Security-Auditing | 5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x3021d Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
|
| | Security | Audit Success | 13826 | 2025-11-30 01:24:05 | | Microsoft-Windows-Security-Auditing | 4799: A security-enabled local group membership was enumerated. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Group: Security ID: S-1-5-32-544 Group Name: Administrators Group Domain: Builtin Process Information: Process ID: 0x1a04 Process Name: C:\Windows\System32\SearchIndexer.exe
|
| | Security | Audit Success | 13826 | 2025-11-30 01:24:05 | | Microsoft-Windows-Security-Auditing | 4799: A security-enabled local group membership was enumerated. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Group: Security ID: S-1-5-32-551 Group Name: Backup Operators Group Domain: Builtin Process Information: Process ID: 0x1a04 Process Name: C:\Windows\System32\SearchIndexer.exe
|
| | Security | Audit Success | 13824 | 2025-11-30 01:24:06 | | Microsoft-Windows-Security-Auditing | 4798: A user's local group membership was enumerated. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x3021d User: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Process Information: Process ID: 0x1688 Process Name: C:\Windows\explorer.exe
|
| | Security | Audit Success | 12544 | 2025-11-30 01:24:07 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x504 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12548 | 2025-11-30 01:24:07 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 13824 | 2025-11-30 01:24:08 | | Microsoft-Windows-Security-Auditing | 4798: A user's local group membership was enumerated. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x3007d User: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Process Information: Process ID: 0x13dc Process Name: C:\Program Files\AMD\CIM\Bin64\InstallManagerApp.exe
|
| | Security | Audit Success | 12544 | 2025-11-30 01:24:09 | | Microsoft-Windows-Security-Auditing | 4648: A logon was attempted using explicit credentials. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon GUID: {00000000-0000-0000-0000-000000000000} Account Whose Credentials Were Used: Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon GUID: {00000000-0000-0000-0000-000000000000} Target Server: Target Server Name: localhost Additional Information: localhost Process Information: Process ID: 0x970 Process Name: C:\Windows\System32\svchost.exe Network Information: Network Address: 127.0.0.1 Port: 0 This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
|
| | Security | Audit Success | 12544 | 2025-11-30 01:24:09 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 2 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0xcdbbc Linked Logon ID: 0xcdbe7 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x970 Process Name: C:\Windows\System32\svchost.exe Network Information: Workstation Name: DESKTOP-0JV7HJV Source Network Address: 127.0.0.1 Source Port: 0 Detailed Authentication Information: Logon Process: User32 Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-30 01:24:09 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 2 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1843 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0xcdbe7 Linked Logon ID: 0xcdbbc Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x970 Process Name: C:\Windows\System32\svchost.exe Network Information: Workstation Name: DESKTOP-0JV7HJV Source Network Address: 127.0.0.1 Source Port: 0 Detailed Authentication Information: Logon Process: User32 Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12545 | 2025-11-30 01:24:09 | | Microsoft-Windows-Security-Auditing | 4634: An account was logged off. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0xcdbe7 Logon Type: 2 This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
|
| | Security | Audit Success | 12545 | 2025-11-30 01:24:09 | | Microsoft-Windows-Security-Auditing | 4634: An account was logged off. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0xcdbbc Logon Type: 2 This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
|
| | Security | Audit Success | 12548 | 2025-11-30 01:24:09 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0xcdbbc Privileges: SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 13824 | 2025-11-30 01:24:09 | | Microsoft-Windows-Security-Auditing | 4798: A user's local group membership was enumerated. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 User: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Process Information: Process ID: 0x544 Process Name: C:\Windows\System32\lsass.exe
|
| | Security | Audit Success | 13824 | 2025-11-30 01:24:09 | | Microsoft-Windows-Security-Auditing | 4798: A user's local group membership was enumerated. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x3007d User: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Process Information: Process ID: 0x251c Process Name: C:\Program Files\AMD\CIM\Bin64\InstallManagerApp.exe
|
| | Security | Audit Success | 12544 | 2025-11-30 01:24:12 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x504 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12548 | 2025-11-30 01:24:12 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 13826 | 2025-11-30 01:24:13 | | Microsoft-Windows-Security-Auditing | 4799: A security-enabled local group membership was enumerated. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Group: Security ID: S-1-5-32-544 Group Name: Administrators Group Domain: Builtin Process Information: Process ID: 0x10bc Process Name: C:\Windows\System32\svchost.exe
|
| | Security | Audit Success | 13826 | 2025-11-30 01:24:13 | | Microsoft-Windows-Security-Auditing | 4799: A security-enabled local group membership was enumerated. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Group: Security ID: S-1-5-32-551 Group Name: Backup Operators Group Domain: Builtin Process Information: Process ID: 0x10bc Process Name: C:\Windows\System32\svchost.exe
|
| | Security | Audit Success | 12544 | 2025-11-30 01:24:20 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x504 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12548 | 2025-11-30 01:24:20 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12544 | 2025-11-30 01:25:30 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x504 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12548 | 2025-11-30 01:25:30 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12544 | 2025-11-30 01:26:02 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x504 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12548 | 2025-11-30 01:26:02 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12544 | 2025-11-30 01:26:03 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x504 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-30 01:26:03 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x504 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-30 01:26:03 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x504 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12548 | 2025-11-30 01:26:03 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-30 01:26:03 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-30 01:26:03 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12544 | 2025-11-30 01:26:04 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x504 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12544 | 2025-11-30 01:26:04 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x504 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12548 | 2025-11-30 01:26:04 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 12548 | 2025-11-30 01:26:04 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | Security | Audit Success | 13824 | 2025-11-30 01:27:22 | | Microsoft-Windows-Security-Auditing | 4798: A user's local group membership was enumerated. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x3007d User: Security ID: S-1-5-21-2954332259-1466799094-2054226798-500 Account Name: Administrator Account Domain: DESKTOP-0JV7HJV Process Information: Process ID: 0x2470 Process Name: C:\Program Files\FinalWire\AIDA64 Extreme\aida64.exe
|
| | Security | Audit Success | 13824 | 2025-11-30 01:27:22 | | Microsoft-Windows-Security-Auditing | 4798: A user's local group membership was enumerated. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x3007d User: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Process Information: Process ID: 0x2470 Process Name: C:\Program Files\FinalWire\AIDA64 Extreme\aida64.exe
|
| | Security | Audit Success | 13824 | 2025-11-30 01:27:22 | | Microsoft-Windows-Security-Auditing | 4798: A user's local group membership was enumerated. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x3007d User: Security ID: S-1-5-21-2954332259-1466799094-2054226798-503 Account Name: DefaultAccount Account Domain: DESKTOP-0JV7HJV Process Information: Process ID: 0x2470 Process Name: C:\Program Files\FinalWire\AIDA64 Extreme\aida64.exe
|
| | Security | Audit Success | 13824 | 2025-11-30 01:27:22 | | Microsoft-Windows-Security-Auditing | 4798: A user's local group membership was enumerated. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x3007d User: Security ID: S-1-5-21-2954332259-1466799094-2054226798-501 Account Name: Guest Account Domain: DESKTOP-0JV7HJV Process Information: Process ID: 0x2470 Process Name: C:\Program Files\FinalWire\AIDA64 Extreme\aida64.exe
|
| | Security | Audit Success | 13824 | 2025-11-30 01:27:22 | | Microsoft-Windows-Security-Auditing | 4798: A user's local group membership was enumerated. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x3007d User: Security ID: S-1-5-21-2954332259-1466799094-2054226798-504 Account Name: WDAGUtilityAccount Account Domain: DESKTOP-0JV7HJV Process Information: Process ID: 0x2470 Process Name: C:\Program Files\FinalWire\AIDA64 Extreme\aida64.exe
|
| | Security | Audit Success | 13824 | 2025-11-30 01:27:22 | | Microsoft-Windows-Security-Auditing | 4798: A user's local group membership was enumerated. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x3007d User: Security ID: S-1-5-21-2954332259-1466799094-2054226798-500 Account Name: Administrator Account Domain: DESKTOP-0JV7HJV Process Information: Process ID: 0x2470 Process Name: C:\Program Files\FinalWire\AIDA64 Extreme\aida64.exe
|
| | Security | Audit Success | 13824 | 2025-11-30 01:27:22 | | Microsoft-Windows-Security-Auditing | 4798: A user's local group membership was enumerated. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x3007d User: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Process Information: Process ID: 0x2470 Process Name: C:\Program Files\FinalWire\AIDA64 Extreme\aida64.exe
|
| | Security | Audit Success | 13824 | 2025-11-30 01:27:22 | | Microsoft-Windows-Security-Auditing | 4798: A user's local group membership was enumerated. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x3007d User: Security ID: S-1-5-21-2954332259-1466799094-2054226798-503 Account Name: DefaultAccount Account Domain: DESKTOP-0JV7HJV Process Information: Process ID: 0x2470 Process Name: C:\Program Files\FinalWire\AIDA64 Extreme\aida64.exe
|
| | Security | Audit Success | 13824 | 2025-11-30 01:27:22 | | Microsoft-Windows-Security-Auditing | 4798: A user's local group membership was enumerated. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x3007d User: Security ID: S-1-5-21-2954332259-1466799094-2054226798-501 Account Name: Guest Account Domain: DESKTOP-0JV7HJV Process Information: Process ID: 0x2470 Process Name: C:\Program Files\FinalWire\AIDA64 Extreme\aida64.exe
|
| | Security | Audit Success | 13824 | 2025-11-30 01:27:22 | | Microsoft-Windows-Security-Auditing | 4798: A user's local group membership was enumerated. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x3007d User: Security ID: S-1-5-21-2954332259-1466799094-2054226798-504 Account Name: WDAGUtilityAccount Account Domain: DESKTOP-0JV7HJV Process Information: Process ID: 0x2470 Process Name: C:\Program Files\FinalWire\AIDA64 Extreme\aida64.exe
|
| | Security | Audit Success | 13824 | 2025-11-30 01:27:22 | | Microsoft-Windows-Security-Auditing | 4798: A user's local group membership was enumerated. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x3007d User: Security ID: S-1-5-21-2954332259-1466799094-2054226798-500 Account Name: Administrator Account Domain: DESKTOP-0JV7HJV Process Information: Process ID: 0x2470 Process Name: C:\Program Files\FinalWire\AIDA64 Extreme\aida64.exe
|
| | Security | Audit Success | 13824 | 2025-11-30 01:27:22 | | Microsoft-Windows-Security-Auditing | 4798: A user's local group membership was enumerated. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x3007d User: Security ID: S-1-5-21-2954332259-1466799094-2054226798-500 Account Name: Administrator Account Domain: DESKTOP-0JV7HJV Process Information: Process ID: 0x2470 Process Name: C:\Program Files\FinalWire\AIDA64 Extreme\aida64.exe
|
| | Security | Audit Success | 13824 | 2025-11-30 01:27:22 | | Microsoft-Windows-Security-Auditing | 4798: A user's local group membership was enumerated. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x3007d User: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Process Information: Process ID: 0x2470 Process Name: C:\Program Files\FinalWire\AIDA64 Extreme\aida64.exe
|
| | Security | Audit Success | 13824 | 2025-11-30 01:27:22 | | Microsoft-Windows-Security-Auditing | 4798: A user's local group membership was enumerated. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x3007d User: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Process Information: Process ID: 0x2470 Process Name: C:\Program Files\FinalWire\AIDA64 Extreme\aida64.exe
|
| | Security | Audit Success | 13824 | 2025-11-30 01:27:22 | | Microsoft-Windows-Security-Auditing | 4798: A user's local group membership was enumerated. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x3007d User: Security ID: S-1-5-21-2954332259-1466799094-2054226798-503 Account Name: DefaultAccount Account Domain: DESKTOP-0JV7HJV Process Information: Process ID: 0x2470 Process Name: C:\Program Files\FinalWire\AIDA64 Extreme\aida64.exe
|
| | Security | Audit Success | 13824 | 2025-11-30 01:27:22 | | Microsoft-Windows-Security-Auditing | 4798: A user's local group membership was enumerated. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x3007d User: Security ID: S-1-5-21-2954332259-1466799094-2054226798-503 Account Name: DefaultAccount Account Domain: DESKTOP-0JV7HJV Process Information: Process ID: 0x2470 Process Name: C:\Program Files\FinalWire\AIDA64 Extreme\aida64.exe
|
| | Security | Audit Success | 13824 | 2025-11-30 01:27:22 | | Microsoft-Windows-Security-Auditing | 4798: A user's local group membership was enumerated. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x3007d User: Security ID: S-1-5-21-2954332259-1466799094-2054226798-501 Account Name: Guest Account Domain: DESKTOP-0JV7HJV Process Information: Process ID: 0x2470 Process Name: C:\Program Files\FinalWire\AIDA64 Extreme\aida64.exe
|
| | Security | Audit Success | 13824 | 2025-11-30 01:27:22 | | Microsoft-Windows-Security-Auditing | 4798: A user's local group membership was enumerated. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x3007d User: Security ID: S-1-5-21-2954332259-1466799094-2054226798-501 Account Name: Guest Account Domain: DESKTOP-0JV7HJV Process Information: Process ID: 0x2470 Process Name: C:\Program Files\FinalWire\AIDA64 Extreme\aida64.exe
|
| | Security | Audit Success | 13824 | 2025-11-30 01:27:22 | | Microsoft-Windows-Security-Auditing | 4798: A user's local group membership was enumerated. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x3007d User: Security ID: S-1-5-21-2954332259-1466799094-2054226798-504 Account Name: WDAGUtilityAccount Account Domain: DESKTOP-0JV7HJV Process Information: Process ID: 0x2470 Process Name: C:\Program Files\FinalWire\AIDA64 Extreme\aida64.exe
|
| | Security | Audit Success | 13824 | 2025-11-30 01:27:22 | | Microsoft-Windows-Security-Auditing | 4798: A user's local group membership was enumerated. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x3007d User: Security ID: S-1-5-21-2954332259-1466799094-2054226798-504 Account Name: WDAGUtilityAccount Account Domain: DESKTOP-0JV7HJV Process Information: Process ID: 0x2470 Process Name: C:\Program Files\FinalWire\AIDA64 Extreme\aida64.exe
|
| | Security | Audit Success | 13824 | 2025-11-30 01:27:22 | | Microsoft-Windows-Security-Auditing | 4798: A user's local group membership was enumerated. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x3007d User: Security ID: S-1-5-21-2954332259-1466799094-2054226798-500 Account Name: Administrator Account Domain: DESKTOP-0JV7HJV Process Information: Process ID: 0x2470 Process Name: C:\Program Files\FinalWire\AIDA64 Extreme\aida64.exe
|
| | Security | Audit Success | 13824 | 2025-11-30 01:27:22 | | Microsoft-Windows-Security-Auditing | 4798: A user's local group membership was enumerated. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x3007d User: Security ID: S-1-5-21-2954332259-1466799094-2054226798-500 Account Name: Administrator Account Domain: DESKTOP-0JV7HJV Process Information: Process ID: 0x2470 Process Name: C:\Program Files\FinalWire\AIDA64 Extreme\aida64.exe
|
| | Security | Audit Success | 13824 | 2025-11-30 01:27:22 | | Microsoft-Windows-Security-Auditing | 4798: A user's local group membership was enumerated. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x3007d User: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Process Information: Process ID: 0x2470 Process Name: C:\Program Files\FinalWire\AIDA64 Extreme\aida64.exe
|
| | Security | Audit Success | 13824 | 2025-11-30 01:27:22 | | Microsoft-Windows-Security-Auditing | 4798: A user's local group membership was enumerated. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x3007d User: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Process Information: Process ID: 0x2470 Process Name: C:\Program Files\FinalWire\AIDA64 Extreme\aida64.exe
|
| | Security | Audit Success | 13824 | 2025-11-30 01:27:22 | | Microsoft-Windows-Security-Auditing | 4798: A user's local group membership was enumerated. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x3007d User: Security ID: S-1-5-21-2954332259-1466799094-2054226798-501 Account Name: Guest Account Domain: DESKTOP-0JV7HJV Process Information: Process ID: 0x2470 Process Name: C:\Program Files\FinalWire\AIDA64 Extreme\aida64.exe
|
| | Security | Audit Success | 13824 | 2025-11-30 01:27:22 | | Microsoft-Windows-Security-Auditing | 4798: A user's local group membership was enumerated. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x3007d User: Security ID: S-1-5-21-2954332259-1466799094-2054226798-501 Account Name: Guest Account Domain: DESKTOP-0JV7HJV Process Information: Process ID: 0x2470 Process Name: C:\Program Files\FinalWire\AIDA64 Extreme\aida64.exe
|
| | Security | Audit Success | 13824 | 2025-11-30 01:27:22 | | Microsoft-Windows-Security-Auditing | 4798: A user's local group membership was enumerated. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x3007d User: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Process Information: Process ID: 0x2470 Process Name: C:\Program Files\FinalWire\AIDA64 Extreme\aida64.exe
|
| | Security | Audit Success | 13824 | 2025-11-30 01:27:22 | | Microsoft-Windows-Security-Auditing | 4798: A user's local group membership was enumerated. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x3007d User: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Process Information: Process ID: 0x2470 Process Name: C:\Program Files\FinalWire\AIDA64 Extreme\aida64.exe
|
| | Security | Audit Success | 13824 | 2025-11-30 01:27:22 | | Microsoft-Windows-Security-Auditing | 4798: A user's local group membership was enumerated. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x3007d User: Security ID: S-1-5-21-2954332259-1466799094-2054226798-503 Account Name: DefaultAccount Account Domain: DESKTOP-0JV7HJV Process Information: Process ID: 0x2470 Process Name: C:\Program Files\FinalWire\AIDA64 Extreme\aida64.exe
|
| | Security | Audit Success | 13824 | 2025-11-30 01:27:22 | | Microsoft-Windows-Security-Auditing | 4798: A user's local group membership was enumerated. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x3007d User: Security ID: S-1-5-21-2954332259-1466799094-2054226798-503 Account Name: DefaultAccount Account Domain: DESKTOP-0JV7HJV Process Information: Process ID: 0x2470 Process Name: C:\Program Files\FinalWire\AIDA64 Extreme\aida64.exe
|
| | Security | Audit Success | 13824 | 2025-11-30 01:27:22 | | Microsoft-Windows-Security-Auditing | 4798: A user's local group membership was enumerated. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x3007d User: Security ID: S-1-5-21-2954332259-1466799094-2054226798-500 Account Name: Administrator Account Domain: DESKTOP-0JV7HJV Process Information: Process ID: 0x2470 Process Name: C:\Program Files\FinalWire\AIDA64 Extreme\aida64.exe
|
| | Security | Audit Success | 13824 | 2025-11-30 01:27:22 | | Microsoft-Windows-Security-Auditing | 4798: A user's local group membership was enumerated. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x3007d User: Security ID: S-1-5-21-2954332259-1466799094-2054226798-500 Account Name: Administrator Account Domain: DESKTOP-0JV7HJV Process Information: Process ID: 0x2470 Process Name: C:\Program Files\FinalWire\AIDA64 Extreme\aida64.exe
|
| | Security | Audit Success | 13824 | 2025-11-30 01:27:22 | | Microsoft-Windows-Security-Auditing | 4798: A user's local group membership was enumerated. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x3007d User: Security ID: S-1-5-21-2954332259-1466799094-2054226798-501 Account Name: Guest Account Domain: DESKTOP-0JV7HJV Process Information: Process ID: 0x2470 Process Name: C:\Program Files\FinalWire\AIDA64 Extreme\aida64.exe
|
| | Security | Audit Success | 13824 | 2025-11-30 01:27:22 | | Microsoft-Windows-Security-Auditing | 4798: A user's local group membership was enumerated. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x3007d User: Security ID: S-1-5-21-2954332259-1466799094-2054226798-501 Account Name: Guest Account Domain: DESKTOP-0JV7HJV Process Information: Process ID: 0x2470 Process Name: C:\Program Files\FinalWire\AIDA64 Extreme\aida64.exe
|
| | Security | Audit Success | 13824 | 2025-11-30 01:27:22 | | Microsoft-Windows-Security-Auditing | 4798: A user's local group membership was enumerated. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x3007d User: Security ID: S-1-5-21-2954332259-1466799094-2054226798-503 Account Name: DefaultAccount Account Domain: DESKTOP-0JV7HJV Process Information: Process ID: 0x2470 Process Name: C:\Program Files\FinalWire\AIDA64 Extreme\aida64.exe
|
| | Security | Audit Success | 13824 | 2025-11-30 01:27:22 | | Microsoft-Windows-Security-Auditing | 4798: A user's local group membership was enumerated. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x3007d User: Security ID: S-1-5-21-2954332259-1466799094-2054226798-503 Account Name: DefaultAccount Account Domain: DESKTOP-0JV7HJV Process Information: Process ID: 0x2470 Process Name: C:\Program Files\FinalWire\AIDA64 Extreme\aida64.exe
|
| | Security | Audit Success | 13824 | 2025-11-30 01:27:22 | | Microsoft-Windows-Security-Auditing | 4798: A user's local group membership was enumerated. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x3007d User: Security ID: S-1-5-21-2954332259-1466799094-2054226798-504 Account Name: WDAGUtilityAccount Account Domain: DESKTOP-0JV7HJV Process Information: Process ID: 0x2470 Process Name: C:\Program Files\FinalWire\AIDA64 Extreme\aida64.exe
|
| | Security | Audit Success | 13824 | 2025-11-30 01:27:22 | | Microsoft-Windows-Security-Auditing | 4798: A user's local group membership was enumerated. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x3007d User: Security ID: S-1-5-21-2954332259-1466799094-2054226798-504 Account Name: WDAGUtilityAccount Account Domain: DESKTOP-0JV7HJV Process Information: Process ID: 0x2470 Process Name: C:\Program Files\FinalWire\AIDA64 Extreme\aida64.exe
|
| | Security | Audit Success | 13824 | 2025-11-30 01:27:22 | | Microsoft-Windows-Security-Auditing | 4798: A user's local group membership was enumerated. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x3007d User: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Process Information: Process ID: 0x2470 Process Name: C:\Program Files\FinalWire\AIDA64 Extreme\aida64.exe
|
| | Security | Audit Success | 13824 | 2025-11-30 01:27:22 | | Microsoft-Windows-Security-Auditing | 4798: A user's local group membership was enumerated. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x3007d User: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Process Information: Process ID: 0x2470 Process Name: C:\Program Files\FinalWire\AIDA64 Extreme\aida64.exe
|
| | Security | Audit Success | 13826 | 2025-11-30 01:27:22 | | Microsoft-Windows-Security-Auditing | 4799: A security-enabled local group membership was enumerated. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x3007d Group: Security ID: S-1-5-32-579 Group Name: Access Control Assistance Operators Group Domain: Builtin Process Information: Process ID: 0x2470 Process Name: C:\Program Files\FinalWire\AIDA64 Extreme\aida64.exe
|
| | Security | Audit Success | 13826 | 2025-11-30 01:27:22 | | Microsoft-Windows-Security-Auditing | 4799: A security-enabled local group membership was enumerated. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x3007d Group: Security ID: S-1-5-32-544 Group Name: Administrators Group Domain: Builtin Process Information: Process ID: 0x2470 Process Name: C:\Program Files\FinalWire\AIDA64 Extreme\aida64.exe
|
| | Security | Audit Success | 13826 | 2025-11-30 01:27:22 | | Microsoft-Windows-Security-Auditing | 4799: A security-enabled local group membership was enumerated. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x3007d Group: Security ID: S-1-5-32-551 Group Name: Backup Operators Group Domain: Builtin Process Information: Process ID: 0x2470 Process Name: C:\Program Files\FinalWire\AIDA64 Extreme\aida64.exe
|
| | Security | Audit Success | 13826 | 2025-11-30 01:27:22 | | Microsoft-Windows-Security-Auditing | 4799: A security-enabled local group membership was enumerated. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x3007d Group: Security ID: S-1-5-32-569 Group Name: Cryptographic Operators Group Domain: Builtin Process Information: Process ID: 0x2470 Process Name: C:\Program Files\FinalWire\AIDA64 Extreme\aida64.exe
|
| | Security | Audit Success | 13826 | 2025-11-30 01:27:22 | | Microsoft-Windows-Security-Auditing | 4799: A security-enabled local group membership was enumerated. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x3007d Group: Security ID: S-1-5-32-583 Group Name: Device Owners Group Domain: Builtin Process Information: Process ID: 0x2470 Process Name: C:\Program Files\FinalWire\AIDA64 Extreme\aida64.exe
|
| | Security | Audit Success | 13826 | 2025-11-30 01:27:22 | | Microsoft-Windows-Security-Auditing | 4799: A security-enabled local group membership was enumerated. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x3007d Group: Security ID: S-1-5-32-562 Group Name: Distributed COM Users Group Domain: Builtin Process Information: Process ID: 0x2470 Process Name: C:\Program Files\FinalWire\AIDA64 Extreme\aida64.exe
|
| | Security | Audit Success | 13826 | 2025-11-30 01:27:22 | | Microsoft-Windows-Security-Auditing | 4799: A security-enabled local group membership was enumerated. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x3007d Group: Security ID: S-1-5-32-573 Group Name: Event Log Readers Group Domain: Builtin Process Information: Process ID: 0x2470 Process Name: C:\Program Files\FinalWire\AIDA64 Extreme\aida64.exe
|
| | Security | Audit Success | 13826 | 2025-11-30 01:27:22 | | Microsoft-Windows-Security-Auditing | 4799: A security-enabled local group membership was enumerated. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x3007d Group: Security ID: S-1-5-32-546 Group Name: Guests Group Domain: Builtin Process Information: Process ID: 0x2470 Process Name: C:\Program Files\FinalWire\AIDA64 Extreme\aida64.exe
|
| | Security | Audit Success | 13826 | 2025-11-30 01:27:22 | | Microsoft-Windows-Security-Auditing | 4799: A security-enabled local group membership was enumerated. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x3007d Group: Security ID: S-1-5-32-578 Group Name: Hyper-V Administrators Group Domain: Builtin Process Information: Process ID: 0x2470 Process Name: C:\Program Files\FinalWire\AIDA64 Extreme\aida64.exe
|
| | Security | Audit Success | 13826 | 2025-11-30 01:27:22 | | Microsoft-Windows-Security-Auditing | 4799: A security-enabled local group membership was enumerated. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x3007d Group: Security ID: S-1-5-32-568 Group Name: IIS_IUSRS Group Domain: Builtin Process Information: Process ID: 0x2470 Process Name: C:\Program Files\FinalWire\AIDA64 Extreme\aida64.exe
|
| | Security | Audit Success | 13826 | 2025-11-30 01:27:22 | | Microsoft-Windows-Security-Auditing | 4799: A security-enabled local group membership was enumerated. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x3007d Group: Security ID: S-1-5-32-556 Group Name: Network Configuration Operators Group Domain: Builtin Process Information: Process ID: 0x2470 Process Name: C:\Program Files\FinalWire\AIDA64 Extreme\aida64.exe
|
| | Security | Audit Success | 13826 | 2025-11-30 01:27:22 | | Microsoft-Windows-Security-Auditing | 4799: A security-enabled local group membership was enumerated. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x3007d Group: Security ID: S-1-5-32-585 Group Name: OpenSSH Users Group Domain: Builtin Process Information: Process ID: 0x2470 Process Name: C:\Program Files\FinalWire\AIDA64 Extreme\aida64.exe
|
| | Security | Audit Success | 13826 | 2025-11-30 01:27:22 | | Microsoft-Windows-Security-Auditing | 4799: A security-enabled local group membership was enumerated. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x3007d Group: Security ID: S-1-5-32-559 Group Name: Performance Log Users Group Domain: Builtin Process Information: Process ID: 0x2470 Process Name: C:\Program Files\FinalWire\AIDA64 Extreme\aida64.exe
|
| | Security | Audit Success | 13826 | 2025-11-30 01:27:22 | | Microsoft-Windows-Security-Auditing | 4799: A security-enabled local group membership was enumerated. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x3007d Group: Security ID: S-1-5-32-558 Group Name: Performance Monitor Users Group Domain: Builtin Process Information: Process ID: 0x2470 Process Name: C:\Program Files\FinalWire\AIDA64 Extreme\aida64.exe
|
| | Security | Audit Success | 13826 | 2025-11-30 01:27:22 | | Microsoft-Windows-Security-Auditing | 4799: A security-enabled local group membership was enumerated. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x3007d Group: Security ID: S-1-5-32-547 Group Name: Power Users Group Domain: Builtin Process Information: Process ID: 0x2470 Process Name: C:\Program Files\FinalWire\AIDA64 Extreme\aida64.exe
|
| | Security | Audit Success | 13826 | 2025-11-30 01:27:22 | | Microsoft-Windows-Security-Auditing | 4799: A security-enabled local group membership was enumerated. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x3007d Group: Security ID: S-1-5-32-555 Group Name: Remote Desktop Users Group Domain: Builtin Process Information: Process ID: 0x2470 Process Name: C:\Program Files\FinalWire\AIDA64 Extreme\aida64.exe
|
| | Security | Audit Success | 13826 | 2025-11-30 01:27:22 | | Microsoft-Windows-Security-Auditing | 4799: A security-enabled local group membership was enumerated. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x3007d Group: Security ID: S-1-5-32-580 Group Name: Remote Management Users Group Domain: Builtin Process Information: Process ID: 0x2470 Process Name: C:\Program Files\FinalWire\AIDA64 Extreme\aida64.exe
|
| | Security | Audit Success | 13826 | 2025-11-30 01:27:22 | | Microsoft-Windows-Security-Auditing | 4799: A security-enabled local group membership was enumerated. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x3007d Group: Security ID: S-1-5-32-552 Group Name: Replicator Group Domain: Builtin Process Information: Process ID: 0x2470 Process Name: C:\Program Files\FinalWire\AIDA64 Extreme\aida64.exe
|
| | Security | Audit Success | 13826 | 2025-11-30 01:27:22 | | Microsoft-Windows-Security-Auditing | 4799: A security-enabled local group membership was enumerated. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x3007d Group: Security ID: S-1-5-32-581 Group Name: System Managed Accounts Group Group Domain: Builtin Process Information: Process ID: 0x2470 Process Name: C:\Program Files\FinalWire\AIDA64 Extreme\aida64.exe
|
| | Security | Audit Success | 13826 | 2025-11-30 01:27:22 | | Microsoft-Windows-Security-Auditing | 4799: A security-enabled local group membership was enumerated. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x3007d Group: Security ID: S-1-5-32-584 Group Name: User Mode Hardware Operators Group Domain: Builtin Process Information: Process ID: 0x2470 Process Name: C:\Program Files\FinalWire\AIDA64 Extreme\aida64.exe
|
| | Security | Audit Success | 13826 | 2025-11-30 01:27:22 | | Microsoft-Windows-Security-Auditing | 4799: A security-enabled local group membership was enumerated. Subject: Security ID: S-1-5-21-2954332259-1466799094-2054226798-1001 Account Name: CogiArt Account Domain: DESKTOP-0JV7HJV Logon ID: 0x3007d Group: Security ID: S-1-5-32-545 Group Name: Users Group Domain: Builtin Process Information: Process ID: 0x2470 Process Name: C:\Program Files\FinalWire\AIDA64 Extreme\aida64.exe
|
| | Security | Audit Success | 12544 | 2025-11-30 01:27:35 | | Microsoft-Windows-Security-Auditing | 4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-0JV7HJV$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x504 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
|
| | Security | Audit Success | 12548 | 2025-11-30 01:27:35 | | Microsoft-Windows-Security-Auditing | 4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
|
| | System | Error | None | 2025-11-29 04:06:48 | | Service Control Manager | 7023: The netprofm service terminated with the following error: %%21
|
| | System | Error | None | 2025-11-29 04:06:50 | LOCAL SERVICE | Microsoft-Windows-WHEA-Logger | 1: A fatal hardware error has occurred. A record describing the condition is contained in the data section of this event.
|
| | System | Warning | None | 2025-11-29 04:07:14 | | e1i68x64 | 27: Intel(R) 82574L Gigabit Network Connection Network link is disconnected.
|
| | System | Warning | None | 2025-11-29 04:07:14 | | e1i68x64 | 27: Intel(R) 82574L Gigabit Network Connection #2 Network link is disconnected.
|
| | System | Error | None | 2025-11-29 04:08:48 | | Service Control Manager | 7023: The Network List Service service terminated with the following error: %%21
|
| | System | Error | None | 2025-11-29 04:08:48 | SYSTEM | DCOM | 10010: The server {A47979D2-C419-11D9-A5B4-001185AD2B89} did not register with DCOM within the required timeout.
|
| | System | Error | None | 2025-11-29 04:08:50 | | Service Control Manager | 7030: The Printer Extensions and Notifications service is marked as an interactive service. However, the system is configured to not allow interactive services. This service may not function properly.
|
| | System | Warning | None | 2025-11-29 04:09:25 | | e1i68x64 | 27: Intel(R) 82574L Gigabit Network Connection Network link is disconnected.
|
| | System | Warning | None | 2025-11-29 04:09:25 | | e1i68x64 | 27: Intel(R) 82574L Gigabit Network Connection #2 Network link is disconnected.
|
| | System | Warning | None | 2025-11-29 04:09:28 | SYSTEM | Microsoft-Windows-Wininit | 15: Credential Guard and/or VBS Key Isolation are configured but the secure kernel is not running; continuing without them.
|
| | System | Error | None | 2025-11-29 04:09:38 | LOCAL SERVICE | Microsoft-Windows-WHEA-Logger | 1: A fatal hardware error has occurred. A record describing the condition is contained in the data section of this event.
|
| | System | Warning | None | 2025-11-29 04:09:38 | LOCAL SERVICE | Microsoft-Windows-Time-Service | 134: NtpClient was unable to set a manual peer to use as a time source because of DNS resolution error on 'time.windows.com,0x9'. NtpClient will try again in 15 minutes and double the reattempt interval thereafter. The error was: No such host is known. (0x80072AF9)
|
| | System | Warning | None | 2025-11-29 04:09:39 | LOCAL SERVICE | Microsoft-Windows-Time-Service | 134: NtpClient was unable to set a manual peer to use as a time source because of DNS resolution error on 'time.windows.com,0x9'. NtpClient will try again in 15 minutes and double the reattempt interval thereafter. The error was: No such host is known. (0x80072AF9)
|
| | System | Error | None | 2025-11-29 04:31:34 | CogiArt | DCOM | 10010: The server {544C4C52-DE0B-4D14-9510-21745381D5CA} did not register with DCOM within the required timeout.
|
| | System | Warning | None | 2025-11-29 04:31:39 | SYSTEM | winsrvext | 100: Process C:\Users\CogiArt\AppData\Local\Microsoft\OneDrive\25.087.0506.0001\Microsoft.SharePoint.exe is delaying system shutdown after 5015 milliseconds.
|
| | System | Warning | None | 2025-11-29 04:31:39 | SYSTEM | winsrvext | 100: Process C:\Users\CogiArt\AppData\Local\Microsoft\OneDrive\OneDrive.exe is delaying system shutdown after 5062 milliseconds.
|
| | System | Warning | None | 2025-11-29 04:31:54 | | e1i68x64 | 27: Intel(R) 82574L Gigabit Network Connection Network link is disconnected.
|
| | System | Warning | None | 2025-11-29 04:31:54 | | e1i68x64 | 27: Intel(R) 82574L Gigabit Network Connection #2 Network link is disconnected.
|
| | System | Error | None | 2025-11-29 04:32:04 | LOCAL SERVICE | Microsoft-Windows-WHEA-Logger | 1: A fatal hardware error has occurred. A record describing the condition is contained in the data section of this event.
|
| | System | Error | None | 2025-11-29 04:32:08 | CogiArt | DCOM | 10001: Unable to start a DCOM Server: {297FDBDE-595D-4083-82B1-768BEE65F6C9} as Unavailable/Unavailable. The error: "2147943631" Happened while starting this command: "C:\Program Files\WindowsApps\Microsoft.WidgetsPlatformRuntime_1.6.2.0_x64__8wekyb3d8bbwe\WidgetService\WidgetService.exe" -RegisterProcessAsComServer -Embedding
|
| | System | Error | None | 2025-11-29 04:32:08 | CogiArt | DCOM | 10001: Unable to start a DCOM Server: {3E11DF0F-42EB-4747-9A35-802D98B5BCF0} as Unavailable/Unavailable. The error: "2147943631" Happened while starting this command: "C:\Program Files\WindowsApps\Microsoft.WidgetsPlatformRuntime_1.6.2.0_x64__8wekyb3d8bbwe\WidgetService\WidgetService.exe" -RegisterProcessAsComServer -Embedding
|
| | System | Error | None | 2025-11-29 04:32:08 | CogiArt | DCOM | 10001: Unable to start a DCOM Server: {740FE937-01F7-4482-AA62-C83F0AD3D6D0} as Unavailable/Unavailable. The error: "2147943631" Happened while starting this command: "C:\Program Files\WindowsApps\Microsoft.WidgetsPlatformRuntime_1.6.2.0_x64__8wekyb3d8bbwe\WidgetService\WidgetService.exe" -RegisterProcessAsComServer -Embedding
|
| | System | Error | None | 2025-11-29 04:32:08 | CogiArt | DCOM | 10001: Unable to start a DCOM Server: {6FA05A24-B1DF-4155-909E-7B424F2D2BB5} as Unavailable/Unavailable. The error: "2147943631" Happened while starting this command: "C:\Program Files\WindowsApps\Microsoft.WidgetsPlatformRuntime_1.6.2.0_x64__8wekyb3d8bbwe\WidgetService\WidgetService.exe" -RegisterProcessAsComServer -Embedding
|
| | System | Error | None | 2025-11-29 04:32:13 | CogiArt | DCOM | 10001: Unable to start a DCOM Server: {297FDBDE-595D-4083-82B1-768BEE65F6C9} as Unavailable/Unavailable. The error: "2147943631" Happened while starting this command: "C:\Program Files\WindowsApps\Microsoft.WidgetsPlatformRuntime_1.6.2.0_x64__8wekyb3d8bbwe\WidgetService\WidgetService.exe" -RegisterProcessAsComServer -Embedding
|
| | System | Error | None | 2025-11-29 04:32:13 | CogiArt | DCOM | 10001: Unable to start a DCOM Server: {3E11DF0F-42EB-4747-9A35-802D98B5BCF0} as Unavailable/Unavailable. The error: "2147943631" Happened while starting this command: "C:\Program Files\WindowsApps\Microsoft.WidgetsPlatformRuntime_1.6.2.0_x64__8wekyb3d8bbwe\WidgetService\WidgetService.exe" -RegisterProcessAsComServer -Embedding
|
| | System | Error | None | 2025-11-29 04:32:13 | CogiArt | DCOM | 10001: Unable to start a DCOM Server: {740FE937-01F7-4482-AA62-C83F0AD3D6D0} as Unavailable/Unavailable. The error: "2147943631" Happened while starting this command: "C:\Program Files\WindowsApps\Microsoft.WidgetsPlatformRuntime_1.6.2.0_x64__8wekyb3d8bbwe\WidgetService\WidgetService.exe" -RegisterProcessAsComServer -Embedding
|
| | System | Error | None | 2025-11-29 04:32:13 | CogiArt | DCOM | 10001: Unable to start a DCOM Server: {6FA05A24-B1DF-4155-909E-7B424F2D2BB5} as Unavailable/Unavailable. The error: "2147943631" Happened while starting this command: "C:\Program Files\WindowsApps\Microsoft.WidgetsPlatformRuntime_1.6.2.0_x64__8wekyb3d8bbwe\WidgetService\WidgetService.exe" -RegisterProcessAsComServer -Embedding
|
| | System | Warning | None | 2025-11-29 04:33:06 | LOCAL SERVICE | Microsoft-Windows-Time-Service | 134: NtpClient was unable to set a manual peer to use as a time source because of DNS resolution error on 'time.windows.com,0x9'. NtpClient will try again in 15 minutes and double the reattempt interval thereafter. The error was: No such host is known. (0x80072AF9)
|
| | System | Warning | None | 2025-11-29 04:33:08 | LOCAL SERVICE | Microsoft-Windows-Time-Service | 134: NtpClient was unable to set a manual peer to use as a time source because of DNS resolution error on 'time.windows.com,0x9'. NtpClient will try again in 15 minutes and double the reattempt interval thereafter. The error was: No such host is known. (0x80072AF9)
|
| | System | Warning | None | 2025-11-29 04:42:03 | SYSTEM | DCOM | 10016: The application-specific permission settings do not grant Local Launch permission for the COM Server application with CLSID Windows.SecurityCenter.SecurityAppBroker and APPID Unavailable to the user NT AUTHORITY\SYSTEM SID (S-1-5-18) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool.
|
| | System | Warning | None | 2025-11-29 04:42:03 | SYSTEM | DCOM | 10016: The application-specific permission settings do not grant Local Launch permission for the COM Server application with CLSID Windows.SecurityCenter.WscBrokerManager and APPID Unavailable to the user NT AUTHORITY\SYSTEM SID (S-1-5-18) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool.
|
| | System | Warning | None | 2025-11-29 04:42:03 | SYSTEM | DCOM | 10016: The application-specific permission settings do not grant Local Launch permission for the COM Server application with CLSID Windows.SecurityCenter.WscDataProtection and APPID Unavailable to the user NT AUTHORITY\SYSTEM SID (S-1-5-18) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool.
|
| | System | Warning | 223 | 2025-11-29 04:43:57 | SYSTEM | Microsoft-Windows-Kernel-PnP | 225: The application System with process id 4 stopped the removal or ejection for the device ACPI\PNP0A08\2&daba3ff&0. Process command line: List of affected devices: STORAGE\Volume\{c67841dd-cd1b-11f0-8722-806e6f6e6963}#0000000001100000 STORAGE\Volume\{c67841dd-cd1b-11f0-8722-806e6f6e6963}#0000001BC4900000 STORAGE\Volume\{c67841ed-cd1b-11f0-8722-806e6f6e6963}#0000000000005000
|
| | System | Warning | 223 | 2025-11-29 04:43:57 | SYSTEM | Microsoft-Windows-Kernel-PnP | 225: The application \Device\HarddiskVolume2\Windows\System32\smss.exe with process id 872 stopped the removal or ejection for the device ACPI\PNP0A08\2&daba3ff&0. Process command line: \SystemRoot\System32\smss.exe List of affected devices: STORAGE\Volume\{c67841dd-cd1b-11f0-8722-806e6f6e6963}#0000000001100000
|
| | System | Warning | 223 | 2025-11-29 04:43:57 | SYSTEM | Microsoft-Windows-Kernel-PnP | 225: The application \Device\HarddiskVolume2\Windows\System32\csrss.exe with process id 952 stopped the removal or ejection for the device ACPI\PNP0A08\2&daba3ff&0. Process command line: %SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16 List of affected devices: STORAGE\Volume\{c67841dd-cd1b-11f0-8722-806e6f6e6963}#0000000001100000
|
| | System | Warning | 223 | 2025-11-29 04:43:57 | SYSTEM | Microsoft-Windows-Kernel-PnP | 225: The application \Device\HarddiskVolume2\Windows\System32\wininit.exe with process id 1080 stopped the removal or ejection for the device ACPI\PNP0A08\2&daba3ff&0. Process command line: wininit.exe List of affected devices: STORAGE\Volume\{c67841dd-cd1b-11f0-8722-806e6f6e6963}#0000000001100000
|
| | System | Warning | 223 | 2025-11-29 04:43:57 | SYSTEM | Microsoft-Windows-Kernel-PnP | 225: The application \Device\HarddiskVolume2\Windows\System32\csrss.exe with process id 1088 stopped the removal or ejection for the device ACPI\PNP0A08\2&daba3ff&0. Process command line: %SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16 List of affected devices: STORAGE\Volume\{c67841dd-cd1b-11f0-8722-806e6f6e6963}#0000000001100000
|
| | System | Warning | 223 | 2025-11-29 04:43:57 | SYSTEM | Microsoft-Windows-Kernel-PnP | 225: The application \Device\HarddiskVolume2\Windows\System32\winlogon.exe with process id 1152 stopped the removal or ejection for the device ACPI\PNP0A08\2&daba3ff&0. Process command line: winlogon.exe List of affected devices: STORAGE\Volume\{c67841dd-cd1b-11f0-8722-806e6f6e6963}#0000000001100000
|
| | System | Warning | 223 | 2025-11-29 04:43:57 | SYSTEM | Microsoft-Windows-Kernel-PnP | 225: The application \Device\HarddiskVolume2\Windows\System32\RuntimeBroker.exe with process id 1168 stopped the removal or ejection for the device ACPI\PNP0A08\2&daba3ff&0. Process command line: C:\Windows\System32\RuntimeBroker.exe -Embedding List of affected devices: STORAGE\Volume\{c67841dd-cd1b-11f0-8722-806e6f6e6963}#0000000001100000
|
| | System | Warning | 223 | 2025-11-29 04:43:57 | SYSTEM | Microsoft-Windows-Kernel-PnP | 225: The application \Device\HarddiskVolume2\Windows\System32\services.exe with process id 1224 stopped the removal or ejection for the device ACPI\PNP0A08\2&daba3ff&0. Process command line: C:\WINDOWS\system32\services.exe List of affected devices: STORAGE\Volume\{c67841dd-cd1b-11f0-8722-806e6f6e6963}#0000000001100000
|
| | System | Warning | 223 | 2025-11-29 04:43:57 | SYSTEM | Microsoft-Windows-Kernel-PnP | 225: The application \Device\HarddiskVolume2\Windows\System32\lsass.exe with process id 1244 stopped the removal or ejection for the device ACPI\PNP0A08\2&daba3ff&0. Process command line: C:\WINDOWS\system32\lsass.exe List of affected devices: STORAGE\Volume\{c67841dd-cd1b-11f0-8722-806e6f6e6963}#0000000001100000
|
| | System | Warning | 223 | 2025-11-29 04:43:57 | SYSTEM | Microsoft-Windows-Kernel-PnP | 225: The application \Device\HarddiskVolume2\Windows\System32\DriverStore\FileRepository\u0390451.inf_amd64_39377efdd62734d1\B390182\atieclxx.exe with process id 1312 stopped the removal or ejection for the device ACPI\PNP0A08\2&daba3ff&0. Process command line: atieclxx List of affected devices: STORAGE\Volume\{c67841dd-cd1b-11f0-8722-806e6f6e6963}#0000000001100000
|
| | System | Warning | 223 | 2025-11-29 04:43:57 | SYSTEM | Microsoft-Windows-Kernel-PnP | 225: The application \Device\HarddiskVolume2\Windows\System32\svchost.exe with process id 1324 stopped the removal or ejection for the device ACPI\PNP0A08\2&daba3ff&0. Process command line: C:\WINDOWS\System32\svchost.exe -k netprofm -p -s netprofm List of affected devices: STORAGE\Volume\{c67841dd-cd1b-11f0-8722-806e6f6e6963}#0000000001100000
|
| | System | Warning | 223 | 2025-11-29 04:43:57 | SYSTEM | Microsoft-Windows-Kernel-PnP | 225: The application \Device\HarddiskVolume2\Windows\System32\svchost.exe with process id 1380 stopped the removal or ejection for the device ACPI\PNP0A08\2&daba3ff&0. Process command line: C:\WINDOWS\system32\svchost.exe -k DcomLaunch -p List of affected devices: SCSI\Disk&Ven_&Prod_KINGSTON_SV300S3\4&fefddb&0&020000 STORAGE\Volume\{c67841dd-cd1b-11f0-8722-806e6f6e6963}#0000000001100000
|
| | System | Warning | 223 | 2025-11-29 04:43:57 | SYSTEM | Microsoft-Windows-Kernel-PnP | 225: The application \Device\HarddiskVolume2\Windows\System32\fontdrvhost.exe with process id 1412 stopped the removal or ejection for the device ACPI\PNP0A08\2&daba3ff&0. Process command line: "fontdrvhost.exe" List of affected devices: STORAGE\Volume\{c67841dd-cd1b-11f0-8722-806e6f6e6963}#0000000001100000
|
| | System | Warning | 223 | 2025-11-29 04:43:57 | SYSTEM | Microsoft-Windows-Kernel-PnP | 225: The application \Device\HarddiskVolume2\Windows\System32\fontdrvhost.exe with process id 1420 stopped the removal or ejection for the device ACPI\PNP0A08\2&daba3ff&0. Process command line: "fontdrvhost.exe" List of affected devices: STORAGE\Volume\{c67841dd-cd1b-11f0-8722-806e6f6e6963}#0000000001100000
|
| | System | Warning | 223 | 2025-11-29 04:43:57 | SYSTEM | Microsoft-Windows-Kernel-PnP | 225: The application \Device\HarddiskVolume2\Windows\System32\svchost.exe with process id 1504 stopped the removal or ejection for the device ACPI\PNP0A08\2&daba3ff&0. Process command line: C:\WINDOWS\system32\svchost.exe -k RPCSS -p List of affected devices: STORAGE\Volume\{c67841dd-cd1b-11f0-8722-806e6f6e6963}#0000000001100000
|
| | System | Warning | 223 | 2025-11-29 04:43:57 | SYSTEM | Microsoft-Windows-Kernel-PnP | 225: The application \Device\HarddiskVolume2\Windows\System32\svchost.exe with process id 1552 stopped the removal or ejection for the device ACPI\PNP0A08\2&daba3ff&0. Process command line: C:\WINDOWS\system32\svchost.exe -k DcomLaunch -p -s LSM List of affected devices: STORAGE\Volume\{c67841dd-cd1b-11f0-8722-806e6f6e6963}#0000000001100000
|
| | System | Warning | 223 | 2025-11-29 04:43:57 | SYSTEM | Microsoft-Windows-Kernel-PnP | 225: The application \Device\HarddiskVolume2\Windows\System32\svchost.exe with process id 1716 stopped the removal or ejection for the device ACPI\PNP0A08\2&daba3ff&0. Process command line: C:\WINDOWS\system32\svchost.exe -k netsvcs -p -s DsmSvc List of affected devices: STORAGE\Volume\{c67841dd-cd1b-11f0-8722-806e6f6e6963}#0000000001100000
|
| | System | Warning | 223 | 2025-11-29 04:43:57 | SYSTEM | Microsoft-Windows-Kernel-PnP | 225: The application \Device\HarddiskVolume2\Windows\System32\svchost.exe with process id 1724 stopped the removal or ejection for the device ACPI\PNP0A08\2&daba3ff&0. Process command line: C:\WINDOWS\system32\svchost.exe -k DcomLaunch -p -s DeviceInstall List of affected devices: STORAGE\Volume\{c67841dd-cd1b-11f0-8722-806e6f6e6963}#0000000001100000
|
| | System | Warning | 223 | 2025-11-29 04:43:57 | SYSTEM | Microsoft-Windows-Kernel-PnP | 225: The application \Device\HarddiskVolume2\Windows\System32\svchost.exe with process id 1732 stopped the removal or ejection for the device ACPI\PNP0A08\2&daba3ff&0. Process command line: C:\WINDOWS\system32\svchost.exe -k NetworkService -p List of affected devices: SCSI\Disk&Ven_&Prod_KINGSTON_SV300S3\4&fefddb&0&020000 STORAGE\Volume\{c67841dd-cd1b-11f0-8722-806e6f6e6963}#0000000001100000
|
| | System | Warning | 223 | 2025-11-29 04:43:57 | SYSTEM | Microsoft-Windows-Kernel-PnP | 225: The application \Device\HarddiskVolume2\Windows\System32\svchost.exe with process id 1740 stopped the removal or ejection for the device ACPI\PNP0A08\2&daba3ff&0. Process command line: C:\WINDOWS\system32\svchost.exe -k netsvcs -p -s wlidsvc List of affected devices: STORAGE\Volume\{c67841dd-cd1b-11f0-8722-806e6f6e6963}#0000000001100000
|
| | System | Warning | 223 | 2025-11-29 04:43:57 | SYSTEM | Microsoft-Windows-Kernel-PnP | 225: The application \Device\HarddiskVolume2\Windows\System32\svchost.exe with process id 1756 stopped the removal or ejection for the device ACPI\PNP0A08\2&daba3ff&0. Process command line: C:\WINDOWS\System32\svchost.exe -k wsappx -p -s ClipSVC List of affected devices: STORAGE\Volume\{c67841dd-cd1b-11f0-8722-806e6f6e6963}#0000000001100000
|
| | System | Warning | 223 | 2025-11-29 04:43:57 | SYSTEM | Microsoft-Windows-Kernel-PnP | 225: The application \Device\HarddiskVolume2\Windows\System32\svchost.exe with process id 1796 stopped the removal or ejection for the device ACPI\PNP0A08\2&daba3ff&0. Process command line: C:\WINDOWS\system32\svchost.exe -k netsvcs -p -s wuauserv List of affected devices: SCSI\Disk&Ven_&Prod_KINGSTON_SV300S3\4&fefddb&0&020000 STORAGE\Volume\{c67841dd-cd1b-11f0-8722-806e6f6e6963}#0000000001100000
|
| | System | Warning | 223 | 2025-11-29 04:43:57 | SYSTEM | Microsoft-Windows-Kernel-PnP | 225: The application \Device\HarddiskVolume2\Windows\System32\svchost.exe with process id 1912 stopped the removal or ejection for the device ACPI\PNP0A08\2&daba3ff&0. Process command line: C:\WINDOWS\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService List of affected devices: STORAGE\Volume\{c67841dd-cd1b-11f0-8722-806e6f6e6963}#0000000001100000
|
| | System | Warning | 223 | 2025-11-29 04:43:57 | SYSTEM | Microsoft-Windows-Kernel-PnP | 225: The application \Device\HarddiskVolume2\Windows\System32\svchost.exe with process id 1968 stopped the removal or ejection for the device ACPI\PNP0A08\2&daba3ff&0. Process command line: C:\WINDOWS\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc List of affected devices: STORAGE\Volume\{c67841dd-cd1b-11f0-8722-806e6f6e6963}#0000000001100000
|
| | System | Warning | 223 | 2025-11-29 04:43:57 | SYSTEM | Microsoft-Windows-Kernel-PnP | 225: The application \Device\HarddiskVolume2\Windows\System32\svchost.exe with process id 2004 stopped the removal or ejection for the device ACPI\PNP0A08\2&daba3ff&0. Process command line: C:\WINDOWS\system32\svchost.exe -k LocalService -p -s nsi List of affected devices: STORAGE\Volume\{c67841dd-cd1b-11f0-8722-806e6f6e6963}#0000000001100000
|
| | System | Warning | 223 | 2025-11-29 04:43:57 | SYSTEM | Microsoft-Windows-Kernel-PnP | 225: The application \Device\HarddiskVolume2\Windows\System32\svchost.exe with process id 2020 stopped the removal or ejection for the device ACPI\PNP0A08\2&daba3ff&0. Process command line: C:\WINDOWS\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s hidserv List of affected devices: STORAGE\Volume\{c67841dd-cd1b-11f0-8722-806e6f6e6963}#0000000001100000
|
| | System | Warning | 223 | 2025-11-29 04:43:57 | SYSTEM | Microsoft-Windows-Kernel-PnP | 225: The application \Device\HarddiskVolume2\Windows\System32\svchost.exe with process id 2044 stopped the removal or ejection for the device ACPI\PNP0A08\2&daba3ff&0. Process command line: C:\WINDOWS\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s AppIDSvc List of affected devices: STORAGE\Volume\{c67841dd-cd1b-11f0-8722-806e6f6e6963}#0000000001100000
|
| | System | Warning | 223 | 2025-11-29 04:43:57 | SYSTEM | Microsoft-Windows-Kernel-PnP | 225: The application \Device\HarddiskVolume2\Program Files (x86)\Microsoft\EdgeWebView\Application\140.0.3485.66\msedgewebview2.exe with process id 2108 stopped the removal or ejection for the device ACPI\PNP0A08\2&daba3ff&0. Process command line: "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\140.0.3485.66\msedgewebview2.exe" --type=renderer --noerrdialogs --user-agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64; Cortana 1.18.9.23723; 10.0.0.0.26200.6584) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.26200 IsWebView2/True (WebView2Version 140.0.3485.66)" --user-data-dir="C:\Users\CogiArt\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\LocalState\EBWebView" --webview-exe-name=SearchHost.exe --webview-exe-version=2125.21002.10.0 --embedded-browser-webview=1 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1.25 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --js-flags="--expose-gc --ms-user-locale=" --time-ticks-at-unix-epoch=-1764419504945838 --launch-time-ticks=247352734 --always-read-main-dll --metrics-shmem-handle=2392,i,14176612957052240401,5255948198628843005,2097152 --field-trial-handle=1844,i,6697581408194740510,13859916280955955461,262144 --enable-features=ForceSWDCompWhenDCompFallbackRequired,msAggressiveCacheTrimming,msCustomDataPartition,msEdgeFluentOverlayScrollbar,msWebView2NoTabForScreenShare,msWebViewAppLifeCycleWorkaround --disable-features=BackForwardCache,BackgroundTabLoadingFromPerformanceManager,CloseOmniboxPopupOnInactiveAreaClick,CollectAVProductsInfo,CollectCodeIntegrityInfo,EnableHangWatcher,FilterAdsOnAbusiveSites,GetWifiProtocol,LoginDetection,MediaFoundationCameraUsageMonitoring,PreconnectToSearch,SafetyHub,SegmentationPlatform,SpareRendererForSitePerProcess,Ukm,WebPayments,msAITrackerClassification,msAbydosForWindowlessWV2,msAffirmVirtualCard,msAllowChromeWebstore,msAllowMSAPrtSSOForNonMSAProfile,msApplicationGuard,msAskBeforeClosingMultipleTabs,msAutoToggleAADPrtSSOForNonAADProfile,msAutofillEdgeCoupons,msAutofillEdgeCouponsAutoApply,msAutofillEdgeServiceRequest,msAutofillEnableEdgeSuggestions,msAutomaticTabFreeze,msBrowserSettingsSupported,msCoarseGeolocationService,msDataProtection,msDesktopMode,msDesktopRewards,msDisableVariationsSeedFetchThrottling,msEEProactiveHistory,msETFOffstoreExtensionFileDataCollection,msETFPasswordTheftDNRActionSignals,msEdgeAdPlatformUI,msEdgeAddWebCapturetoCollections,msEdgeAutofillShowDeployedPassword,msEdgeCaptureSelectionInPDF,msEdgeCloudConfigService,msEdgeCloudConfigServiceV2,msEdgeCohorts,msEdgeCollectionsPrismExperiment1,msEdgeCollectionsPrismOverallMigration,msEdgeComposeNext,msEdgeEnableNurturingFramework,msEdgeEnclavePrefsBasic,msEdgeEnclavePrefsNotification,msEdgeFaviconService,msEdgeHJTelemetry,msEdgeHubAppSkype,msEdgeImageEditorUI,msEdgeLinkDoctor,msEdgeMouseGestureDefaultEnabled,msEdgeMouseGestureSupported,msEdgeNewDeviceFre,msEdgeOnRampFRE,msEdgeOnRampImport,msEdgePDFCMHighlightUX,msEdgePasswordIris,msEdgePasswordIrisSaveBubble,msEdgeProngPersonalization,msEdgeReadingView,msEdgeRose,msEdgeScreenshotUI,msEdgeSendTabToSelf,msEdgeSettingsImport,msEdgeSettingsImportV2,msEdgeShoppingPersistentStorage,msEdgeShoppingUI,msEdgeSmartFind,msEdgeSuperDragDefaultEnabled,msEdgeSuperDragDropSupported,msEdgeTranslate,msEdgeUpdatesMoreMenuPill,msEdgeWebCapture,msEdgeWebCaptureUniformExperience,msEdgeWebContentFilteringFeedback,msEdgeWorkSearchBanner,msEnableCustomJobMemoryLimitsOnXbox,msEnableMIPForPDF,msEnablePdfUpsell,msEnableThirdPartyScanning,msEnableWebSignInCta,msEnableWebToBrowserSignIn,msEndpointDlp,msEntityExtraction,msExtensionTelemetryFramework,msExternalTaskManager,msFileSystemAccessDirectoryIterationBlocklistCheck,msForceBrowserSignIn,msForeignSessionsPage,msGeolocationAccessService,msGeolocationOSLocationPermissionFallback,msGeolocationSQMService,msGeolocationService,msGrowthInfraLaunchSourceLogging,msGuidedSwitchAllowed,msHubPinPersist,msImplicitSignin,msIrm,msIrmv2,msKlarnaVirtualCard,msLlmConsumerDlpPurview,msLoadStatistics,msLogIsEdgePinnedToTaskbarOnLaunch,msMIPCrossTenantPdfViewSupport,msMdatpWebSiteDlp,msNotificationPermissionForPWA,msNumberOfSitesToPin,msNurturingGlobalSitePinningOnCloseModal,msNurturingSitePinningCITopSites,msNurturingSitePinningWithWindowsConsent,msOnHoverSearchInSidebar,msOpenOfficeDocumentsInWebViewer,msPageInteractionRestrictionRevoke,msPasswordBreachDetection,msPdfAnnotationsVisibility,msPdfDataRecovery,msPdfDigitalSignatureRead,msPdfFreeText,msPdfFreeTextForCJK,msPdfHighlightMode,msPdfInking,msPdfKeyphraseSupport,msPdfOOUI,msPdfPopupMarkerRenderer,msPdfShare,msPdfSharedLibrary,msPdfTextNote,msPdfTextNoteMoreMenu,msPdfThumbnailCache,msPdfUnderside,msPdfViewRestore,msPersonalizationUMA,msPriceComparison,msPrintInWebView2,msPromptDefaultHandlerForPDF,msReactiveSearch,msReadAloud,msReadAloudPdf,msRedirectToShoreline,msRevokeExtensions,msSaasDlp,msShoppingTrigger,msShorelineSearch,msShorelineSearchFindOnPageWebUI,msShowOfflineGameEntrance,msShowReadAloudIconInAddressBar,msShowUXForAADPrtSSOForNonAADProfile,msSitePinningWithoutUi,msSmartScreenProtection,msSuspendMessageForNewSessionWhenHavingPendingNavigation,msSyncEdgeCollections,msTabResourceStats,msTokenizationAutofillInlineEnabled,msTouchMode,msTriggeringSignalGenerator,msUserUnderstanding,msVideoSuperResolutionUI,msWalletBuyNow,msWalletCheckout,msWalletDiagnosticDataLogger,msWalletHubEntry,msWalletHubIntlP3,msWalletPartialCard,msWalletPasswordCategorization,msWalletPasswordCategorizationPlatformExpansion,msWalletTokenizationCardMetadata,msWalletTokenizedAutofill,msWebAssist,msWebAssistHistorySearchService,msWebOOUI,msWindowsTaskManager,msWindowsUserActivities,msZipPayVirtualCard --variations-seed-version --mojo-platform-channel-handle=4832 /pfhostedapp:b239454542aeb4426687a343f2ad9726df39e1a8 /prefetch:1 List of affected devices: STORAGE\Volume\{c67841dd-cd1b-11f0-8722-806e6f6e6963}#0000000001100000
|
| | System | Warning | 223 | 2025-11-29 04:43:57 | SYSTEM | Microsoft-Windows-Kernel-PnP | 225: The application \Device\HarddiskVolume2\Windows\System32\dwm.exe with process id 2180 stopped the removal or ejection for the device ACPI\PNP0A08\2&daba3ff&0. Process command line: "dwm.exe" List of affected devices: STORAGE\Volume\{c67841dd-cd1b-11f0-8722-806e6f6e6963}#0000000001100000
|
| | System | Warning | 223 | 2025-11-29 04:43:57 | SYSTEM | Microsoft-Windows-Kernel-PnP | 225: The application \Device\HarddiskVolume2\Windows\System32\svchost.exe with process id 2248 stopped the removal or ejection for the device ACPI\PNP0A08\2&daba3ff&0. Process command line: C:\WINDOWS\system32\svchost.exe -k GPSvcGroup List of affected devices: STORAGE\Volume\{c67841dd-cd1b-11f0-8722-806e6f6e6963}#0000000001100000
|
| | System | Warning | 223 | 2025-11-29 04:43:57 | SYSTEM | Microsoft-Windows-Kernel-PnP | 225: The application \Device\HarddiskVolume2\Windows\System32\svchost.exe with process id 2268 stopped the removal or ejection for the device ACPI\PNP0A08\2&daba3ff&0. Process command line: C:\WINDOWS\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog List of affected devices: STORAGE\Volume\{c67841dd-cd1b-11f0-8722-806e6f6e6963}#0000000001100000
|
| | System | Warning | 223 | 2025-11-29 04:43:57 | SYSTEM | Microsoft-Windows-Kernel-PnP | 225: The application \Device\HarddiskVolume2\Windows\System32\svchost.exe with process id 2332 stopped the removal or ejection for the device ACPI\PNP0A08\2&daba3ff&0. Process command line: C:\WINDOWS\system32\svchost.exe -k NetworkService -p List of affected devices: STORAGE\Volume\{c67841dd-cd1b-11f0-8722-806e6f6e6963}#0000000001100000
|
| | System | Warning | 223 | 2025-11-29 04:43:57 | SYSTEM | Microsoft-Windows-Kernel-PnP | 225: The application \Device\HarddiskVolume2\Windows\System32\svchost.exe with process id 2360 stopped the removal or ejection for the device ACPI\PNP0A08\2&daba3ff&0. Process command line: C:\WINDOWS\system32\svchost.exe -k UserProfileService -p -s ProfSvc List of affected devices: STORAGE\Volume\{c67841dd-cd1b-11f0-8722-806e6f6e6963}#0000000001100000
|
| | System | Warning | 223 | 2025-11-29 04:43:57 | SYSTEM | Microsoft-Windows-Kernel-PnP | 225: The application \Device\HarddiskVolume2\Windows\System32\svchost.exe with process id 2368 stopped the removal or ejection for the device ACPI\PNP0A08\2&daba3ff&0. Process command line: C:\WINDOWS\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s SysMain List of affected devices: STORAGE\Volume\{c67841dd-cd1b-11f0-8722-806e6f6e6963}#0000000001100000
|
| | System | Warning | 223 | 2025-11-29 04:43:57 | SYSTEM | Microsoft-Windows-Kernel-PnP | 225: The application \Device\HarddiskVolume2\Windows\System32\svchost.exe with process id 2376 stopped the removal or ejection for the device ACPI\PNP0A08\2&daba3ff&0. Process command line: C:\WINDOWS\System32\svchost.exe -k netsvcs -p -s Themes List of affected devices: STORAGE\Volume\{c67841dd-cd1b-11f0-8722-806e6f6e6963}#0000000001100000
|
| | System | Warning | 223 | 2025-11-29 04:43:57 | SYSTEM | Microsoft-Windows-Kernel-PnP | 225: The application \Device\HarddiskVolume2\Windows\System32\svchost.exe with process id 2384 stopped the removal or ejection for the device ACPI\PNP0A08\2&daba3ff&0. Process command line: C:\WINDOWS\system32\svchost.exe -k LocalService -p -s EventSystem List of affected devices: STORAGE\Volume\{c67841dd-cd1b-11f0-8722-806e6f6e6963}#0000000001100000
|
| | System | Warning | 223 | 2025-11-29 04:43:57 | SYSTEM | Microsoft-Windows-Kernel-PnP | 225: The application \Device\HarddiskVolume2\Windows\System32\svchost.exe with process id 2524 stopped the removal or ejection for the device ACPI\PNP0A08\2&daba3ff&0. Process command line: C:\WINDOWS\system32\svchost.exe -k netsvcs -p -s Schedule List of affected devices: STORAGE\Volume\{c67841dd-cd1b-11f0-8722-806e6f6e6963}#0000000001100000
|
| | System | Warning | 223 | 2025-11-29 04:43:57 | SYSTEM | Microsoft-Windows-Kernel-PnP | 225: The application \Device\HarddiskVolume2\Windows\System32\svchost.exe with process id 2564 stopped the removal or ejection for the device ACPI\PNP0A08\2&daba3ff&0. Process command line: C:\WINDOWS\system32\svchost.exe -k netsvcsRedirectionGuard -p -s SENS List of affected devices: STORAGE\Volume\{c67841dd-cd1b-11f0-8722-806e6f6e6963}#0000000001100000
|
| | System | Warning | 223 | 2025-11-29 04:43:57 | SYSTEM | Microsoft-Windows-Kernel-PnP | 225: The application \Device\HarddiskVolume2\Windows\System32\svchost.exe with process id 2620 stopped the removal or ejection for the device ACPI\PNP0A08\2&daba3ff&0. Process command line: C:\WINDOWS\system32\svchost.exe -k netsvcs -p -s UserManager List of affected devices: STORAGE\Volume\{c67841dd-cd1b-11f0-8722-806e6f6e6963}#0000000001100000
|
| | System | Warning | 223 | 2025-11-29 04:43:57 | SYSTEM | Microsoft-Windows-Kernel-PnP | 225: The application \Device\HarddiskVolume2\Windows\System32\svchost.exe with process id 2696 stopped the removal or ejection for the device ACPI\PNP0A08\2&daba3ff&0. Process command line: C:\WINDOWS\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder List of affected devices: STORAGE\Volume\{c67841dd-cd1b-11f0-8722-806e6f6e6963}#0000000001100000
|
| | System | Warning | 223 | 2025-11-29 04:43:57 | SYSTEM | Microsoft-Windows-Kernel-PnP | 225: The application \Device\HarddiskVolume2\Windows\System32\svchost.exe with process id 2704 stopped the removal or ejection for the device ACPI\PNP0A08\2&daba3ff&0. Process command line: C:\WINDOWS\system32\svchost.exe -k LocalService -p -s FontCache List of affected devices: STORAGE\Volume\{c67841dd-cd1b-11f0-8722-806e6f6e6963}#0000000001100000
|
| | System | Warning | 223 | 2025-11-29 04:43:57 | SYSTEM | Microsoft-Windows-Kernel-PnP | 225: The application \Device\HarddiskVolume2\Windows\System32\wbem\WmiPrvSE.exe with process id 2800 stopped the removal or ejection for the device ACPI\PNP0A08\2&daba3ff&0. Process command line: C:\WINDOWS\system32\wbem\wmiprvse.exe List of affected devices: -Embedding
|
| | System | Warning | 223 | 2025-11-29 04:43:57 | SYSTEM | Microsoft-Windows-Kernel-PnP | 225: The application \Device\HarddiskVolume2\Windows\System32\dllhost.exe with process id 2884 stopped the removal or ejection for the device ACPI\PNP0A08\2&daba3ff&0. Process command line: C:\WINDOWS\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5} List of affected devices: STORAGE\Volume\{c67841dd-cd1b-11f0-8722-806e6f6e6963}#0000000001100000
|
| | System | Warning | 223 | 2025-11-29 04:43:57 | SYSTEM | Microsoft-Windows-Kernel-PnP | 225: The application \Device\HarddiskVolume2\Program Files (x86)\Microsoft\EdgeWebView\Application\140.0.3485.66\msedgewebview2.exe with process id 2932 stopped the removal or ejection for the device ACPI\PNP0A08\2&daba3ff&0. Process command line: "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\140.0.3485.66\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=SearchHost.exe --webview-exe-version=2125.21002.10.0 --user-data-dir="C:\Users\CogiArt\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\LocalState\EBWebView" --noerrdialogs --disable-features=msSmartScreenProtection --edge-webview-enable-mojo-ipcz --enable-features=msEdgeFluentOverlayScrollbar --user-agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64; Cortana 1.18.9.23723; 10.0.0.0.26200.6584) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.26200 IsWebView2/True (WebView2Version 140.0.3485.66)" --lang=en-US --mojo-named-platform-channel-pipe=6792.7200.3786573828812570330 /pfhostedapp:b239454542aeb4426687a343f2ad9726df39e1a8 List of affected devices: STORAGE\Volume\{c67841dd-cd1b-11f0-8722-806e6f6e6963}#0000000001100000
|
| | System | Warning | 223 | 2025-11-29 04:43:57 | SYSTEM | Microsoft-Windows-Kernel-PnP | 225: The application \Device\HarddiskVolume2\Windows\System32\svchost.exe with process id 2964 stopped the removal or ejection for the device ACPI\PNP0A08\2&daba3ff&0. Process command line: C:\WINDOWS\System32\svchost.exe -k LocalServiceNetworkRestricted -p List of affected devices: STORAGE\Volume\{c67841dd-cd1b-11f0-8722-806e6f6e6963}#0000000001100000
|
| | System | Warning | 223 | 2025-11-29 04:43:57 | SYSTEM | Microsoft-Windows-Kernel-PnP | 225: The application \Device\HarddiskVolume2\Windows\System32\svchost.exe with process id 3020 stopped the removal or ejection for the device ACPI\PNP0A08\2&daba3ff&0. Process command line: C:\WINDOWS\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TextInputManagementService List of affected devices: STORAGE\Volume\{c67841dd-cd1b-11f0-8722-806e6f6e6963}#0000000001100000
|
| | System | Warning | 223 | 2025-11-29 04:43:57 | SYSTEM | Microsoft-Windows-Kernel-PnP | 225: The application \Device\HarddiskVolume2\Windows\System32\svchost.exe with process id 3068 stopped the removal or ejection for the device ACPI\PNP0A08\2&daba3ff&0. Process command line: C:\WINDOWS\system32\svchost.exe -k LocalServiceNoNetwork -p List of affected devices: STORAGE\Volume\{c67841dd-cd1b-11f0-8722-806e6f6e6963}#0000000001100000
|
| | System | Warning | 223 | 2025-11-29 04:43:57 | SYSTEM | Microsoft-Windows-Kernel-PnP | 225: The application \Device\HarddiskVolume2\Windows\System32\svchost.exe with process id 3096 stopped the removal or ejection for the device ACPI\PNP0A08\2&daba3ff&0. Process command line: C:\WINDOWS\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s DusmSvc List of affected devices: STORAGE\Volume\{c67841dd-cd1b-11f0-8722-806e6f6e6963}#0000000001100000
|
| | System | Warning | 223 | 2025-11-29 04:43:57 | SYSTEM | Microsoft-Windows-Kernel-PnP | 225: The application \Device\HarddiskVolume2\Windows\System32\svchost.exe with process id 3104 stopped the removal or ejection for the device ACPI\PNP0A08\2&daba3ff&0. Process command line: C:\WINDOWS\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp List of affected devices: STORAGE\Volume\{c67841dd-cd1b-11f0-8722-806e6f6e6963}#0000000001100000
|
| | System | Warning | 223 | 2025-11-29 04:43:57 | SYSTEM | Microsoft-Windows-Kernel-PnP | 225: The application \Device\HarddiskVolume2\Windows\System32\svchost.exe with process id 3156 stopped the removal or ejection for the device ACPI\PNP0A08\2&daba3ff&0. Process command line: C:\WINDOWS\System32\svchost.exe -k netsvcs -p List of affected devices: STORAGE\Volume\{c67841dd-cd1b-11f0-8722-806e6f6e6963}#0000000001100000
|
| | System | Warning | 223 | 2025-11-29 04:43:57 | SYSTEM | Microsoft-Windows-Kernel-PnP | 225: The application \Device\HarddiskVolume2\Windows\System32\svchost.exe with process id 3208 stopped the removal or ejection for the device ACPI\PNP0A08\2&daba3ff&0. Process command line: C:\WINDOWS\system32\svchost.exe -k netsvcs -p -s Winmgmt List of affected devices: STORAGE\Volume\{c67841dd-cd1b-11f0-8722-806e6f6e6963}#0000000001100000
|
| | System | Warning | 223 | 2025-11-29 04:43:57 | SYSTEM | Microsoft-Windows-Kernel-PnP | 225: The application \Device\HarddiskVolume2\Windows\System32\svchost.exe with process id 3240 stopped the removal or ejection for the device ACPI\PNP0A08\2&daba3ff&0. Process command line: C:\WINDOWS\system32\svchost.exe -k LocalServiceNoNetworkFirewall -p List of affected devices: STORAGE\Volume\{c67841dd-cd1b-11f0-8722-806e6f6e6963}#0000000001100000
|
| | System | Warning | 223 | 2025-11-29 04:43:57 | SYSTEM | Microsoft-Windows-Kernel-PnP | 225: The application \Device\HarddiskVolume2\Program Files\Windows Defender\MsMpEng.exe with process id 3292 stopped the removal or ejection for the device ACPI\PNP0A08\2&daba3ff&0. Process command line: "C:\Program Files\Windows Defender\MsMpEng.exe" List of affected devices: STORAGE\Volume\{c67841dd-cd1b-11f0-8722-806e6f6e6963}#0000000001100000
|
| | System | Warning | 223 | 2025-11-29 04:43:57 | SYSTEM | Microsoft-Windows-Kernel-PnP | 225: The application \Device\HarddiskVolume2\Windows\System32\svchost.exe with process id 3296 stopped the removal or ejection for the device ACPI\PNP0A08\2&daba3ff&0. Process command line: C:\WINDOWS\system32\svchost.exe -k appmodel -p -s StateRepository List of affected devices: STORAGE\Volume\{c67841dd-cd1b-11f0-8722-806e6f6e6963}#0000000001100000
|
| | System | Warning | 223 | 2025-11-29 04:43:57 | SYSTEM | Microsoft-Windows-Kernel-PnP | 225: The application \Device\HarddiskVolume2\Windows\System32\svchost.exe with process id 3380 stopped the removal or ejection for the device ACPI\PNP0A08\2&daba3ff&0. Process command line: C:\WINDOWS\system32\svchost.exe -k LocalServiceHttp -p List of affected devices: STORAGE\Volume\{c67841dd-cd1b-11f0-8722-806e6f6e6963}#0000000001100000
|
| | System | Warning | 223 | 2025-11-29 04:43:57 | SYSTEM | Microsoft-Windows-Kernel-PnP | 225: The application \Device\HarddiskVolume2\Windows\System32\svchost.exe with process id 3464 stopped the removal or ejection for the device ACPI\PNP0A08\2&daba3ff&0. Process command line: C:\WINDOWS\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Wcmsvc List of affected devices: STORAGE\Volume\{c67841dd-cd1b-11f0-8722-806e6f6e6963}#0000000001100000
|
| | System | Warning | 223 | 2025-11-29 04:43:57 | SYSTEM | Microsoft-Windows-Kernel-PnP | 225: The application \Device\HarddiskVolume2\Windows\System32\svchost.exe with process id 3508 stopped the removal or ejection for the device ACPI\PNP0A08\2&daba3ff&0. Process command line: C:\WINDOWS\System32\svchost.exe -k netsvcs -p -s ShellHWDetection List of affected devices: STORAGE\Volume\{c67841dd-cd1b-11f0-8722-806e6f6e6963}#0000000001100000
|
| | System | Warning | 223 | 2025-11-29 04:43:57 | SYSTEM | Microsoft-Windows-Kernel-PnP | 225: The application \Device\HarddiskVolume2\Windows\System32\audiodg.exe with process id 3520 stopped the removal or ejection for the device ACPI\PNP0A08\2&daba3ff&0. Process command line: C:\WINDOWS\system32\AUDIODG.EXE 0x00000000000005EC List of affected devices: 72
|
| | System | Warning | 223 | 2025-11-29 04:43:57 | SYSTEM | Microsoft-Windows-Kernel-PnP | 225: The application \Device\HarddiskVolume2\Windows\System32\dllhost.exe with process id 3560 stopped the removal or ejection for the device ACPI\PNP0A08\2&daba3ff&0. Process command line: C:\WINDOWS\system32\DllHost.exe /Processid:{6C752774-29FB-4E50-8BB1-97098425A77C} List of affected devices: STORAGE\Volume\{c67841dd-cd1b-11f0-8722-806e6f6e6963}#0000000001100000
|
| | System | Warning | 223 | 2025-11-29 04:43:57 | SYSTEM | Microsoft-Windows-Kernel-PnP | 225: The application \Device\HarddiskVolume2\Program Files (x86)\Microsoft\Edge\Application\msedge.exe with process id 3660 stopped the removal or ejection for the device ACPI\PNP0A08\2&daba3ff&0. Process command line: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --no-pre-read-main-dll --skip-read-main-dll --metrics-shmem-handle=7872,i,17986700062155484471,4368496162716426878,524288 --field-trial-handle=2348,i,4383914887142717900,4649832010531238256,262144 --variations-seed-version --mojo-platform-channel-handle=7208 /prefetch:14 List of affected devices: STORAGE\Volume\{c67841dd-cd1b-11f0-8722-806e6f6e6963}#0000000001100000
|
| | System | Warning | 223 | 2025-11-29 04:43:57 | SYSTEM | Microsoft-Windows-Kernel-PnP | 225: The application \Device\HarddiskVolume2\Windows\System32\spoolsv.exe with process id 3740 stopped the removal or ejection for the device ACPI\PNP0A08\2&daba3ff&0. Process command line: C:\WINDOWS\System32\spoolsv.exe List of affected devices: STORAGE\Volume\{c67841dd-cd1b-11f0-8722-806e6f6e6963}#0000000001100000
|
| | System | Warning | 223 | 2025-11-29 04:43:57 | SYSTEM | Microsoft-Windows-Kernel-PnP | 225: The application \Device\HarddiskVolume2\Windows\System32\svchost.exe with process id 3860 stopped the removal or ejection for the device ACPI\PNP0A08\2&daba3ff&0. Process command line: C:\WINDOWS\system32\svchost.exe -k WebThreatDefense -p -s webthreatdefsvc List of affected devices: STORAGE\Volume\{c67841dd-cd1b-11f0-8722-806e6f6e6963}#0000000001100000
|
| | System | Warning | 223 | 2025-11-29 04:43:57 | SYSTEM | Microsoft-Windows-Kernel-PnP | 225: The application \Device\HarddiskVolume2\Windows\System32\svchost.exe with process id 3888 stopped the removal or ejection for the device ACPI\PNP0A08\2&daba3ff&0. Process command line: C:\WINDOWS\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation List of affected devices: STORAGE\Volume\{c67841dd-cd1b-11f0-8722-806e6f6e6963}#0000000001100000
|
| | System | Warning | 223 | 2025-11-29 04:43:57 | SYSTEM | Microsoft-Windows-Kernel-PnP | 225: The application \Device\HarddiskVolume2\Windows\System32\svchost.exe with process id 3932 stopped the removal or ejection for the device ACPI\PNP0A08\2&daba3ff&0. Process command line: C:\WINDOWS\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc List of affected devices: STORAGE\Volume\{c67841dd-cd1b-11f0-8722-806e6f6e6963}#0000000001100000
|
| | System | Warning | 223 | 2025-11-29 04:43:57 | SYSTEM | Microsoft-Windows-Kernel-PnP | 225: The application \Device\HarddiskVolume2\Windows\System32\svchost.exe with process id 4008 stopped the removal or ejection for the device ACPI\PNP0A08\2&daba3ff&0. Process command line: C:\WINDOWS\System32\svchost.exe -k utcsvc -p List of affected devices: SCSI\Disk&Ven_&Prod_KINGSTON_SV300S3\4&fefddb&0&020000 STORAGE\Volume\{c67841dd-cd1b-11f0-8722-806e6f6e6963}#0000000001100000
|
| | System | Warning | 223 | 2025-11-29 04:43:57 | SYSTEM | Microsoft-Windows-Kernel-PnP | 225: The application \Device\HarddiskVolume2\Windows\System32\svchost.exe with process id 4020 stopped the removal or ejection for the device ACPI\PNP0A08\2&daba3ff&0. Process command line: C:\WINDOWS\System32\svchost.exe -k NetSvcs -p -s iphlpsvc List of affected devices: STORAGE\Volume\{c67841dd-cd1b-11f0-8722-806e6f6e6963}#0000000001100000
|
| | System | Warning | 223 | 2025-11-29 04:43:57 | SYSTEM | Microsoft-Windows-Kernel-PnP | 225: The application \Device\HarddiskVolume2\Windows\System32\svchost.exe with process id 4028 stopped the removal or ejection for the device ACPI\PNP0A08\2&daba3ff&0. Process command line: C:\WINDOWS\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks List of affected devices: STORAGE\Volume\{c67841dd-cd1b-11f0-8722-806e6f6e6963}#0000000001100000
|
| | System | Warning | 223 | 2025-11-29 04:43:57 | SYSTEM | Microsoft-Windows-Kernel-PnP | 225: The application \Device\HarddiskVolume2\Windows\System32\svchost.exe with process id 4044 stopped the removal or ejection for the device ACPI\PNP0A08\2&daba3ff&0. Process command line: C:\WINDOWS\system32\svchost.exe -k WSAIFabricSvcGroup -p -s WSAIFabricSvc List of affected devices: STORAGE\Volume\{c67841dd-cd1b-11f0-8722-806e6f6e6963}#0000000001100000
|
| | System | Warning | 223 | 2025-11-29 04:43:57 | SYSTEM | Microsoft-Windows-Kernel-PnP | 225: The application \Device\HarddiskVolume2\Windows\System32\svchost.exe with process id 4052 stopped the removal or ejection for the device ACPI\PNP0A08\2&daba3ff&0. Process command line: C:\WINDOWS\system32\svchost.exe -k netsvcs -p -s WpnService List of affected devices: STORAGE\Volume\{c67841dd-cd1b-11f0-8722-806e6f6e6963}#0000000001100000
|
| | System | Warning | 223 | 2025-11-29 04:43:57 | SYSTEM | Microsoft-Windows-Kernel-PnP | 225: The application \Device\HarddiskVolume2\Windows\System32\svchost.exe with process id 4060 stopped the removal or ejection for the device ACPI\PNP0A08\2&daba3ff&0. Process command line: C:\WINDOWS\System32\svchost.exe -k LocalServiceNoNetwork -p -s DPS List of affected devices: STORAGE\Volume\{c67841dd-cd1b-11f0-8722-806e6f6e6963}#0000000001100000
|
| | System | Warning | 223 | 2025-11-29 04:43:57 | SYSTEM | Microsoft-Windows-Kernel-PnP | 225: The application \Device\HarddiskVolume2\Windows\System32\taskhostw.exe with process id 4088 stopped the removal or ejection for the device ACPI\PNP0A08\2&daba3ff&0. Process command line: taskhostw.exe $(Arg0) List of affected devices: STORAGE\Volume\{c67841dd-cd1b-11f0-8722-806e6f6e6963}#0000000001100000
|
| | System | Warning | 223 | 2025-11-29 04:43:57 | SYSTEM | Microsoft-Windows-Kernel-PnP | 225: The application \Device\HarddiskVolume2\Windows\System32\svchost.exe with process id 4308 stopped the removal or ejection for the device ACPI\PNP0A08\2&daba3ff&0. Process command line: C:\WINDOWS\system32\svchost.exe -k netsvcs -p -s LanmanServer List of affected devices: STORAGE\Volume\{c67841dd-cd1b-11f0-8722-806e6f6e6963}#0000000001100000
|
| | System | Warning | 223 | 2025-11-29 04:43:57 | SYSTEM | Microsoft-Windows-Kernel-PnP | 225: The application \Device\HarddiskVolume2\Windows\System32\wbem\WmiPrvSE.exe with process id 4612 stopped the removal or ejection for the device ACPI\PNP0A08\2&daba3ff&0. Process command line: C:\WINDOWS\system32\wbem\wmiprvse.exe List of affected devices: 72
|
| | System | Warning | 223 | 2025-11-29 04:43:57 | SYSTEM | Microsoft-Windows-Kernel-PnP | 225: The application \Device\HarddiskVolume2\Windows\System32\sihost.exe with process id 4788 stopped the removal or ejection for the device ACPI\PNP0A08\2&daba3ff&0. Process command line: sihost.exe List of affected devices: STORAGE\Volume\{c67841dd-cd1b-11f0-8722-806e6f6e6963}#0000000001100000
|
| | System | Warning | 223 | 2025-11-29 04:43:57 | SYSTEM | Microsoft-Windows-Kernel-PnP | 225: The application \Device\HarddiskVolume2\Windows\System32\svchost.exe with process id 4824 stopped the removal or ejection for the device ACPI\PNP0A08\2&daba3ff&0. Process command line: C:\WINDOWS\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc List of affected devices: STORAGE\Volume\{c67841dd-cd1b-11f0-8722-806e6f6e6963}#0000000001100000
|
| | System | Warning | 223 | 2025-11-29 04:43:57 | SYSTEM | Microsoft-Windows-Kernel-PnP | 225: The application \Device\HarddiskVolume2\Windows\System32\svchost.exe with process id 4852 stopped the removal or ejection for the device ACPI\PNP0A08\2&daba3ff&0. Process command line: C:\WINDOWS\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s webthreatdefusersvc List of affected devices: STORAGE\Volume\{c67841dd-cd1b-11f0-8722-806e6f6e6963}#0000000001100000
|
| | System | Warning | 223 | 2025-11-29 04:43:57 | SYSTEM | Microsoft-Windows-Kernel-PnP | 225: The application \Device\HarddiskVolume2\Windows\System32\svchost.exe with process id 4880 stopped the removal or ejection for the device ACPI\PNP0A08\2&daba3ff&0. Process command line: C:\WINDOWS\system32\svchost.exe -k UnistackSvcGroup -s WpnUserService List of affected devices: STORAGE\Volume\{c67841dd-cd1b-11f0-8722-806e6f6e6963}#0000000001100000
|
| | System | Warning | 223 | 2025-11-29 04:43:57 | SYSTEM | Microsoft-Windows-Kernel-PnP | 225: The application \Device\HarddiskVolume2\Windows\System32\svchost.exe with process id 4916 stopped the removal or ejection for the device ACPI\PNP0A08\2&daba3ff&0. Process command line: C:\WINDOWS\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DisplayEnhancementService List of affected devices: STORAGE\Volume\{c67841dd-cd1b-11f0-8722-806e6f6e6963}#0000000001100000
|
| | System | Warning | 223 | 2025-11-29 04:43:57 | SYSTEM | Microsoft-Windows-Kernel-PnP | 225: The application \Device\HarddiskVolume2\Windows\System32\taskhostw.exe with process id 4972 stopped the removal or ejection for the device ACPI\PNP0A08\2&daba3ff&0. Process command line: taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E} List of affected devices: SCSI\Disk&Ven_&Prod_KINGSTON_SV300S3\4&fefddb&0&020000 STORAGE\Volume\{c67841dd-cd1b-11f0-8722-806e6f6e6963}#0000000001100000
|
| | System | Warning | 223 | 2025-11-29 04:43:57 | SYSTEM | Microsoft-Windows-Kernel-PnP | 225: The application \Device\HarddiskVolume2\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe with process id 4996 stopped the removal or ejection for the device ACPI\PNP0A08\2&daba3ff&0. Process command line: "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /c List of affected devices: STORAGE\Volume\{c67841dd-cd1b-11f0-8722-806e6f6e6963}#0000000001100000
|
| | System | Warning | 223 | 2025-11-29 04:43:57 | SYSTEM | Microsoft-Windows-Kernel-PnP | 225: The application \Device\HarddiskVolume2\Windows\System32\svchost.exe with process id 5060 stopped the removal or ejection for the device ACPI\PNP0A08\2&daba3ff&0. Process command line: C:\WINDOWS\system32\svchost.exe -k netsvcs -p -s TokenBroker List of affected devices: STORAGE\Volume\{c67841dd-cd1b-11f0-8722-806e6f6e6963}#0000000001100000
|
| | System | Warning | 223 | 2025-11-29 04:43:57 | SYSTEM | Microsoft-Windows-Kernel-PnP | 225: The application \Device\HarddiskVolume2\Windows\System32\svchost.exe with process id 5164 stopped the removal or ejection for the device ACPI\PNP0A08\2&daba3ff&0. Process command line: C:\WINDOWS\system32\svchost.exe -k LocalService -p -s CDPSvc List of affected devices: STORAGE\Volume\{c67841dd-cd1b-11f0-8722-806e6f6e6963}#0000000001100000
|
| | System | Warning | 223 | 2025-11-29 04:43:57 | SYSTEM | Microsoft-Windows-Kernel-PnP | 225: The application \Device\HarddiskVolume2\Program Files (x86)\Microsoft\Edge\Application\msedge.exe with process id 5352 stopped the removal or ejection for the device ACPI\PNP0A08\2&daba3ff&0. Process command line: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --no-pre-read-main-dll --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1.25 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=44 --time-ticks-at-unix-epoch=-1764419504945837 --launch-time-ticks=168913958 --ssd-no-pressure-read-main-dll --metrics-shmem-handle=4460,i,14233452545960282836,2928249594437128450,2097152 --field-trial-handle=2348,i,4383914887142717900,4649832010531238256,262144 --variations-seed-version --mojo-platform-channel-handle=2620 /prefetch:1 List of affected devices: STORAGE\Volume\{c67841dd-cd1b-11f0-8722-806e6f6e6963}#0000000001100000
|
| | System | Warning | 223 | 2025-11-29 04:43:57 | SYSTEM | Microsoft-Windows-Kernel-PnP | 225: The application \Device\HarddiskVolume2\Windows\System32\svchost.exe with process id 5404 stopped the removal or ejection for the device ACPI\PNP0A08\2&daba3ff&0. Process command line: C:\WINDOWS\system32\svchost.exe -k osprivacy -p -s camsvc List of affected devices: STORAGE\Volume\{c67841dd-cd1b-11f0-8722-806e6f6e6963}#0000000001100000
|
| | System | Warning | 223 | 2025-11-29 04:43:57 | SYSTEM | Microsoft-Windows-Kernel-PnP | 225: The application \Device\HarddiskVolume2\Windows\System32\svchost.exe with process id 5412 stopped the removal or ejection for the device ACPI\PNP0A08\2&daba3ff&0. Process command line: C:\WINDOWS\system32\svchost.exe -k wsappx -p -s AppXSvc List of affected devices: STORAGE\Volume\{c67841dd-cd1b-11f0-8722-806e6f6e6963}#0000000001100000
|
| | System | Warning | 223 | 2025-11-29 04:43:57 | SYSTEM | Microsoft-Windows-Kernel-PnP | 225: The application \Device\HarddiskVolume2\Windows\System32\sppsvc.exe with process id 5460 stopped the removal or ejection for the device ACPI\PNP0A08\2&daba3ff&0. Process command line: C:\WINDOWS\system32\sppsvc.exe List of affected devices: STORAGE\Volume\{c67841dd-cd1b-11f0-8722-806e6f6e6963}#0000000001100000
|
| | System | Warning | 223 | 2025-11-29 04:43:57 | SYSTEM | Microsoft-Windows-Kernel-PnP | 225: The application \Device\HarddiskVolume2\Windows\System32\AggregatorHost.exe with process id 5688 stopped the removal or ejection for the device ACPI\PNP0A08\2&daba3ff&0. Process command line: AggregatorHost.exe List of affected devices: STORAGE\Volume\{c67841dd-cd1b-11f0-8722-806e6f6e6963}#0000000001100000
|
| | System | Warning | 223 | 2025-11-29 04:43:57 | SYSTEM | Microsoft-Windows-Kernel-PnP | 225: The application \Device\HarddiskVolume2\Windows\explorer.exe with process id 5740 stopped the removal or ejection for the device ACPI\PNP0A08\2&daba3ff&0. Process command line: C:\WINDOWS\Explorer.EXE List of affected devices: STORAGE\Volume\{c67841dd-cd1b-11f0-8722-806e6f6e6963}#0000000001100000
|
| | System | Warning | 223 | 2025-11-29 04:43:57 | SYSTEM | Microsoft-Windows-Kernel-PnP | 225: The application \Device\HarddiskVolume2\Windows\servicing\TrustedInstaller.exe with process id 5792 stopped the removal or ejection for the device ACPI\PNP0A08\2&daba3ff&0. Process command line: C:\WINDOWS\servicing\TrustedInstaller.exe List of affected devices: STORAGE\Volume\{c67841dd-cd1b-11f0-8722-806e6f6e6963}#0000000001100000
|
| | System | Warning | 223 | 2025-11-29 04:43:57 | SYSTEM | Microsoft-Windows-Kernel-PnP | 225: The application \Device\HarddiskVolume2\Windows\System32\ShellHost.exe with process id 5796 stopped the removal or ejection for the device ACPI\PNP0A08\2&daba3ff&0. Process command line: "C:\Windows\System32\ShellHost.exe" List of affected devices: STORAGE\Volume\{c67841dd-cd1b-11f0-8722-806e6f6e6963}#0000000001100000
|
| | System | Warning | 223 | 2025-11-29 04:43:57 | SYSTEM | Microsoft-Windows-Kernel-PnP | 225: The application \Device\HarddiskVolume2\Windows\System32\svchost.exe with process id 5908 stopped the removal or ejection for the device ACPI\PNP0A08\2&daba3ff&0. Process command line: C:\WINDOWS\system32\svchost.exe -k netsvcs -p -s Appinfo List of affected devices: STORAGE\Volume\{c67841dd-cd1b-11f0-8722-806e6f6e6963}#0000000001100000
|
| | System | Warning | 223 | 2025-11-29 04:43:57 | SYSTEM | Microsoft-Windows-Kernel-PnP | 225: The application \Device\HarddiskVolume2\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\CrossDeviceResume.exe with process id 6036 stopped the removal or ejection for the device ACPI\PNP0A08\2&daba3ff&0. Process command line: "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\CrossDeviceResume.exe" /tileid MicrosoftWindows.Client.CBS_cw5n1h2txyewy!CrossDeviceResumeApp List of affected devices: STORAGE\Volume\{c67841dd-cd1b-11f0-8722-806e6f6e6963}#0000000001100000
|
| | System | Warning | 223 | 2025-11-29 04:43:57 | SYSTEM | Microsoft-Windows-Kernel-PnP | 225: The application \Device\HarddiskVolume2\Windows\System32\svchost.exe with process id 6128 stopped the removal or ejection for the device ACPI\PNP0A08\2&daba3ff&0. Process command line: C:\WINDOWS\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc List of affected devices: STORAGE\Volume\{c67841dd-cd1b-11f0-8722-806e6f6e6963}#0000000001100000
|
| | System | Warning | 223 | 2025-11-29 04:43:57 | SYSTEM | Microsoft-Windows-Kernel-PnP | 225: The application \Device\HarddiskVolume2\Windows\System32\svchost.exe with process id 6232 stopped the removal or ejection for the device ACPI\PNP0A08\2&daba3ff&0. Process command line: C:\WINDOWS\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s WdiSystemHost List of affected devices: STORAGE\Volume\{c67841dd-cd1b-11f0-8722-806e6f6e6963}#0000000001100000
|
| | System | Warning | 223 | 2025-11-29 04:43:57 | SYSTEM | Microsoft-Windows-Kernel-PnP | 225: The application \Device\HarddiskVolume2\Windows\System32\svchost.exe with process id 6260 stopped the removal or ejection for the device ACPI\PNP0A08\2&daba3ff&0. Process command line: C:\WINDOWS\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s PcaSvc List of affected devices: STORAGE\Volume\{c67841dd-cd1b-11f0-8722-806e6f6e6963}#0000000001100000
|
| | System | Warning | 223 | 2025-11-29 04:43:57 | SYSTEM | Microsoft-Windows-Kernel-PnP | 225: The application \Device\HarddiskVolume2\Windows\System32\svchost.exe with process id 6364 stopped the removal or ejection for the device ACPI\PNP0A08\2&daba3ff&0. Process command line: C:\WINDOWS\System32\svchost.exe -k LocalService -p -s LicenseManager List of affected devices: STORAGE\Volume\{c67841dd-cd1b-11f0-8722-806e6f6e6963}#0000000001100000
|
| | System | Warning | 223 | 2025-11-29 04:43:57 | SYSTEM | Microsoft-Windows-Kernel-PnP | 225: The application \Device\HarddiskVolume2\Windows\System32\svchost.exe with process id 6440 stopped the removal or ejection for the device ACPI\PNP0A08\2&daba3ff&0. Process command line: C:\WINDOWS\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc List of affected devices: STORAGE\Volume\{c67841dd-cd1b-11f0-8722-806e6f6e6963}#0000000001100000
|
| | System | Warning | 223 | 2025-11-29 04:43:57 | SYSTEM | Microsoft-Windows-Kernel-PnP | 225: The application \Device\HarddiskVolume2\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe with process id 6792 stopped the removal or ejection for the device ACPI\PNP0A08\2&daba3ff&0. Process command line: "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca List of affected devices: STORAGE\Volume\{c67841dd-cd1b-11f0-8722-806e6f6e6963}#0000000001100000
|
| | System | Warning | 223 | 2025-11-29 04:43:57 | SYSTEM | Microsoft-Windows-Kernel-PnP | 225: The application \Device\HarddiskVolume2\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe with process id 6816 stopped the removal or ejection for the device ACPI\PNP0A08\2&daba3ff&0. Process command line: "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca List of affected devices: STORAGE\Volume\{c67841dd-cd1b-11f0-8722-806e6f6e6963}#0000000001100000
|
| | System | Warning | 223 | 2025-11-29 04:43:57 | SYSTEM | Microsoft-Windows-Kernel-PnP | 225: The application \Device\HarddiskVolume2\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_525.18101.90.9_x64__cw5n1h2txyewy\Dashboard\Widgets.exe with process id 6956 stopped the removal or ejection for the device ACPI\PNP0A08\2&daba3ff&0. Process command line: "C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_525.18101.90.9_x64__cw5n1h2txyewy\Dashboard\Widgets.exe" -ServerName:Microsoft.Windows.DashboardServer List of affected devices: STORAGE\Volume\{c67841dd-cd1b-11f0-8722-806e6f6e6963}#0000000001100000
|
| | System | Warning | 223 | 2025-11-29 04:43:57 | SYSTEM | Microsoft-Windows-Kernel-PnP | 225: The application \Device\HarddiskVolume2\Windows\System32\RuntimeBroker.exe with process id 7004 stopped the removal or ejection for the device ACPI\PNP0A08\2&daba3ff&0. Process command line: C:\Windows\System32\RuntimeBroker.exe -Embedding List of affected devices: STORAGE\Volume\{c67841dd-cd1b-11f0-8722-806e6f6e6963}#0000000001100000
|
| | System | Warning | 223 | 2025-11-29 04:43:57 | SYSTEM | Microsoft-Windows-Kernel-PnP | 225: The application \Device\HarddiskVolume2\Windows\System32\svchost.exe with process id 7096 stopped the removal or ejection for the device ACPI\PNP0A08\2&daba3ff&0. Process command line: C:\WINDOWS\system32\svchost.exe -k UdkSvcGroup -s UdkUserSvc List of affected devices: STORAGE\Volume\{c67841dd-cd1b-11f0-8722-806e6f6e6963}#0000000001100000
|
| | System | Warning | 223 | 2025-11-29 04:43:57 | SYSTEM | Microsoft-Windows-Kernel-PnP | 225: The application \Device\HarddiskVolume2\Windows\System32\RuntimeBroker.exe with process id 7116 stopped the removal or ejection for the device ACPI\PNP0A08\2&daba3ff&0. Process command line: C:\Windows\System32\RuntimeBroker.exe -Embedding List of affected devices: STORAGE\Volume\{c67841dd-cd1b-11f0-8722-806e6f6e6963}#0000000001100000
|
| | System | Warning | 223 | 2025-11-29 04:43:57 | SYSTEM | Microsoft-Windows-Kernel-PnP | 225: The application \Device\HarddiskVolume2\Windows\System32\drvinst.exe with process id 7156 stopped the removal or ejection for the device ACPI\PNP0A08\2&daba3ff&0. Process command line: DrvInst.exe "2" "1" "ACPI\PNP0A08\2&DABA3FF&0" "C:\WINDOWS\System32\DriverStore\FileRepository\amdkmpfd.inf_amd64_5b151ceb2aff8d62\amdkmpfd.inf" "oem3.inf:c7937652a1b7534c:AMDKMPFD_Install:22.20.0.1:acpi\pnp0a08," "43ab78ba3" "00000000000001D8" "45f9" List of affected devices: STORAGE\Volume\{c67841dd-cd1b-11f0-8722-806e6f6e6963}#0000000001100000
|
| | System | Warning | 223 | 2025-11-29 04:43:57 | SYSTEM | Microsoft-Windows-Kernel-PnP | 225: The application \Device\HarddiskVolume2\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.5074_none_a5532eb7772ad4c4\TiWorker.exe with process id 7208 stopped the removal or ejection for the device ACPI\PNP0A08\2&daba3ff&0. Process command line: C:\WINDOWS\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.5074_none_a5532eb7772ad4c4\TiWorker.exe -Embedding List of affected devices: STORAGE\Volume\{c67841dd-cd1b-11f0-8722-806e6f6e6963}#0000000001100000
|
| | System | Warning | 223 | 2025-11-29 04:43:57 | SYSTEM | Microsoft-Windows-Kernel-PnP | 225: The application \Device\HarddiskVolume2\Windows\System32\DriverStore\FileRepository\u0390451.inf_amd64_39377efdd62734d1\B390182\atiesrxx.exe with process id 7316 stopped the removal or ejection for the device ACPI\PNP0A08\2&daba3ff&0. Process command line: C:\WINDOWS\System32\DriverStore\FileRepository\u0390451.inf_amd64_39377efdd62734d1\B390182\atiesrxx.exe List of affected devices: STORAGE\Volume\{c67841dd-cd1b-11f0-8722-806e6f6e6963}#0000000001100000
|
| | System | Warning | 223 | 2025-11-29 04:43:57 | SYSTEM | Microsoft-Windows-Kernel-PnP | 225: The application \Device\HarddiskVolume2\Windows\System32\svchost.exe with process id 7336 stopped the removal or ejection for the device ACPI\PNP0A08\2&daba3ff&0. Process command line: C:\WINDOWS\system32\svchost.exe -k whesvc -p -s whesvc List of affected devices: STORAGE\Volume\{c67841dd-cd1b-11f0-8722-806e6f6e6963}#0000000001100000
|
| | System | Warning | 223 | 2025-11-29 04:43:57 | SYSTEM | Microsoft-Windows-Kernel-PnP | 225: The application \Device\HarddiskVolume2\Windows\System32\svchost.exe with process id 7404 stopped the removal or ejection for the device ACPI\PNP0A08\2&daba3ff&0. Process command line: C:\WINDOWS\System32\svchost.exe -k NetworkService -p List of affected devices: STORAGE\Volume\{c67841dd-cd1b-11f0-8722-806e6f6e6963}#0000000001100000
|
| | System | Warning | 223 | 2025-11-29 04:43:57 | SYSTEM | Microsoft-Windows-Kernel-PnP | 225: The application \Device\HarddiskVolume2\Program Files\Windows Defender\NisSrv.exe with process id 7660 stopped the removal or ejection for the device ACPI\PNP0A08\2&daba3ff&0. Process command line: "C:\Program Files\Windows Defender\NisSrv.exe" List of affected devices: STORAGE\Volume\{c67841dd-cd1b-11f0-8722-806e6f6e6963}#0000000001100000
|
| | System | Warning | 223 | 2025-11-29 04:43:57 | SYSTEM | Microsoft-Windows-Kernel-PnP | 225: The application \Device\HarddiskVolume2\Windows\SystemApps\Microsoft.LockApp_cw5n1h2txyewy\LockApp.exe with process id 7764 stopped the removal or ejection for the device ACPI\PNP0A08\2&daba3ff&0. Process command line: "C:\Windows\SystemApps\Microsoft.LockApp_cw5n1h2txyewy\LockApp.exe" -ServerName:WindowsDefaultLockScreen.AppX7y4nbzq37zn4ks9k7amqjywdat7d3j2z.mca List of affected devices: STORAGE\Volume\{c67841dd-cd1b-11f0-8722-806e6f6e6963}#0000000001100000
|
| | System | Warning | 223 | 2025-11-29 04:43:57 | SYSTEM | Microsoft-Windows-Kernel-PnP | 225: The application \Device\HarddiskVolume2\Windows\System32\svchost.exe with process id 7788 stopped the removal or ejection for the device ACPI\PNP0A08\2&daba3ff&0. Process command line: C:\WINDOWS\system32\svchost.exe -k netsvcs -p -s wisvc List of affected devices: STORAGE\Volume\{c67841dd-cd1b-11f0-8722-806e6f6e6963}#0000000001100000
|
| | System | Warning | 223 | 2025-11-29 04:43:57 | SYSTEM | Microsoft-Windows-Kernel-PnP | 225: The application \Device\HarddiskVolume2\Windows\System32\ctfmon.exe with process id 8060 stopped the removal or ejection for the device ACPI\PNP0A08\2&daba3ff&0. Process command line: /QuitInfo:0000000000000284;0000000000000288; List of affected devices: STORAGE\Volume\{c67841dd-cd1b-11f0-8722-806e6f6e6963}#0000000001100000
|
| | System | Warning | 223 | 2025-11-29 04:43:57 | SYSTEM | Microsoft-Windows-Kernel-PnP | 225: The application \Device\HarddiskVolume2\Windows\System32\svchost.exe with process id 8156 stopped the removal or ejection for the device ACPI\PNP0A08\2&daba3ff&0. Process command line: C:\WINDOWS\System32\svchost.exe -k LocalSystemNetworkRestricted -p List of affected devices: STORAGE\Volume\{c67841dd-cd1b-11f0-8722-806e6f6e6963}#0000000001100000
|
| | System | Warning | 223 | 2025-11-29 04:43:57 | SYSTEM | Microsoft-Windows-Kernel-PnP | 225: The application \Device\HarddiskVolume2\Program Files (x86)\Microsoft\EdgeWebView\Application\140.0.3485.66\msedgewebview2.exe with process id 8196 stopped the removal or ejection for the device ACPI\PNP0A08\2&daba3ff&0. Process command line: "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\140.0.3485.66\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\CogiArt\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\LocalState\EBWebView /prefetch:4 /pfhostedapp:b239454542aeb4426687a343f2ad9726df39e1a8 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\CogiArt\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\LocalState\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=140.0.7339.133 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\140.0.3485.66\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=140.0.3485.66 --initial-client-data=0x178,0x17c,0x180,0x138,0x188,0x7fff2c8a2200,0x7fff2c8a220c,0x7fff2c8a2218 List of affected devices: STORAGE\Volume\{c67841dd-cd1b-11f0-8722-806e6f6e6963}#0000000001100000
|
| | System | Warning | 223 | 2025-11-29 04:43:57 | SYSTEM | Microsoft-Windows-Kernel-PnP | 225: The application \Device\HarddiskVolume2\Program Files (x86)\Microsoft\EdgeWebView\Application\140.0.3485.66\msedgewebview2.exe with process id 8448 stopped the removal or ejection for the device ACPI\PNP0A08\2&daba3ff&0. Process command line: "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\140.0.3485.66\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64; Cortana 1.18.9.23723; 10.0.0.0.26200.6584) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.26200 IsWebView2/True (WebView2Version 140.0.3485.66)" --user-data-dir="C:\Users\CogiArt\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\LocalState\EBWebView" --webview-exe-name=SearchHost.exe --webview-exe-version=2125.21002.10.0 --embedded-browser-webview=1 --no-pre-read-main-dll --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1680,i,2146040270215223487,1041600286210841220,262144 --field-trial-handle=1844,i,6697581408194740510,13859916280955955461,262144 --enable-features=ForceSWDCompWhenDCompFallbackRequired,msAggressiveCacheTrimming,msCustomDataPartition,msEdgeFluentOverlayScrollbar,msWebView2NoTabForScreenShare,msWebViewAppLifeCycleWorkaround --disable-features=BackForwardCache,BackgroundTabLoadingFromPerformanceManager,CloseOmniboxPopupOnInactiveAreaClick,CollectAVProductsInfo,CollectCodeIntegrityInfo,EnableHangWatcher,FilterAdsOnAbusiveSites,GetWifiProtocol,LoginDetection,MediaFoundationCameraUsageMonitoring,PreconnectToSearch,SafetyHub,SegmentationPlatform,SpareRendererForSitePerProcess,Ukm,WebPayments,msAITrackerClassification,msAbydosForWindowlessWV2,msAffirmVirtualCard,msAllowChromeWebstore,msAllowMSAPrtSSOForNonMSAProfile,msApplicationGuard,msAskBeforeClosingMultipleTabs,msAutoToggleAADPrtSSOForNonAADProfile,msAutofillEdgeCoupons,msAutofillEdgeCouponsAutoApply,msAutofillEdgeServiceRequest,msAutofillEnableEdgeSuggestions,msAutomaticTabFreeze,msBrowserSettingsSupported,msCoarseGeolocationService,msDataProtection,msDesktopMode,msDesktopRewards,msDisableVariationsSeedFetchThrottling,msEEProactiveHistory,msETFOffstoreExtensionFileDataCollection,msETFPasswordTheftDNRActionSignals,msEdgeAdPlatformUI,msEdgeAddWebCapturetoCollections,msEdgeAutofillShowDeployedPassword,msEdgeCaptureSelectionInPDF,msEdgeCloudConfigService,msEdgeCloudConfigServiceV2,msEdgeCohorts,msEdgeCollectionsPrismExperiment1,msEdgeCollectionsPrismOverallMigration,msEdgeComposeNext,msEdgeEnableNurturingFramework,msEdgeEnclavePrefsBasic,msEdgeEnclavePrefsNotification,msEdgeFaviconService,msEdgeHJTelemetry,msEdgeHubAppSkype,msEdgeImageEditorUI,msEdgeLinkDoctor,msEdgeMouseGestureDefaultEnabled,msEdgeMouseGestureSupported,msEdgeNewDeviceFre,msEdgeOnRampFRE,msEdgeOnRampImport,msEdgePDFCMHighlightUX,msEdgePasswordIris,msEdgePasswordIrisSaveBubble,msEdgeProngPersonalization,msEdgeReadingView,msEdgeRose,msEdgeScreenshotUI,msEdgeSendTabToSelf,msEdgeSettingsImport,msEdgeSettingsImportV2,msEdgeShoppingPersistentStorage,msEdgeShoppingUI,msEdgeSmartFind,msEdgeSuperDragDefaultEnabled,msEdgeSuperDragDropSupported,msEdgeTranslate,msEdgeUpdatesMoreMenuPill,msEdgeWebCapture,msEdgeWebCaptureUniformExperience,msEdgeWebContentFilteringFeedback,msEdgeWorkSearchBanner,msEnableCustomJobMemoryLimitsOnXbox,msEnableMIPForPDF,msEnablePdfUpsell,msEnableThirdPartyScanning,msEnableWebSignInCta,msEnableWebToBrowserSignIn,msEndpointDlp,msEntityExtraction,msExtensionTelemetryFramework,msExternalTaskManager,msFileSystemAccessDirectoryIterationBlocklistCheck,msForceBrowserSignIn,msForeignSessionsPage,msGeolocationAccessService,msGeolocationOSLocationPermissionFallback,msGeolocationSQMService,msGeolocationService,msGrowthInfraLaunchSourceLogging,msGuidedSwitchAllowed,msHubPinPersist,msImplicitSignin,msIrm,msIrmv2,msKlarnaVirtualCard,msLlmConsumerDlpPurview,msLoadStatistics,msLogIsEdgePinnedToTaskbarOnLaunch,msMIPCrossTenantPdfViewSupport,msMdatpWebSiteDlp,msNotificationPermissionForPWA,msNumberOfSitesToPin,msNurturingGlobalSitePinningOnCloseModal,msNurturingSitePinningCITopSites,msNurturingSitePinningWithWindowsConsent,msOnHoverSearchInSidebar,msOpenOfficeDocumentsInWebViewer,msPageInteractionRestrictionRevoke,msPasswordBreachDetection,msPdfAnnotationsVisibility,msPdfDataRecovery,msPdfDigitalSignatureRead,msPdfFreeText,msPdfFreeTextForCJK,msPdfHighlightMode,msPdfInking,msPdfKeyphraseSupport,msPdfOOUI,msPdfPopupMarkerRenderer,msPdfShare,msPdfSharedLibrary,msPdfTextNote,msPdfTextNoteMoreMenu,msPdfThumbnailCache,msPdfUnderside,msPdfViewRestore,msPersonalizationUMA,msPriceComparison,msPrintInWebView2,msPromptDefaultHandlerForPDF,msReactiveSearch,msReadAloud,msReadAloudPdf,msRedirectToShoreline,msRevokeExtensions,msSaasDlp,msShoppingTrigger,msShorelineSearch,msShorelineSearchFindOnPageWebUI,msShowOfflineGameEntrance,msShowReadAloudIconInAddressBar,msShowUXForAADPrtSSOForNonAADProfile,msSitePinningWithoutUi,msSmartScreenProtection,msSuspendMessageForNewSessionWhenHavingPendingNavigation,msSyncEdgeCollections,msTabResourceStats,msTokenizationAutofillInlineEnabled,msTouchMode,msTriggeringSignalGenerator,msUserUnderstanding,msVideoSuperResolutionUI,msWalletBuyNow,msWalletCheckout,msWalletDiagnosticDataLogger,msWalletHubEntry,msWalletHubIntlP3,msWalletPartialCard,msWalletPasswordCategorization,msWalletPasswordCategorizationPlatformExpansion,msWalletTokenizationCardMetadata,msWalletTokenizedAutofill,msWebAssist,msWebAssistHistorySearchService,msWebOOUI,msWindowsTaskManager,msWindowsUserActivities,msZipPayVirtualCard --variations-seed-version --mojo-platform-channel-handle=1832 /prefetch:2 /pfhostedapp:b239454542aeb4426687a343f2ad9726df39e1a8 List of affected devices: STORAGE\Volume\{c67841dd-cd1b-11f0-8722-806e6f6e6963}#0000000001100000
|
| | System | Warning | 223 | 2025-11-29 04:43:57 | SYSTEM | Microsoft-Windows-Kernel-PnP | 225: The application \Device\HarddiskVolume2\Windows\System32\RuntimeBroker.exe with process id 8456 stopped the removal or ejection for the device ACPI\PNP0A08\2&daba3ff&0. Process command line: C:\Windows\System32\RuntimeBroker.exe -Embedding List of affected devices: STORAGE\Volume\{c67841dd-cd1b-11f0-8722-806e6f6e6963}#0000000001100000
|
| | System | Warning | 223 | 2025-11-29 04:43:57 | SYSTEM | Microsoft-Windows-Kernel-PnP | 225: The application \Device\HarddiskVolume2\Program Files (x86)\Microsoft\EdgeWebView\Application\140.0.3485.66\msedgewebview2.exe with process id 8544 stopped the removal or ejection for the device ACPI\PNP0A08\2&daba3ff&0. Process command line: "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\140.0.3485.66\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64; Cortana 1.18.9.23723; 10.0.0.0.26200.6584) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.26200 IsWebView2/True (WebView2Version 140.0.3485.66)" --user-data-dir="C:\Users\CogiArt\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\LocalState\EBWebView" --webview-exe-name=SearchHost.exe --webview-exe-version=2125.21002.10.0 --embedded-browser-webview=1 --always-read-main-dll --metrics-shmem-handle=2176,i,12606121700463249393,6780851667607998830,524288 --field-trial-handle=1844,i,6697581408194740510,13859916280955955461,262144 --enable-features=ForceSWDCompWhenDCompFallbackRequired,msAggressiveCacheTrimming,msCustomDataPartition,msEdgeFluentOverlayScrollbar,msWebView2NoTabForScreenShare,msWebViewAppLifeCycleWorkaround --disable-features=BackForwardCache,BackgroundTabLoadingFromPerformanceManager,CloseOmniboxPopupOnInactiveAreaClick,CollectAVProductsInfo,CollectCodeIntegrityInfo,EnableHangWatcher,FilterAdsOnAbusiveSites,GetWifiProtocol,LoginDetection,MediaFoundationCameraUsageMonitoring,PreconnectToSearch,SafetyHub,SegmentationPlatform,SpareRendererForSitePerProcess,Ukm,WebPayments,msAITrackerClassification,msAbydosForWindowlessWV2,msAffirmVirtualCard,msAllowChromeWebstore,msAllowMSAPrtSSOForNonMSAProfile,msApplicationGuard,msAskBeforeClosingMultipleTabs,msAutoToggleAADPrtSSOForNonAADProfile,msAutofillEdgeCoupons,msAutofillEdgeCouponsAutoApply,msAutofillEdgeServiceRequest,msAutofillEnableEdgeSuggestions,msAutomaticTabFreeze,msBrowserSettingsSupported,msCoarseGeolocationService,msDataProtection,msDesktopMode,msDesktopRewards,msDisableVariationsSeedFetchThrottling,msEEProactiveHistory,msETFOffstoreExtensionFileDataCollection,msETFPasswordTheftDNRActionSignals,msEdgeAdPlatformUI,msEdgeAddWebCapturetoCollections,msEdgeAutofillShowDeployedPassword,msEdgeCaptureSelectionInPDF,msEdgeCloudConfigService,msEdgeCloudConfigServiceV2,msEdgeCohorts,msEdgeCollectionsPrismExperiment1,msEdgeCollectionsPrismOverallMigration,msEdgeComposeNext,msEdgeEnableNurturingFramework,msEdgeEnclavePrefsBasic,msEdgeEnclavePrefsNotification,msEdgeFaviconService,msEdgeHJTelemetry,msEdgeHubAppSkype,msEdgeImageEditorUI,msEdgeLinkDoctor,msEdgeMouseGestureDefaultEnabled,msEdgeMouseGestureSupported,msEdgeNewDeviceFre,msEdgeOnRampFRE,msEdgeOnRampImport,msEdgePDFCMHighlightUX,msEdgePasswordIris,msEdgePasswordIrisSaveBubble,msEdgeProngPersonalization,msEdgeReadingView,msEdgeRose,msEdgeScreenshotUI,msEdgeSendTabToSelf,msEdgeSettingsImport,msEdgeSettingsImportV2,msEdgeShoppingPersistentStorage,msEdgeShoppingUI,msEdgeSmartFind,msEdgeSuperDragDefaultEnabled,msEdgeSuperDragDropSupported,msEdgeTranslate,msEdgeUpdatesMoreMenuPill,msEdgeWebCapture,msEdgeWebCaptureUniformExperience,msEdgeWebContentFilteringFeedback,msEdgeWorkSearchBanner,msEnableCustomJobMemoryLimitsOnXbox,msEnableMIPForPDF,msEnablePdfUpsell,msEnableThirdPartyScanning,msEnableWebSignInCta,msEnableWebToBrowserSignIn,msEndpointDlp,msEntityExtraction,msExtensionTelemetryFramework,msExternalTaskManager,msFileSystemAccessDirectoryIterationBlocklistCheck,msForceBrowserSignIn,msForeignSessionsPage,msGeolocationAccessService,msGeolocationOSLocationPermissionFallback,msGeolocationSQMService,msGeolocationService,msGrowthInfraLaunchSourceLogging,msGuidedSwitchAllowed,msHubPinPersist,msImplicitSignin,msIrm,msIrmv2,msKlarnaVirtualCard,msLlmConsumerDlpPurview,msLoadStatistics,msLogIsEdgePinnedToTaskbarOnLaunch,msMIPCrossTenantPdfViewSupport,msMdatpWebSiteDlp,msNotificationPermissionForPWA,msNumberOfSitesToPin,msNurturingGlobalSitePinningOnCloseModal,msNurturingSitePinningCITopSites,msNurturingSitePinningWithWindowsConsent,msOnHoverSearchInSidebar,msOpenOfficeDocumentsInWebViewer,msPageInteractionRestrictionRevoke,msPasswordBreachDetection,msPdfAnnotationsVisibility,msPdfDataRecovery,msPdfDigitalSignatureRead,msPdfFreeText,msPdfFreeTextForCJK,msPdfHighlightMode,msPdfInking,msPdfKeyphraseSupport,msPdfOOUI,msPdfPopupMarkerRenderer,msPdfShare,msPdfSharedLibrary,msPdfTextNote,msPdfTextNoteMoreMenu,msPdfThumbnailCache,msPdfUnderside,msPdfViewRestore,msPersonalizationUMA,msPriceComparison,msPrintInWebView2,msPromptDefaultHandlerForPDF,msReactiveSearch,msReadAloud,msReadAloudPdf,msRedirectToShoreline,msRevokeExtensions,msSaasDlp,msShoppingTrigger,msShorelineSearch,msShorelineSearchFindOnPageWebUI,msShowOfflineGameEntrance,msShowReadAloudIconInAddressBar,msShowUXForAADPrtSSOForNonAADProfile,msSitePinningWithoutUi,msSmartScreenProtection,msSuspendMessageForNewSessionWhenHavingPendingNavigation,msSyncEdgeCollections,msTabResourceStats,msTokenizationAutofillInlineEnabled,msTouchMode,msTriggeringSignalGenerator,msUserUnderstanding,msVideoSuperResolutionUI,msWalletBuyNow,msWalletCheckout,msWalletDiagnosticDataLogger,msWalletHubEntry,msWalletHubIntlP3,msWalletPartialCard,msWalletPasswordCategorization,msWalletPasswordCategorizationPlatformExpansion,msWalletTokenizationCardMetadata,msWalletTokenizedAutofill,msWebAssist,msWebAssistHistorySearchService,msWebOOUI,msWindowsTaskManager,msWindowsUserActivities,msZipPayVirtualCard --variations-seed-version --mojo-platform-channel-handle=2164 /prefetch:11 /pfhostedapp:b239454542aeb4426687a343f2ad9726df39e1a8 List of affected devices: STORAGE\Volume\{c67841dd-cd1b-11f0-8722-806e6f6e6963}#0000000001100000
|
| | System | Warning | 223 | 2025-11-29 04:43:57 | SYSTEM | Microsoft-Windows-Kernel-PnP | 225: The application \Device\HarddiskVolume2\Program Files (x86)\Microsoft\EdgeWebView\Application\140.0.3485.66\msedgewebview2.exe with process id 8672 stopped the removal or ejection for the device ACPI\PNP0A08\2&daba3ff&0. Process command line: "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\140.0.3485.66\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64; Cortana 1.18.9.23723; 10.0.0.0.26200.6584) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.26200 IsWebView2/True (WebView2Version 140.0.3485.66)" --user-data-dir="C:\Users\CogiArt\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\LocalState\EBWebView" --webview-exe-name=SearchHost.exe --webview-exe-version=2125.21002.10.0 --embedded-browser-webview=1 --always-read-main-dll --metrics-shmem-handle=2476,i,6803141820668948687,5530864620902532028,524288 --field-trial-handle=1844,i,6697581408194740510,13859916280955955461,262144 --enable-features=ForceSWDCompWhenDCompFallbackRequired,msAggressiveCacheTrimming,msCustomDataPartition,msEdgeFluentOverlayScrollbar,msWebView2NoTabForScreenShare,msWebViewAppLifeCycleWorkaround --disable-features=BackForwardCache,BackgroundTabLoadingFromPerformanceManager,CloseOmniboxPopupOnInactiveAreaClick,CollectAVProductsInfo,CollectCodeIntegrityInfo,EnableHangWatcher,FilterAdsOnAbusiveSites,GetWifiProtocol,LoginDetection,MediaFoundationCameraUsageMonitoring,PreconnectToSearch,SafetyHub,SegmentationPlatform,SpareRendererForSitePerProcess,Ukm,WebPayments,msAITrackerClassification,msAbydosForWindowlessWV2,msAffirmVirtualCard,msAllowChromeWebstore,msAllowMSAPrtSSOForNonMSAProfile,msApplicationGuard,msAskBeforeClosingMultipleTabs,msAutoToggleAADPrtSSOForNonAADProfile,msAutofillEdgeCoupons,msAutofillEdgeCouponsAutoApply,msAutofillEdgeServiceRequest,msAutofillEnableEdgeSuggestions,msAutomaticTabFreeze,msBrowserSettingsSupported,msCoarseGeolocationService,msDataProtection,msDesktopMode,msDesktopRewards,msDisableVariationsSeedFetchThrottling,msEEProactiveHistory,msETFOffstoreExtensionFileDataCollection,msETFPasswordTheftDNRActionSignals,msEdgeAdPlatformUI,msEdgeAddWebCapturetoCollections,msEdgeAutofillShowDeployedPassword,msEdgeCaptureSelectionInPDF,msEdgeCloudConfigService,msEdgeCloudConfigServiceV2,msEdgeCohorts,msEdgeCollectionsPrismExperiment1,msEdgeCollectionsPrismOverallMigration,msEdgeComposeNext,msEdgeEnableNurturingFramework,msEdgeEnclavePrefsBasic,msEdgeEnclavePrefsNotification,msEdgeFaviconService,msEdgeHJTelemetry,msEdgeHubAppSkype,msEdgeImageEditorUI,msEdgeLinkDoctor,msEdgeMouseGestureDefaultEnabled,msEdgeMouseGestureSupported,msEdgeNewDeviceFre,msEdgeOnRampFRE,msEdgeOnRampImport,msEdgePDFCMHighlightUX,msEdgePasswordIris,msEdgePasswordIrisSaveBubble,msEdgeProngPersonalization,msEdgeReadingView,msEdgeRose,msEdgeScreenshotUI,msEdgeSendTabToSelf,msEdgeSettingsImport,msEdgeSettingsImportV2,msEdgeShoppingPersistentStorage,msEdgeShoppingUI,msEdgeSmartFind,msEdgeSuperDragDefaultEnabled,msEdgeSuperDragDropSupported,msEdgeTranslate,msEdgeUpdatesMoreMenuPill,msEdgeWebCapture,msEdgeWebCaptureUniformExperience,msEdgeWebContentFilteringFeedback,msEdgeWorkSearchBanner,msEnableCustomJobMemoryLimitsOnXbox,msEnableMIPForPDF,msEnablePdfUpsell,msEnableThirdPartyScanning,msEnableWebSignInCta,msEnableWebToBrowserSignIn,msEndpointDlp,msEntityExtraction,msExtensionTelemetryFramework,msExternalTaskManager,msFileSystemAccessDirectoryIterationBlocklistCheck,msForceBrowserSignIn,msForeignSessionsPage,msGeolocationAccessService,msGeolocationOSLocationPermissionFallback,msGeolocationSQMService,msGeolocationService,msGrowthInfraLaunchSourceLogging,msGuidedSwitchAllowed,msHubPinPersist,msImplicitSignin,msIrm,msIrmv2,msKlarnaVirtualCard,msLlmConsumerDlpPurview,msLoadStatistics,msLogIsEdgePinnedToTaskbarOnLaunch,msMIPCrossTenantPdfViewSupport,msMdatpWebSiteDlp,msNotificationPermissionForPWA,msNumberOfSitesToPin,msNurturingGlobalSitePinningOnCloseModal,msNurturingSitePinningCITopSites,msNurturingSitePinningWithWindowsConsent,msOnHoverSearchInSidebar,msOpenOfficeDocumentsInWebViewer,msPageInteractionRestrictionRevoke,msPasswordBreachDetection,msPdfAnnotationsVisibility,msPdfDataRecovery,msPdfDigitalSignatureRead,msPdfFreeText,msPdfFreeTextForCJK,msPdfHighlightMode,msPdfInking,msPdfKeyphraseSupport,msPdfOOUI,msPdfPopupMarkerRenderer,msPdfShare,msPdfSharedLibrary,msPdfTextNote,msPdfTextNoteMoreMenu,msPdfThumbnailCache,msPdfUnderside,msPdfViewRestore,msPersonalizationUMA,msPriceComparison,msPrintInWebView2,msPromptDefaultHandlerForPDF,msReactiveSearch,msReadAloud,msReadAloudPdf,msRedirectToShoreline,msRevokeExtensions,msSaasDlp,msShoppingTrigger,msShorelineSearch,msShorelineSearchFindOnPageWebUI,msShowOfflineGameEntrance,msShowReadAloudIconInAddressBar,msShowUXForAADPrtSSOForNonAADProfile,msSitePinningWithoutUi,msSmartScreenProtection,msSuspendMessageForNewSessionWhenHavingPendingNavigation,msSyncEdgeCollections,msTabResourceStats,msTokenizationAutofillInlineEnabled,msTouchMode,msTriggeringSignalGenerator,msUserUnderstanding,msVideoSuperResolutionUI,msWalletBuyNow,msWalletCheckout,msWalletDiagnosticDataLogger,msWalletHubEntry,msWalletHubIntlP3,msWalletPartialCard,msWalletPasswordCategorization,msWalletPasswordCategorizationPlatformExpansion,msWalletTokenizationCardMetadata,msWalletTokenizedAutofill,msWebAssist,msWebAssistHistorySearchService,msWebOOUI,msWindowsTaskManager,msWindowsUserActivities,msZipPayVirtualCard --variations-seed-version --mojo-platform-channel-handle=2488 /prefetch:13 /pfhostedapp:b239454542aeb4426687a343f2ad9726df39e1a8 List of affected devices: STORAGE\Volume\{c67841dd-cd1b-11f0-8722-806e6f6e6963}#0000000001100000
|
| | System | Warning | 223 | 2025-11-29 04:43:57 | SYSTEM | Microsoft-Windows-Kernel-PnP | 225: The application \Device\HarddiskVolume2\Windows\System32\svchost.exe with process id 8904 stopped the removal or ejection for the device ACPI\PNP0A08\2&daba3ff&0. Process command line: C:\WINDOWS\system32\svchost.exe -k LocalService -p -s NPSMSvc List of affected devices: STORAGE\Volume\{c67841dd-cd1b-11f0-8722-806e6f6e6963}#0000000001100000
|
| | System | Warning | 223 | 2025-11-29 04:43:57 | SYSTEM | Microsoft-Windows-Kernel-PnP | 225: The application \Device\HarddiskVolume2\Windows\System32\SearchIndexer.exe with process id 9292 stopped the removal or ejection for the device ACPI\PNP0A08\2&daba3ff&0. Process command line: C:\WINDOWS\system32\SearchIndexer.exe /Embedding List of affected devices: STORAGE\Volume\{c67841dd-cd1b-11f0-8722-806e6f6e6963}#0000000001100000
|
| | System | Warning | 223 | 2025-11-29 04:43:57 | SYSTEM | Microsoft-Windows-Kernel-PnP | 225: The application \Device\HarddiskVolume2\Program Files (x86)\Microsoft\Edge\Application\msedge.exe with process id 9308 stopped the removal or ejection for the device ACPI\PNP0A08\2&daba3ff&0. Process command line: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --no-pre-read-main-dll --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1.25 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --time-ticks-at-unix-epoch=-1764419504945837 --launch-time-ticks=117745552 --skip-read-main-dll --metrics-shmem-handle=8260,i,1647140191953158479,2709063737171939114,2097152 --field-trial-handle=2348,i,4383914887142717900,4649832010531238256,262144 --variations-seed-version --mojo-platform-channel-handle=8244 /prefetch:1 List of affected devices: STORAGE\Volume\{c67841dd-cd1b-11f0-8722-806e6f6e6963}#0000000001100000
|
| | System | Warning | 223 | 2025-11-29 04:43:57 | SYSTEM | Microsoft-Windows-Kernel-PnP | 225: The application \Device\HarddiskVolume2\Windows\System32\SearchProtocolHost.exe with process id 9364 stopped the removal or ejection for the device ACPI\PNP0A08\2&daba3ff&0. Process command line: "C:\WINDOWS\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" List of affected devices: STORAGE\Volume\{c67841dd-cd1b-11f0-8722-806e6f6e6963}#0000000001100000
|
| | System | Warning | 223 | 2025-11-29 04:43:57 | SYSTEM | Microsoft-Windows-Kernel-PnP | 225: The application \Device\HarddiskVolume2\Windows\System32\SearchProtocolHost.exe with process id 9404 stopped the removal or ejection for the device ACPI\PNP0A08\2&daba3ff&0. Process command line: "C:\WINDOWS\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-2954332259-1466799094-2054226798-10012_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-2954332259-1466799094-2054226798-10012 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1" List of affected devices: STORAGE\Volume\{c67841dd-cd1b-11f0-8722-806e6f6e6963}#0000000001100000
|
| | System | Warning | 223 | 2025-11-29 04:43:57 | SYSTEM | Microsoft-Windows-Kernel-PnP | 225: The application \Device\HarddiskVolume2\Program Files (x86)\Microsoft\Edge\Application\msedge.exe with process id 9472 stopped the removal or ejection for the device ACPI\PNP0A08\2&daba3ff&0. Process command line: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --no-pre-read-main-dll --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1.25 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --time-ticks-at-unix-epoch=-1764419504945837 --launch-time-ticks=115995249 --skip-read-main-dll --metrics-shmem-handle=5564,i,6162628953556025520,8274258594588635617,2097152 --field-trial-handle=2348,i,4383914887142717900,4649832010531238256,262144 --variations-seed-version --mojo-platform-channel-handle=5676 /prefetch:1 List of affected devices: STORAGE\Volume\{c67841dd-cd1b-11f0-8722-806e6f6e6963}#0000000001100000
|
| | System | Warning | 223 | 2025-11-29 04:43:57 | SYSTEM | Microsoft-Windows-Kernel-PnP | 225: The application \Device\HarddiskVolume2\Windows\System32\svchost.exe with process id 9520 stopped the removal or ejection for the device ACPI\PNP0A08\2&daba3ff&0. Process command line: C:\WINDOWS\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts List of affected devices: STORAGE\Volume\{c67841dd-cd1b-11f0-8722-806e6f6e6963}#0000000001100000
|
| | System | Warning | 223 | 2025-11-29 04:43:57 | SYSTEM | Microsoft-Windows-Kernel-PnP | 225: The application \Device\HarddiskVolume2\Windows\System32\SearchFilterHost.exe with process id 9532 stopped the removal or ejection for the device ACPI\PNP0A08\2&daba3ff&0. Process command line: "C:\WINDOWS\System32\SearchFilterHost.exe" 888 2828 2836 872 {0E5DCEC5-7795-4E38-9621-94DFD9F9A421} List of affected devices: STORAGE\Volume\{c67841dd-cd1b-11f0-8722-806e6f6e6963}#0000000001100000
|
| | System | Warning | 223 | 2025-11-29 04:43:57 | SYSTEM | Microsoft-Windows-Kernel-PnP | 225: The application \Device\HarddiskVolume2\Windows\System32\smartscreen.exe with process id 9568 stopped the removal or ejection for the device ACPI\PNP0A08\2&daba3ff&0. Process command line: C:\Windows\System32\smartscreen.exe -Embedding List of affected devices: STORAGE\Volume\{c67841dd-cd1b-11f0-8722-806e6f6e6963}#0000000001100000
|
| | System | Warning | 223 | 2025-11-29 04:43:57 | SYSTEM | Microsoft-Windows-Kernel-PnP | 225: The application \Device\HarddiskVolume2\Windows\System32\SecurityHealthSystray.exe with process id 9676 stopped the removal or ejection for the device ACPI\PNP0A08\2&daba3ff&0. Process command line: "C:\Windows\System32\SecurityHealthSystray.exe" List of affected devices: STORAGE\Volume\{c67841dd-cd1b-11f0-8722-806e6f6e6963}#0000000001100000
|
| | System | Warning | 223 | 2025-11-29 04:43:57 | SYSTEM | Microsoft-Windows-Kernel-PnP | 225: The application \Device\HarddiskVolume2\Windows\System32\SecurityHealthService.exe with process id 9696 stopped the removal or ejection for the device ACPI\PNP0A08\2&daba3ff&0. Process command line: C:\WINDOWS\system32\SecurityHealthService.exe List of affected devices: STORAGE\Volume\{c67841dd-cd1b-11f0-8722-806e6f6e6963}#0000000001100000
|
| | System | Warning | 223 | 2025-11-29 04:43:57 | SYSTEM | Microsoft-Windows-Kernel-PnP | 225: The application \Device\HarddiskVolume2\AMD\AMD-Software-Installer\Bin64\AMDSoftwareInstaller.exe with process id 9752 stopped the removal or ejection for the device ACPI\PNP0A08\2&daba3ff&0. Process command line: "C:\AMD\AMD-Software-Installer\BIN64\AMDSoftwareInstaller.exe" -CLEANAFTERINSTALL -LAUNCHEDFROMNSIS List of affected devices: STORAGE\Volume\{c67841dd-cd1b-11f0-8722-806e6f6e6963}#0000000001100000
|
| | System | Warning | 223 | 2025-11-29 04:43:57 | SYSTEM | Microsoft-Windows-Kernel-PnP | 225: The application \Device\HarddiskVolume2\Program Files (x86)\Microsoft\Edge\Application\msedge.exe with process id 9760 stopped the removal or ejection for the device ACPI\PNP0A08\2&daba3ff&0. Process command line: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start List of affected devices: STORAGE\Volume\{c67841dd-cd1b-11f0-8722-806e6f6e6963}#0000000001100000
|
| | System | Warning | 223 | 2025-11-29 04:43:57 | SYSTEM | Microsoft-Windows-Kernel-PnP | 225: The application \Device\HarddiskVolume2\Program Files (x86)\Microsoft\Edge\Application\msedge.exe with process id 9796 stopped the removal or ejection for the device ACPI\PNP0A08\2&daba3ff&0. Process command line: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\CogiArt\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\CogiArt\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=140.0.7339.133 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=140.0.3485.66 --initial-client-data=0x26c,0x270,0x274,0x268,0x27c,0x7fff2c8a2200,0x7fff2c8a220c,0x7fff2c8a2218 List of affected devices: STORAGE\Volume\{c67841dd-cd1b-11f0-8722-806e6f6e6963}#0000000001100000
|
| | System | Warning | 223 | 2025-11-29 04:43:57 | SYSTEM | Microsoft-Windows-Kernel-PnP | 225: The application \Device\HarddiskVolume2\Program Files (x86)\Microsoft\Edge\Application\msedge.exe with process id 10000 stopped the removal or ejection for the device ACPI\PNP0A08\2&daba3ff&0. Process command line: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --startup-read-main-dll --metrics-shmem-handle=2092,i,4887180018940892193,14466571100499298652,262144 --field-trial-handle=2348,i,4383914887142717900,4649832010531238256,262144 --variations-seed-version --mojo-platform-channel-handle=2316 /prefetch:2 List of affected devices: STORAGE\Volume\{c67841dd-cd1b-11f0-8722-806e6f6e6963}#0000000001100000
|
| | System | Warning | 223 | 2025-11-29 04:43:57 | SYSTEM | Microsoft-Windows-Kernel-PnP | 225: The application \Device\HarddiskVolume2\Program Files (x86)\Microsoft\Edge\Application\msedge.exe with process id 10008 stopped the removal or ejection for the device ACPI\PNP0A08\2&daba3ff&0. Process command line: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --startup-read-main-dll --metrics-shmem-handle=2380,i,10255135448204520466,12585701750255230017,524288 --field-trial-handle=2348,i,4383914887142717900,4649832010531238256,262144 --variations-seed-version --mojo-platform-channel-handle=2496 /prefetch:11 List of affected devices: STORAGE\Volume\{c67841dd-cd1b-11f0-8722-806e6f6e6963}#0000000001100000
|
| | System | Warning | 223 | 2025-11-29 04:43:57 | SYSTEM | Microsoft-Windows-Kernel-PnP | 225: The application \Device\HarddiskVolume2\Program Files (x86)\Microsoft\Edge\Application\msedge.exe with process id 10068 stopped the removal or ejection for the device ACPI\PNP0A08\2&daba3ff&0. Process command line: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --startup-read-main-dll --metrics-shmem-handle=2864,i,17973114004821567313,17809559298368817542,524288 --field-trial-handle=2348,i,4383914887142717900,4649832010531238256,262144 --variations-seed-version --mojo-platform-channel-handle=2924 /prefetch:13 List of affected devices: STORAGE\Volume\{c67841dd-cd1b-11f0-8722-806e6f6e6963}#0000000001100000
|
| | System | Warning | 223 | 2025-11-29 04:43:57 | SYSTEM | Microsoft-Windows-Kernel-PnP | 225: The application \Device\HarddiskVolume2\Program Files (x86)\Microsoft\EdgeWebView\Application\140.0.3485.66\msedgewebview2.exe with process id 10248 stopped the removal or ejection for the device ACPI\PNP0A08\2&daba3ff&0. Process command line: "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\140.0.3485.66\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\CogiArt\AppData\Local\Packages\MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy\LocalState\EBWebView" --webview-exe-name=Widgets.exe --webview-exe-version=525.18101.20.0 --embedded-browser-webview=1 --no-pre-read-main-dll --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1.25 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--expose-gc --ms-user-locale=" --time-ticks-at-unix-epoch=-1764419504945837 --launch-time-ticks=94129476 --ssd-no-pressure-read-main-dll --metrics-shmem-handle=3752,i,2830136848684407124,8583458329782934973,2097152 --field-trial-handle=1808,i,15071252571358623589,15946776921661307760,262144 --enable-features=ForceSWDCompWhenDCompFallbackRequired,msAggressiveCacheTrimming,msCustomDataPartition,msWebView2NoTabForScreenShare,msWindowsTaskManager --disable-features=BackForwardCache,BackgroundTabLoadingFromPerformanceManager,CloseOmniboxPopupOnInactiveAreaClick,CollectAVProductsInfo,CollectCodeIntegrityInfo,EnableHangWatcher,FilterAdsOnAbusiveSites,GetWifiProtocol,LoginDetection,MediaFoundationCameraUsageMonitoring,PreconnectToSearch,SafetyHub,SegmentationPlatform,SpareRendererForSitePerProcess,Ukm,WebPayments,msAITrackerClassification,msAbydosForWindowlessWV2,msAffirmVirtualCard,msAllowChromeWebstore,msAllowMSAPrtSSOForNonMSAProfile,msApplicationGuard,msAskBeforeClosingMultipleTabs,msAutoToggleAADPrtSSOForNonAADProfile,msAutofillEdgeCoupons,msAutofillEdgeCouponsAutoApply,msAutofillEdgeServiceRequest,msAutofillEnableEdgeSuggestions,msAutomaticTabFreeze,msBrowserSettingsSupported,msCoarseGeolocationService,msDataProtection,msDesktopMode,msDesktopRewards,msDisableVariationsSeedFetchThrottling,msEEProactiveHistory,msETFOffstoreExtensionFileDataCollection,msETFPasswordTheftDNRActionSignals,msEdgeAdPlatformUI,msEdgeAddWebCapturetoCollections,msEdgeAutofillShowDeployedPassword,msEdgeCaptureSelectionInPDF,msEdgeCloudConfigService,msEdgeCloudConfigServiceV2,msEdgeCohorts,msEdgeCollectionsPrismExperiment1,msEdgeCollectionsPrismOverallMigration,msEdgeComposeNext,msEdgeEnableNurturingFramework,msEdgeEnclavePrefsBasic,msEdgeEnclavePrefsNotification,msEdgeFaviconService,msEdgeHJTelemetry,msEdgeHubAppSkype,msEdgeImageEditorUI,msEdgeLinkDoctor,msEdgeMouseGestureDefaultEnabled,msEdgeMouseGestureSupported,msEdgeNewDeviceFre,msEdgeOnRampFRE,msEdgeOnRampImport,msEdgePDFCMHighlightUX,msEdgePasswordIris,msEdgePasswordIrisSaveBubble,msEdgeProngPersonalization,msEdgeReadingView,msEdgeRose,msEdgeScreenshotUI,msEdgeSendTabToSelf,msEdgeSettingsImport,msEdgeSettingsImportV2,msEdgeShoppingPersistentStorage,msEdgeShoppingUI,msEdgeSmartFind,msEdgeSuperDragDefaultEnabled,msEdgeSuperDragDropSupported,msEdgeTranslate,msEdgeUpdatesMoreMenuPill,msEdgeWebCapture,msEdgeWebCaptureUniformExperience,msEdgeWebContentFilteringFeedback,msEdgeWorkSearchBanner,msEnableCustomJobMemoryLimitsOnXbox,msEnableMIPForPDF,msEnablePdfUpsell,msEnableThirdPartyScanning,msEnableWebSignInCta,msEnableWebToBrowserSignIn,msEndpointDlp,msEntityExtraction,msExtensionTelemetryFramework,msExternalTaskManager,msFileSystemAccessDirectoryIterationBlocklistCheck,msForceBrowserSignIn,msForeignSessionsPage,msGeolocationAccessService,msGeolocationOSLocationPermissionFallback,msGeolocationSQMService,msGeolocationService,msGrowthInfraLaunchSourceLogging,msGuidedSwitchAllowed,msHubPinPersist,msImplicitSignin,msIrm,msIrmv2,msKlarnaVirtualCard,msLlmConsumerDlpPurview,msLoadStatistics,msLogIsEdgePinnedToTaskbarOnLaunch,msMIPCrossTenantPdfViewSupport,msMdatpWebSiteDlp,msNotificationPermissionForPWA,msNumberOfSitesToPin,msNurturingGlobalSitePinningOnCloseModal,msNurturingSitePinningCITopSites,msNurturingSitePinningWithWindowsConsent,msOnHoverSearchInSidebar,msOpenOfficeDocumentsInWebViewer,msPageInteractionRestrictionRevoke,msPasswordBreachDetection,msPdfAnnotationsVisibility,msPdfDataRecovery,msPdfDigitalSignatureRead,msPdfFreeText,msPdfFreeTextForCJK,msPdfHighlightMode,msPdfInking,msPdfKeyphraseSupport,msPdfOOUI,msPdfPopupMarkerRenderer,msPdfShare,msPdfSharedLibrary,msPdfTextNote,msPdfTextNoteMoreMenu,msPdfThumbnailCache,msPdfUnderside,msPdfViewRestore,msPersonalizationUMA,msPriceComparison,msPromptDefaultHandlerForPDF,msReactiveSearch,msReadAloud,msReadAloudPdf,msRedirectToShoreline,msRevokeExtensions,msSaasDlp,msShoppingTrigger,msShorelineSearch,msShorelineSearchFindOnPageWebUI,msShowOfflineGameEntrance,msShowReadAloudIconInAddressBar,msShowUXForAADPrtSSOForNonAADProfile,msSitePinningWithoutUi,msSuspendMessageForNewSessionWhenHavingPendingNavigation,msSyncEdgeCollections,msTabResourceStats,msTokenizationAutofillInlineEnabled,msTouchMode,msTriggeringSignalGenerator,msUserUnderstanding,msVideoSuperResolutionUI,msWalletBuyNow,msWalletCheckout,msWalletDiagnosticDataLogger,msWalletHubEntry,msWalletHubIntlP3,msWalletPartialCard,msWalletPasswordCategorization,msWalletPasswordCategorizationPlatformExpansion,msWalletTokenizationCardMetadata,msWalletTokenizedAutofill,msWebAssist,msWebAssistHistorySearchService,msWebOOUI,msWindowsUserActivities,msZipPayVirtualCard --variations-seed-version --mojo-platform-channel-handle=3720 /pfhostedapp:f6f66ce26a423f5091f683b9856ad54f096f2ff7 /prefetch:1 List of affected devices: STORAGE\Volume\{c67841dd-cd1b-11f0-8722-806e6f6e6963}#0000000001100000
|
| | System | Warning | 223 | 2025-11-29 04:43:57 | SYSTEM | Microsoft-Windows-Kernel-PnP | 225: The application \Device\HarddiskVolume2\Windows\System32\svchost.exe with process id 10272 stopped the removal or ejection for the device ACPI\PNP0A08\2&daba3ff&0. Process command line: C:\WINDOWS\system32\svchost.exe -k netsvcs -p -s UsoSvc List of affected devices: STORAGE\Volume\{c67841dd-cd1b-11f0-8722-806e6f6e6963}#0000000001100000
|
| | System | Warning | 223 | 2025-11-29 04:43:57 | SYSTEM | Microsoft-Windows-Kernel-PnP | 225: The application \Device\HarddiskVolume2\Windows\System32\dllhost.exe with process id 10568 stopped the removal or ejection for the device ACPI\PNP0A08\2&daba3ff&0. Process command line: "C:\WINDOWS\system32\DllHost.exe" /Processid:{CA6CC9F1-867A-481E-951E-A28C5E4F01EA} List of affected devices: STORAGE\Volume\{c67841dd-cd1b-11f0-8722-806e6f6e6963}#0000000001100000
|
| | System | Warning | 223 | 2025-11-29 04:43:57 | SYSTEM | Microsoft-Windows-Kernel-PnP | 225: The application \Device\HarddiskVolume2\Users\CogiArt\AppData\Local\Microsoft\OneDrive\OneDrive.exe with process id 10620 stopped the removal or ejection for the device ACPI\PNP0A08\2&daba3ff&0. Process command line: "C:\Users\CogiArt\AppData\Local\Microsoft\OneDrive\OneDrive.exe" /background List of affected devices: STORAGE\Volume\{c67841dd-cd1b-11f0-8722-806e6f6e6963}#0000000001100000
|
| | System | Warning | 223 | 2025-11-29 04:43:57 | SYSTEM | Microsoft-Windows-Kernel-PnP | 225: The application \Device\HarddiskVolume2\Windows\System32\svchost.exe with process id 10652 stopped the removal or ejection for the device ACPI\PNP0A08\2&daba3ff&0. Process command line: C:\WINDOWS\system32\svchost.exe -k netsvcs -p -s lfsvc List of affected devices: STORAGE\Volume\{c67841dd-cd1b-11f0-8722-806e6f6e6963}#0000000001100000
|
| | System | Warning | 223 | 2025-11-29 04:43:57 | SYSTEM | Microsoft-Windows-Kernel-PnP | 225: The application \Device\HarddiskVolume2\Windows\System32\svchost.exe with process id 10820 stopped the removal or ejection for the device ACPI\PNP0A08\2&daba3ff&0. Process command line: C:\WINDOWS\System32\svchost.exe -k netsvcs -p -s BITS List of affected devices: SCSI\Disk&Ven_&Prod_KINGSTON_SV300S3\4&fefddb&0&020000 STORAGE\Volume\{c67841dd-cd1b-11f0-8722-806e6f6e6963}#0000000001100000
|
| | System | Warning | 223 | 2025-11-29 04:43:57 | SYSTEM | Microsoft-Windows-Kernel-PnP | 225: The application \Device\HarddiskVolume2\Windows\System32\svchost.exe with process id 10884 stopped the removal or ejection for the device ACPI\PNP0A08\2&daba3ff&0. Process command line: C:\WINDOWS\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s SSDPSRV List of affected devices: STORAGE\Volume\{c67841dd-cd1b-11f0-8722-806e6f6e6963}#0000000001100000
|
| | System | Warning | 223 | 2025-11-29 04:43:57 | SYSTEM | Microsoft-Windows-Kernel-PnP | 225: The application \Device\HarddiskVolume2\Windows\System32\amdfendrsr.exe with process id 11192 stopped the removal or ejection for the device ACPI\PNP0A08\2&daba3ff&0. Process command line: C:\WINDOWS\System32\amdfendrsr.exe List of affected devices: STORAGE\Volume\{c67841dd-cd1b-11f0-8722-806e6f6e6963}#0000000001100000
|
| | System | Warning | 223 | 2025-11-29 04:43:57 | SYSTEM | Microsoft-Windows-Kernel-PnP | 225: The application \Device\HarddiskVolume2\Program Files (x86)\Microsoft\Edge\Application\msedge.exe with process id 11376 stopped the removal or ejection for the device ACPI\PNP0A08\2&daba3ff&0. Process command line: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --no-pre-read-main-dll --skip-read-main-dll --metrics-shmem-handle=4028,i,2623425999095553841,275752566819237121,524288 --field-trial-handle=2348,i,4383914887142717900,4649832010531238256,262144 --variations-seed-version --mojo-platform-channel-handle=7460 /prefetch:14 List of affected devices: STORAGE\Volume\{c67841dd-cd1b-11f0-8722-806e6f6e6963}#0000000001100000
|
| | System | Warning | 223 | 2025-11-29 04:43:57 | SYSTEM | Microsoft-Windows-Kernel-PnP | 225: The application \Device\HarddiskVolume2\Windows\System32\RuntimeBroker.exe with process id 11432 stopped the removal or ejection for the device ACPI\PNP0A08\2&daba3ff&0. Process command line: C:\Windows\System32\RuntimeBroker.exe -Embedding List of affected devices: STORAGE\Volume\{c67841dd-cd1b-11f0-8722-806e6f6e6963}#0000000001100000
|
| | System | Warning | 223 | 2025-11-29 04:43:57 | SYSTEM | Microsoft-Windows-Kernel-PnP | 225: The application \Device\HarddiskVolume2\Program Files (x86)\Microsoft\EdgeWebView\Application\140.0.3485.66\msedgewebview2.exe with process id 11716 stopped the removal or ejection for the device ACPI\PNP0A08\2&daba3ff&0. Process command line: "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\140.0.3485.66\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=Widgets.exe --webview-exe-version=525.18101.20.0 --user-data-dir="C:\Users\CogiArt\AppData\Local\Packages\MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy\LocalState\EBWebView" --noerrdialogs --disk-cache-size=52428800 --edge-webview-is-background --lang=en-US --mojo-named-platform-channel-pipe=6956.11712.6572351898908404582 /pfhostedapp:f6f66ce26a423f5091f683b9856ad54f096f2ff7 List of affected devices: STORAGE\Volume\{c67841dd-cd1b-11f0-8722-806e6f6e6963}#0000000001100000
|
| | System | Warning | 223 | 2025-11-29 04:43:57 | SYSTEM | Microsoft-Windows-Kernel-PnP | 225: The application \Device\HarddiskVolume2\Program Files (x86)\Microsoft\EdgeWebView\Application\140.0.3485.66\msedgewebview2.exe with process id 11752 stopped the removal or ejection for the device ACPI\PNP0A08\2&daba3ff&0. Process command line: "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\140.0.3485.66\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\CogiArt\AppData\Local\Packages\MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy\LocalState\EBWebView /prefetch:4 /pfhostedapp:f6f66ce26a423f5091f683b9856ad54f096f2ff7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\CogiArt\AppData\Local\Packages\MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy\LocalState\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=140.0.7339.133 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\140.0.3485.66\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=140.0.3485.66 --initial-client-data=0x174,0x178,0x17c,0x150,0x184,0x7fff2c8a2200,0x7fff2c8a220c,0x7fff2c8a2218 List of affected devices: STORAGE\Volume\{c67841dd-cd1b-11f0-8722-806e6f6e6963}#0000000001100000
|
| | System | Warning | 223 | 2025-11-29 04:43:57 | SYSTEM | Microsoft-Windows-Kernel-PnP | 225: The application \Device\HarddiskVolume2\Program Files (x86)\Microsoft\EdgeWebView\Application\140.0.3485.66\msedgewebview2.exe with process id 11936 stopped the removal or ejection for the device ACPI\PNP0A08\2&daba3ff&0. Process command line: "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\140.0.3485.66\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\CogiArt\AppData\Local\Packages\MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy\LocalState\EBWebView" --webview-exe-name=Widgets.exe --webview-exe-version=525.18101.20.0 --embedded-browser-webview=1 --no-pre-read-main-dll --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --startup-read-main-dll --metrics-shmem-handle=1724,i,8517234338539572384,3758977164289618299,262144 --field-trial-handle=1808,i,15071252571358623589,15946776921661307760,262144 --enable-features=ForceSWDCompWhenDCompFallbackRequired,msAggressiveCacheTrimming,msCustomDataPartition,msWebView2NoTabForScreenShare,msWindowsTaskManager --disable-features=BackForwardCache,BackgroundTabLoadingFromPerformanceManager,CloseOmniboxPopupOnInactiveAreaClick,CollectAVProductsInfo,CollectCodeIntegrityInfo,EnableHangWatcher,FilterAdsOnAbusiveSites,GetWifiProtocol,LoginDetection,MediaFoundationCameraUsageMonitoring,PreconnectToSearch,SafetyHub,SegmentationPlatform,SpareRendererForSitePerProcess,Ukm,WebPayments,msAITrackerClassification,msAbydosForWindowlessWV2,msAffirmVirtualCard,msAllowChromeWebstore,msAllowMSAPrtSSOForNonMSAProfile,msApplicationGuard,msAskBeforeClosingMultipleTabs,msAutoToggleAADPrtSSOForNonAADProfile,msAutofillEdgeCoupons,msAutofillEdgeCouponsAutoApply,msAutofillEdgeServiceRequest,msAutofillEnableEdgeSuggestions,msAutomaticTabFreeze,msBrowserSettingsSupported,msCoarseGeolocationService,msDataProtection,msDesktopMode,msDesktopRewards,msDisableVariationsSeedFetchThrottling,msEEProactiveHistory,msETFOffstoreExtensionFileDataCollection,msETFPasswordTheftDNRActionSignals,msEdgeAdPlatformUI,msEdgeAddWebCapturetoCollections,msEdgeAutofillShowDeployedPassword,msEdgeCaptureSelectionInPDF,msEdgeCloudConfigService,msEdgeCloudConfigServiceV2,msEdgeCohorts,msEdgeCollectionsPrismExperiment1,msEdgeCollectionsPrismOverallMigration,msEdgeComposeNext,msEdgeEnableNurturingFramework,msEdgeEnclavePrefsBasic,msEdgeEnclavePrefsNotification,msEdgeFaviconService,msEdgeHJTelemetry,msEdgeHubAppSkype,msEdgeImageEditorUI,msEdgeLinkDoctor,msEdgeMouseGestureDefaultEnabled,msEdgeMouseGestureSupported,msEdgeNewDeviceFre,msEdgeOnRampFRE,msEdgeOnRampImport,msEdgePDFCMHighlightUX,msEdgePasswordIris,msEdgePasswordIrisSaveBubble,msEdgeProngPersonalization,msEdgeReadingView,msEdgeRose,msEdgeScreenshotUI,msEdgeSendTabToSelf,msEdgeSettingsImport,msEdgeSettingsImportV2,msEdgeShoppingPersistentStorage,msEdgeShoppingUI,msEdgeSmartFind,msEdgeSuperDragDefaultEnabled,msEdgeSuperDragDropSupported,msEdgeTranslate,msEdgeUpdatesMoreMenuPill,msEdgeWebCapture,msEdgeWebCaptureUniformExperience,msEdgeWebContentFilteringFeedback,msEdgeWorkSearchBanner,msEnableCustomJobMemoryLimitsOnXbox,msEnableMIPForPDF,msEnablePdfUpsell,msEnableThirdPartyScanning,msEnableWebSignInCta,msEnableWebToBrowserSignIn,msEndpointDlp,msEntityExtraction,msExtensionTelemetryFramework,msExternalTaskManager,msFileSystemAccessDirectoryIterationBlocklistCheck,msForceBrowserSignIn,msForeignSessionsPage,msGeolocationAccessService,msGeolocationOSLocationPermissionFallback,msGeolocationSQMService,msGeolocationService,msGrowthInfraLaunchSourceLogging,msGuidedSwitchAllowed,msHubPinPersist,msImplicitSignin,msIrm,msIrmv2,msKlarnaVirtualCard,msLlmConsumerDlpPurview,msLoadStatistics,msLogIsEdgePinnedToTaskbarOnLaunch,msMIPCrossTenantPdfViewSupport,msMdatpWebSiteDlp,msNotificationPermissionForPWA,msNumberOfSitesToPin,msNurturingGlobalSitePinningOnCloseModal,msNurturingSitePinningCITopSites,msNurturingSitePinningWithWindowsConsent,msOnHoverSearchInSidebar,msOpenOfficeDocumentsInWebViewer,msPageInteractionRestrictionRevoke,msPasswordBreachDetection,msPdfAnnotationsVisibility,msPdfDataRecovery,msPdfDigitalSignatureRead,msPdfFreeText,msPdfFreeTextForCJK,msPdfHighlightMode,msPdfInking,msPdfKeyphraseSupport,msPdfOOUI,msPdfPopupMarkerRenderer,msPdfShare,msPdfSharedLibrary,msPdfTextNote,msPdfTextNoteMoreMenu,msPdfThumbnailCache,msPdfUnderside,msPdfViewRestore,msPersonalizationUMA,msPriceComparison,msPromptDefaultHandlerForPDF,msReactiveSearch,msReadAloud,msReadAloudPdf,msRedirectToShoreline,msRevokeExtensions,msSaasDlp,msShoppingTrigger,msShorelineSearch,msShorelineSearchFindOnPageWebUI,msShowOfflineGameEntrance,msShowReadAloudIconInAddressBar,msShowUXForAADPrtSSOForNonAADProfile,msSitePinningWithoutUi,msSuspendMessageForNewSessionWhenHavingPendingNavigation,msSyncEdgeCollections,msTabResourceStats,msTokenizationAutofillInlineEnabled,msTouchMode,msTriggeringSignalGenerator,msUserUnderstanding,msVideoSuperResolutionUI,msWalletBuyNow,msWalletCheckout,msWalletDiagnosticDataLogger,msWalletHubEntry,msWalletHubIntlP3,msWalletPartialCard,msWalletPasswordCategorization,msWalletPasswordCategorizationPlatformExpansion,msWalletTokenizationCardMetadata,msWalletTokenizedAutofill,msWebAssist,msWebAssistHistorySearchService,msWebOOUI,msWindowsUserActivities,msZipPayVirtualCard --variations-seed-version --mojo-platform-channel-handle=1804 /prefetch:2 /pfhostedapp:f6f66ce26a423f5091f683b9856ad54f096f2ff7 List of affected devices: STORAGE\Volume\{c67841dd-cd1b-11f0-8722-806e6f6e6963}#0000000001100000
|
| | System | Warning | 223 | 2025-11-29 04:43:57 | SYSTEM | Microsoft-Windows-Kernel-PnP | 225: The application \Device\HarddiskVolume2\Program Files (x86)\Microsoft\EdgeWebView\Application\140.0.3485.66\msedgewebview2.exe with process id 11956 stopped the removal or ejection for the device ACPI\PNP0A08\2&daba3ff&0. Process command line: "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\140.0.3485.66\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\CogiArt\AppData\Local\Packages\MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy\LocalState\EBWebView" --webview-exe-name=Widgets.exe --webview-exe-version=525.18101.20.0 --embedded-browser-webview=1 --no-pre-read-main-dll --startup-read-main-dll --metrics-shmem-handle=2132,i,1593952252021684924,15864659763956198671,524288 --field-trial-handle=1808,i,15071252571358623589,15946776921661307760,262144 --enable-features=ForceSWDCompWhenDCompFallbackRequired,msAggressiveCacheTrimming,msCustomDataPartition,msWebView2NoTabForScreenShare,msWindowsTaskManager --disable-features=BackForwardCache,BackgroundTabLoadingFromPerformanceManager,CloseOmniboxPopupOnInactiveAreaClick,CollectAVProductsInfo,CollectCodeIntegrityInfo,EnableHangWatcher,FilterAdsOnAbusiveSites,GetWifiProtocol,LoginDetection,MediaFoundationCameraUsageMonitoring,PreconnectToSearch,SafetyHub,SegmentationPlatform,SpareRendererForSitePerProcess,Ukm,WebPayments,msAITrackerClassification,msAbydosForWindowlessWV2,msAffirmVirtualCard,msAllowChromeWebstore,msAllowMSAPrtSSOForNonMSAProfile,msApplicationGuard,msAskBeforeClosingMultipleTabs,msAutoToggleAADPrtSSOForNonAADProfile,msAutofillEdgeCoupons,msAutofillEdgeCouponsAutoApply,msAutofillEdgeServiceRequest,msAutofillEnableEdgeSuggestions,msAutomaticTabFreeze,msBrowserSettingsSupported,msCoarseGeolocationService,msDataProtection,msDesktopMode,msDesktopRewards,msDisableVariationsSeedFetchThrottling,msEEProactiveHistory,msETFOffstoreExtensionFileDataCollection,msETFPasswordTheftDNRActionSignals,msEdgeAdPlatformUI,msEdgeAddWebCapturetoCollections,msEdgeAutofillShowDeployedPassword,msEdgeCaptureSelectionInPDF,msEdgeCloudConfigService,msEdgeCloudConfigServiceV2,msEdgeCohorts,msEdgeCollectionsPrismExperiment1,msEdgeCollectionsPrismOverallMigration,msEdgeComposeNext,msEdgeEnableNurturingFramework,msEdgeEnclavePrefsBasic,msEdgeEnclavePrefsNotification,msEdgeFaviconService,msEdgeHJTelemetry,msEdgeHubAppSkype,msEdgeImageEditorUI,msEdgeLinkDoctor,msEdgeMouseGestureDefaultEnabled,msEdgeMouseGestureSupported,msEdgeNewDeviceFre,msEdgeOnRampFRE,msEdgeOnRampImport,msEdgePDFCMHighlightUX,msEdgePasswordIris,msEdgePasswordIrisSaveBubble,msEdgeProngPersonalization,msEdgeReadingView,msEdgeRose,msEdgeScreenshotUI,msEdgeSendTabToSelf,msEdgeSettingsImport,msEdgeSettingsImportV2,msEdgeShoppingPersistentStorage,msEdgeShoppingUI,msEdgeSmartFind,msEdgeSuperDragDefaultEnabled,msEdgeSuperDragDropSupported,msEdgeTranslate,msEdgeUpdatesMoreMenuPill,msEdgeWebCapture,msEdgeWebCaptureUniformExperience,msEdgeWebContentFilteringFeedback,msEdgeWorkSearchBanner,msEnableCustomJobMemoryLimitsOnXbox,msEnableMIPForPDF,msEnablePdfUpsell,msEnableThirdPartyScanning,msEnableWebSignInCta,msEnableWebToBrowserSignIn,msEndpointDlp,msEntityExtraction,msExtensionTelemetryFramework,msExternalTaskManager,msFileSystemAccessDirectoryIterationBlocklistCheck,msForceBrowserSignIn,msForeignSessionsPage,msGeolocationAccessService,msGeolocationOSLocationPermissionFallback,msGeolocationSQMService,msGeolocationService,msGrowthInfraLaunchSourceLogging,msGuidedSwitchAllowed,msHubPinPersist,msImplicitSignin,msIrm,msIrmv2,msKlarnaVirtualCard,msLlmConsumerDlpPurview,msLoadStatistics,msLogIsEdgePinnedToTaskbarOnLaunch,msMIPCrossTenantPdfViewSupport,msMdatpWebSiteDlp,msNotificationPermissionForPWA,msNumberOfSitesToPin,msNurturingGlobalSitePinningOnCloseModal,msNurturingSitePinningCITopSites,msNurturingSitePinningWithWindowsConsent,msOnHoverSearchInSidebar,msOpenOfficeDocumentsInWebViewer,msPageInteractionRestrictionRevoke,msPasswordBreachDetection,msPdfAnnotationsVisibility,msPdfDataRecovery,msPdfDigitalSignatureRead,msPdfFreeText,msPdfFreeTextForCJK,msPdfHighlightMode,msPdfInking,msPdfKeyphraseSupport,msPdfOOUI,msPdfPopupMarkerRenderer,msPdfShare,msPdfSharedLibrary,msPdfTextNote,msPdfTextNoteMoreMenu,msPdfThumbnailCache,msPdfUnderside,msPdfViewRestore,msPersonalizationUMA,msPriceComparison,msPromptDefaultHandlerForPDF,msReactiveSearch,msReadAloud,msReadAloudPdf,msRedirectToShoreline,msRevokeExtensions,msSaasDlp,msShoppingTrigger,msShorelineSearch,msShorelineSearchFindOnPageWebUI,msShowOfflineGameEntrance,msShowReadAloudIconInAddressBar,msShowUXForAADPrtSSOForNonAADProfile,msSitePinningWithoutUi,msSuspendMessageForNewSessionWhenHavingPendingNavigation,msSyncEdgeCollections,msTabResourceStats,msTokenizationAutofillInlineEnabled,msTouchMode,msTriggeringSignalGenerator,msUserUnderstanding,msVideoSuperResolutionUI,msWalletBuyNow,msWalletCheckout,msWalletDiagnosticDataLogger,msWalletHubEntry,msWalletHubIntlP3,msWalletPartialCard,msWalletPasswordCategorization,msWalletPasswordCategorizationPlatformExpansion,msWalletTokenizationCardMetadata,msWalletTokenizedAutofill,msWebAssist,msWebAssistHistorySearchService,msWebOOUI,msWindowsUserActivities,msZipPayVirtualCard --variations-seed-version --mojo-platform-channel-handle=2144 /prefetch:11 /pfhostedapp:f6f66ce26a423f5091f683b9856ad54f096f2ff7 List of affected devices: STORAGE\Volume\{c67841dd-cd1b-11f0-8722-806e6f6e6963}#0000000001100000
|
| | System | Warning | 223 | 2025-11-29 04:43:57 | SYSTEM | Microsoft-Windows-Kernel-PnP | 225: The application \Device\HarddiskVolume2\Program Files (x86)\Microsoft\EdgeWebView\Application\140.0.3485.66\msedgewebview2.exe with process id 12012 stopped the removal or ejection for the device ACPI\PNP0A08\2&daba3ff&0. Process command line: "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\140.0.3485.66\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\CogiArt\AppData\Local\Packages\MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy\LocalState\EBWebView" --webview-exe-name=Widgets.exe --webview-exe-version=525.18101.20.0 --embedded-browser-webview=1 --no-pre-read-main-dll --startup-read-main-dll --metrics-shmem-handle=2228,i,12223978943222714146,2280707477634760545,524288 --field-trial-handle=1808,i,15071252571358623589,15946776921661307760,262144 --enable-features=ForceSWDCompWhenDCompFallbackRequired,msAggressiveCacheTrimming,msCustomDataPartition,msWebView2NoTabForScreenShare,msWindowsTaskManager --disable-features=BackForwardCache,BackgroundTabLoadingFromPerformanceManager,CloseOmniboxPopupOnInactiveAreaClick,CollectAVProductsInfo,CollectCodeIntegrityInfo,EnableHangWatcher,FilterAdsOnAbusiveSites,GetWifiProtocol,LoginDetection,MediaFoundationCameraUsageMonitoring,PreconnectToSearch,SafetyHub,SegmentationPlatform,SpareRendererForSitePerProcess,Ukm,WebPayments,msAITrackerClassification,msAbydosForWindowlessWV2,msAffirmVirtualCard,msAllowChromeWebstore,msAllowMSAPrtSSOForNonMSAProfile,msApplicationGuard,msAskBeforeClosingMultipleTabs,msAutoToggleAADPrtSSOForNonAADProfile,msAutofillEdgeCoupons,msAutofillEdgeCouponsAutoApply,msAutofillEdgeServiceRequest,msAutofillEnableEdgeSuggestions,msAutomaticTabFreeze,msBrowserSettingsSupported,msCoarseGeolocationService,msDataProtection,msDesktopMode,msDesktopRewards,msDisableVariationsSeedFetchThrottling,msEEProactiveHistory,msETFOffstoreExtensionFileDataCollection,msETFPasswordTheftDNRActionSignals,msEdgeAdPlatformUI,msEdgeAddWebCapturetoCollections,msEdgeAutofillShowDeployedPassword,msEdgeCaptureSelectionInPDF,msEdgeCloudConfigService,msEdgeCloudConfigServiceV2,msEdgeCohorts,msEdgeCollectionsPrismExperiment1,msEdgeCollectionsPrismOverallMigration,msEdgeComposeNext,msEdgeEnableNurturingFramework,msEdgeEnclavePrefsBasic,msEdgeEnclavePrefsNotification,msEdgeFaviconService,msEdgeHJTelemetry,msEdgeHubAppSkype,msEdgeImageEditorUI,msEdgeLinkDoctor,msEdgeMouseGestureDefaultEnabled,msEdgeMouseGestureSupported,msEdgeNewDeviceFre,msEdgeOnRampFRE,msEdgeOnRampImport,msEdgePDFCMHighlightUX,msEdgePasswordIris,msEdgePasswordIrisSaveBubble,msEdgeProngPersonalization,msEdgeReadingView,msEdgeRose,msEdgeScreenshotUI,msEdgeSendTabToSelf,msEdgeSettingsImport,msEdgeSettingsImportV2,msEdgeShoppingPersistentStorage,msEdgeShoppingUI,msEdgeSmartFind,msEdgeSuperDragDefaultEnabled,msEdgeSuperDragDropSupported,msEdgeTranslate,msEdgeUpdatesMoreMenuPill,msEdgeWebCapture,msEdgeWebCaptureUniformExperience,msEdgeWebContentFilteringFeedback,msEdgeWorkSearchBanner,msEnableCustomJobMemoryLimitsOnXbox,msEnableMIPForPDF,msEnablePdfUpsell,msEnableThirdPartyScanning,msEnableWebSignInCta,msEnableWebToBrowserSignIn,msEndpointDlp,msEntityExtraction,msExtensionTelemetryFramework,msExternalTaskManager,msFileSystemAccessDirectoryIterationBlocklistCheck,msForceBrowserSignIn,msForeignSessionsPage,msGeolocationAccessService,msGeolocationOSLocationPermissionFallback,msGeolocationSQMService,msGeolocationService,msGrowthInfraLaunchSourceLogging,msGuidedSwitchAllowed,msHubPinPersist,msImplicitSignin,msIrm,msIrmv2,msKlarnaVirtualCard,msLlmConsumerDlpPurview,msLoadStatistics,msLogIsEdgePinnedToTaskbarOnLaunch,msMIPCrossTenantPdfViewSupport,msMdatpWebSiteDlp,msNotificationPermissionForPWA,msNumberOfSitesToPin,msNurturingGlobalSitePinningOnCloseModal,msNurturingSitePinningCITopSites,msNurturingSitePinningWithWindowsConsent,msOnHoverSearchInSidebar,msOpenOfficeDocumentsInWebViewer,msPageInteractionRestrictionRevoke,msPasswordBreachDetection,msPdfAnnotationsVisibility,msPdfDataRecovery,msPdfDigitalSignatureRead,msPdfFreeText,msPdfFreeTextForCJK,msPdfHighlightMode,msPdfInking,msPdfKeyphraseSupport,msPdfOOUI,msPdfPopupMarkerRenderer,msPdfShare,msPdfSharedLibrary,msPdfTextNote,msPdfTextNoteMoreMenu,msPdfThumbnailCache,msPdfUnderside,msPdfViewRestore,msPersonalizationUMA,msPriceComparison,msPromptDefaultHandlerForPDF,msReactiveSearch,msReadAloud,msReadAloudPdf,msRedirectToShoreline,msRevokeExtensions,msSaasDlp,msShoppingTrigger,msShorelineSearch,msShorelineSearchFindOnPageWebUI,msShowOfflineGameEntrance,msShowReadAloudIconInAddressBar,msShowUXForAADPrtSSOForNonAADProfile,msSitePinningWithoutUi,msSuspendMessageForNewSessionWhenHavingPendingNavigation,msSyncEdgeCollections,msTabResourceStats,msTokenizationAutofillInlineEnabled,msTouchMode,msTriggeringSignalGenerator,msUserUnderstanding,msVideoSuperResolutionUI,msWalletBuyNow,msWalletCheckout,msWalletDiagnosticDataLogger,msWalletHubEntry,msWalletHubIntlP3,msWalletPartialCard,msWalletPasswordCategorization,msWalletPasswordCategorizationPlatformExpansion,msWalletTokenizationCardMetadata,msWalletTokenizedAutofill,msWebAssist,msWebAssistHistorySearchService,msWebOOUI,msWindowsUserActivities,msZipPayVirtualCard --variations-seed-version --mojo-platform-channel-handle=2408 /prefetch:13 /pfhostedapp:f6f66ce26a423f5091f683b9856ad54f096f2ff7 List of affected devices: STORAGE\Volume\{c67841dd-cd1b-11f0-8722-806e6f6e6963}#0000000001100000
|
| | System | Warning | 223 | 2025-11-29 04:43:57 | SYSTEM | Microsoft-Windows-Kernel-PnP | 225: The application \Device\HarddiskVolume2\Windows\System32\wbem\WmiPrvSE.exe with process id 12512 stopped the removal or ejection for the device ACPI\PNP0A08\2&daba3ff&0. Process command line: C:\WINDOWS\system32\wbem\wmiprvse.exe List of affected devices: -Embedding
|
| | System | Warning | 223 | 2025-11-29 04:43:57 | SYSTEM | Microsoft-Windows-Kernel-PnP | 225: The application \Device\HarddiskVolume2\Program Files (x86)\Microsoft\Edge\Application\msedge.exe with process id 12520 stopped the removal or ejection for the device ACPI\PNP0A08\2&daba3ff&0. Process command line: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --no-pre-read-main-dll --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1.25 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --time-ticks-at-unix-epoch=-1764419504945837 --launch-time-ticks=101673525 --skip-read-main-dll --metrics-shmem-handle=5536,i,12393851022284184564,4650058075989229088,2097152 --field-trial-handle=2348,i,4383914887142717900,4649832010531238256,262144 --variations-seed-version --mojo-platform-channel-handle=5852 /prefetch:1 List of affected devices: STORAGE\Volume\{c67841dd-cd1b-11f0-8722-806e6f6e6963}#0000000001100000
|
| | System | Warning | 223 | 2025-11-29 04:43:57 | SYSTEM | Microsoft-Windows-Kernel-PnP | 225: The application \Device\HarddiskVolume2\Program Files (x86)\Microsoft\Edge\Application\msedge.exe with process id 12640 stopped the removal or ejection for the device ACPI\PNP0A08\2&daba3ff&0. Process command line: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --no-pre-read-main-dll --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1.25 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --time-ticks-at-unix-epoch=-1764419504945837 --launch-time-ticks=117268181 --skip-read-main-dll --metrics-shmem-handle=5148,i,16092209981013059392,10708454124285461251,2097152 --field-trial-handle=2348,i,4383914887142717900,4649832010531238256,262144 --variations-seed-version --mojo-platform-channel-handle=6140 /prefetch:1 List of affected devices: STORAGE\Volume\{c67841dd-cd1b-11f0-8722-806e6f6e6963}#0000000001100000
|
| | System | Warning | 223 | 2025-11-29 04:43:57 | SYSTEM | Microsoft-Windows-Kernel-PnP | 225: The application \Device\HarddiskVolume2\Program Files (x86)\Microsoft\Edge\Application\msedge.exe with process id 12668 stopped the removal or ejection for the device ACPI\PNP0A08\2&daba3ff&0. Process command line: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --no-pre-read-main-dll --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1.25 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --time-ticks-at-unix-epoch=-1764419504945837 --launch-time-ticks=116335786 --skip-read-main-dll --metrics-shmem-handle=6320,i,10244184655814670071,11558143151516782913,2097152 --field-trial-handle=2348,i,4383914887142717900,4649832010531238256,262144 --variations-seed-version --mojo-platform-channel-handle=5832 /prefetch:1 List of affected devices: STORAGE\Volume\{c67841dd-cd1b-11f0-8722-806e6f6e6963}#0000000001100000
|
| | System | Warning | 223 | 2025-11-29 04:43:57 | SYSTEM | Microsoft-Windows-Kernel-PnP | 225: The application \Device\HarddiskVolume2\Windows\System32\svchost.exe with process id 12712 stopped the removal or ejection for the device ACPI\PNP0A08\2&daba3ff&0. Process command line: C:\WINDOWS\system32\svchost.exe -k UnistackSvcGroup List of affected devices: STORAGE\Volume\{c67841dd-cd1b-11f0-8722-806e6f6e6963}#0000000001100000
|
| | System | Warning | 223 | 2025-11-29 04:43:57 | SYSTEM | Microsoft-Windows-Kernel-PnP | 225: The application \Device\HarddiskVolume2\Program Files (x86)\Microsoft\Edge\Application\msedge.exe with process id 12980 stopped the removal or ejection for the device ACPI\PNP0A08\2&daba3ff&0. Process command line: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --no-pre-read-main-dll --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1.25 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --time-ticks-at-unix-epoch=-1764419504945837 --launch-time-ticks=116189806 --skip-read-main-dll --metrics-shmem-handle=8088,i,7777093429136874999,3959979172431801871,2097152 --field-trial-handle=2348,i,4383914887142717900,4649832010531238256,262144 --variations-seed-version --mojo-platform-channel-handle=6156 /prefetch:1 List of affected devices: STORAGE\Volume\{c67841dd-cd1b-11f0-8722-806e6f6e6963}#0000000001100000
|
| | System | Warning | 223 | 2025-11-29 04:43:57 | SYSTEM | Microsoft-Windows-Kernel-PnP | 225: The application \Device\HarddiskVolume2\Program Files (x86)\Microsoft\Edge\Application\msedge.exe with process id 13236 stopped the removal or ejection for the device ACPI\PNP0A08\2&daba3ff&0. Process command line: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --no-pre-read-main-dll --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1.25 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --time-ticks-at-unix-epoch=-1764419504945837 --launch-time-ticks=102672044 --skip-read-main-dll --metrics-shmem-handle=8184,i,12941509890726566974,1273642130367469043,2097152 --field-trial-handle=2348,i,4383914887142717900,4649832010531238256,262144 --variations-seed-version --mojo-platform-channel-handle=8068 /prefetch:1 List of affected devices: STORAGE\Volume\{c67841dd-cd1b-11f0-8722-806e6f6e6963}#0000000001100000
|
| | System | Warning | 223 | 2025-11-29 04:43:57 | SYSTEM | Microsoft-Windows-Kernel-PnP | 225: The application \Device\HarddiskVolume2\Windows\System32\svchost.exe with process id 13592 stopped the removal or ejection for the device ACPI\PNP0A08\2&daba3ff&0. Process command line: C:\WINDOWS\system32\svchost.exe -k InvSvcGroup -p -s InventorySvc List of affected devices: STORAGE\Volume\{c67841dd-cd1b-11f0-8722-806e6f6e6963}#0000000001100000
|
| | System | Warning | 223 | 2025-11-29 04:43:57 | SYSTEM | Microsoft-Windows-Kernel-PnP | 225: The application \Device\HarddiskVolume2\Program Files (x86)\Microsoft\Edge\Application\msedge.exe with process id 13644 stopped the removal or ejection for the device ACPI\PNP0A08\2&daba3ff&0. Process command line: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --no-pre-read-main-dll --skip-read-main-dll --metrics-shmem-handle=10144,i,12788395599204181742,6960392208927655569,524288 --field-trial-handle=2348,i,4383914887142717900,4649832010531238256,262144 --variations-seed-version --mojo-platform-channel-handle=9900 /prefetch:14 List of affected devices: STORAGE\Volume\{c67841dd-cd1b-11f0-8722-806e6f6e6963}#0000000001100000
|
| | System | Warning | 223 | 2025-11-29 04:43:57 | SYSTEM | Microsoft-Windows-Kernel-PnP | 225: The application \Device\HarddiskVolume2\Windows\System32\svchost.exe with process id 13720 stopped the removal or ejection for the device ACPI\PNP0A08\2&daba3ff&0. Process command line: C:\WINDOWS\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s wscsvc List of affected devices: STORAGE\Volume\{c67841dd-cd1b-11f0-8722-806e6f6e6963}#0000000001100000
|
| | System | Warning | 223 | 2025-11-29 04:43:57 | SYSTEM | Microsoft-Windows-Kernel-PnP | 225: The application \Device\HarddiskVolume2\Users\CogiArt\AppData\Local\Microsoft\OneDrive\25.087.0506.0001\FileCoAuth.exe with process id 14176 stopped the removal or ejection for the device ACPI\PNP0A08\2&daba3ff&0. Process command line: "C:\Users\CogiArt\AppData\Local\Microsoft\OneDrive\25.087.0506.0001\FileCoAuth.exe" -Embedding List of affected devices: STORAGE\Volume\{c67841dd-cd1b-11f0-8722-806e6f6e6963}#0000000001100000
|
| | System | Warning | None | 2025-11-29 04:43:58 | | e1i68x64 | 27: Intel(R) 82574L Gigabit Network Connection Network link is disconnected.
|
| | System | Warning | None | 2025-11-29 04:44:08 | | e1i68x64 | 27: Intel(R) 82574L Gigabit Network Connection #2 Network link is disconnected.
|
| | System | Error | 1 | 2025-11-29 04:46:48 | SYSTEM | Microsoft-Windows-WindowsUpdateClient | 20: Installation Failure: Windows failed to install the following update with error 0x80240016: 9NBLGGH4RV3K-Microsoft.VCLibs.140.00.UWPDesktop.
|
| | System | Error | 1 | 2025-11-29 04:46:53 | SYSTEM | Microsoft-Windows-WindowsUpdateClient | 20: Installation Failure: Windows failed to install the following update with error 0x80240016: 9NBLGGH4RV3K-Microsoft.VCLibs.140.00.UWPDesktop.
|
| | System | Error | 1 | 2025-11-29 04:46:56 | SYSTEM | Microsoft-Windows-WindowsUpdateClient | 20: Installation Failure: Windows failed to install the following update with error 0x80073d02: 9MSSGKG348SP-MicrosoftWindows.Client.WebExperience.
|
| | System | Error | 1 | 2025-11-29 04:46:56 | SYSTEM | Microsoft-Windows-WindowsUpdateClient | 20: Installation Failure: Windows failed to install the following update with error 0x80073d02: 9MSMLRH6LZF3-Microsoft.WindowsNotepad.
|
| | System | Warning | 223 | 2025-11-29 04:49:30 | SYSTEM | Microsoft-Windows-Kernel-PnP | 225: The application \Device\HarddiskVolume2\Windows\System32\audiodg.exe with process id 3520 stopped the removal or ejection for the device PCI\VEN_1002&DEV_AAF0&SUBSYS_AAF01DA2&REV_00\4&27422edb&0&0118. Process command line: C:\WINDOWS\system32\AUDIODG.EXE 0x00000000000005EC List of affected devices: 78
|
| | System | Warning | 223 | 2025-11-29 04:49:35 | SYSTEM | Microsoft-Windows-Kernel-PnP | 225: The application System with process id 4 stopped the removal or ejection for the device ACPI\PNP0A08\2&daba3ff&0. Process command line: List of affected devices: STORAGE\Volume\{c67841dd-cd1b-11f0-8722-806e6f6e6963}#0000000001100000 STORAGE\Volume\{c67841dd-cd1b-11f0-8722-806e6f6e6963}#0000001BC4900000 STORAGE\Volume\{c67841ed-cd1b-11f0-8722-806e6f6e6963}#0000000000005000
|
| | System | Warning | 223 | 2025-11-29 04:49:35 | SYSTEM | Microsoft-Windows-Kernel-PnP | 225: The application \Device\HarddiskVolume2\Windows\System32\smss.exe with process id 872 stopped the removal or ejection for the device ACPI\PNP0A08\2&daba3ff&0. Process command line: \SystemRoot\System32\smss.exe List of affected devices: STORAGE\Volume\{c67841dd-cd1b-11f0-8722-806e6f6e6963}#0000000001100000
|
| | System | Warning | 223 | 2025-11-29 04:49:35 | SYSTEM | Microsoft-Windows-Kernel-PnP | 225: The application \Device\HarddiskVolume2\Windows\System32\csrss.exe with process id 952 stopped the removal or ejection for the device ACPI\PNP0A08\2&daba3ff&0. Process command line: %SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16 List of affected devices: STORAGE\Volume\{c67841dd-cd1b-11f0-8722-806e6f6e6963}#0000000001100000
|
| | System | Warning | 223 | 2025-11-29 04:49:35 | SYSTEM | Microsoft-Windows-Kernel-PnP | 225: The application \Device\HarddiskVolume2\Windows\System32\wininit.exe with process id 1080 stopped the removal or ejection for the device ACPI\PNP0A08\2&daba3ff&0. Process command line: wininit.exe List of affected devices: STORAGE\Volume\{c67841dd-cd1b-11f0-8722-806e6f6e6963}#0000000001100000
|
| | System | Warning | 223 | 2025-11-29 04:49:35 | SYSTEM | Microsoft-Windows-Kernel-PnP | 225: The application \Device\HarddiskVolume2\Windows\System32\csrss.exe with process id 1088 stopped the removal or ejection for the device ACPI\PNP0A08\2&daba3ff&0. Process command line: %SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16 List of affected devices: STORAGE\Volume\{c67841dd-cd1b-11f0-8722-806e6f6e6963}#0000000001100000
|
| | System | Warning | 223 | 2025-11-29 04:49:35 | SYSTEM | Microsoft-Windows-Kernel-PnP | 225: The application \Device\HarddiskVolume2\Windows\System32\winlogon.exe with process id 1152 stopped the removal or ejection for the device ACPI\PNP0A08\2&daba3ff&0. Process command line: winlogon.exe List of affected devices: STORAGE\Volume\{c67841dd-cd1b-11f0-8722-806e6f6e6963}#0000000001100000
|
| | System | Warning | 223 | 2025-11-29 04:49:35 | SYSTEM | Microsoft-Windows-Kernel-PnP | 225: The application \Device\HarddiskVolume2\Windows\System32\services.exe with process id 1224 stopped the removal or ejection for the device ACPI\PNP0A08\2&daba3ff&0. Process command line: C:\WINDOWS\system32\services.exe List of affected devices: STORAGE\Volume\{c67841dd-cd1b-11f0-8722-806e6f6e6963}#0000000001100000
|
| | System | Warning | 223 | 2025-11-29 04:49:35 | SYSTEM | Microsoft-Windows-Kernel-PnP | 225: The application \Device\HarddiskVolume2\Windows\System32\lsass.exe with process id 1244 stopped the removal or ejection for the device ACPI\PNP0A08\2&daba3ff&0. Process command line: C:\WINDOWS\system32\lsass.exe List of affected devices: STORAGE\Volume\{c67841dd-cd1b-11f0-8722-806e6f6e6963}#0000000001100000
|
| | System | Warning | 223 | 2025-11-29 04:49:35 | SYSTEM | Microsoft-Windows-Kernel-PnP | 225: The application \Device\HarddiskVolume2\Windows\System32\svchost.exe with process id 1324 stopped the removal or ejection for the device ACPI\PNP0A08\2&daba3ff&0. Process command line: C:\WINDOWS\System32\svchost.exe -k netprofm -p -s netprofm List of affected devices: STORAGE\Volume\{c67841dd-cd1b-11f0-8722-806e6f6e6963}#0000000001100000
|
| | System | Warning | 223 | 2025-11-29 04:49:35 | SYSTEM | Microsoft-Windows-Kernel-PnP | 225: The application \Device\HarddiskVolume2\Windows\System32\svchost.exe with process id 1380 stopped the removal or ejection for the device ACPI\PNP0A08\2&daba3ff&0. Process command line: C:\WINDOWS\system32\svchost.exe -k DcomLaunch -p List of affected devices: SCSI\Disk&Ven_&Prod_KINGSTON_SV300S3\4&fefddb&0&020000 STORAGE\Volume\{c67841dd-cd1b-11f0-8722-806e6f6e6963}#0000000001100000
|
| | System | Warning | 223 | 2025-11-29 04:49:35 | SYSTEM | Microsoft-Windows-Kernel-PnP | 225: The application \Device\HarddiskVolume2\Windows\System32\fontdrvhost.exe with process id 1412 stopped the removal or ejection for the device ACPI\PNP0A08\2&daba3ff&0. Process command line: "fontdrvhost.exe" List of affected devices: STORAGE\Volume\{c67841dd-cd1b-11f0-8722-806e6f6e6963}#0000000001100000
|
| | System | Warning | 223 | 2025-11-29 04:49:35 | SYSTEM | Microsoft-Windows-Kernel-PnP | 225: The application \Device\HarddiskVolume2\Windows\System32\fontdrvhost.exe with process id 1420 stopped the removal or ejection for the device ACPI\PNP0A08\2&daba3ff&0. Process command line: "fontdrvhost.exe" List of affected devices: STORAGE\Volume\{c67841dd-cd1b-11f0-8722-806e6f6e6963}#0000000001100000
|
| | System | Warning | 223 | 2025-11-29 04:49:35 | SYSTEM | Microsoft-Windows-Kernel-PnP | 225: The application \Device\HarddiskVolume2\Windows\System32\svchost.exe with process id 1504 stopped the removal or ejection for the device ACPI\PNP0A08\2&daba3ff&0. Process command line: C:\WINDOWS\system32\svchost.exe -k RPCSS -p List of affected devices: STORAGE\Volume\{c67841dd-cd1b-11f0-8722-806e6f6e6963}#0000000001100000
|
| | System | Warning | 223 | 2025-11-29 04:49:35 | SYSTEM | Microsoft-Windows-Kernel-PnP | 225: The application \Device\HarddiskVolume2\Windows\System32\svchost.exe with process id 1552 stopped the removal or ejection for the device ACPI\PNP0A08\2&daba3ff&0. Process command line: C:\WINDOWS\system32\svchost.exe -k DcomLaunch -p -s LSM List of affected devices: STORAGE\Volume\{c67841dd-cd1b-11f0-8722-806e6f6e6963}#0000000001100000
|
| | System | Warning | 223 | 2025-11-29 04:49:35 | SYSTEM | Microsoft-Windows-Kernel-PnP | 225: The application \Device\HarddiskVolume2\Windows\ImmersiveControlPanel\SystemSettings.exe with process id 1708 stopped the removal or ejection for the device ACPI\PNP0A08\2&daba3ff&0. Process command line: "C:\Windows\ImmersiveControlPanel\SystemSettings.exe" -ServerName:microsoft.windows.immersivecontrolpanel List of affected devices: STORAGE\Volume\{c67841dd-cd1b-11f0-8722-806e6f6e6963}#0000000001100000
|
| | System | Warning | 223 | 2025-11-29 04:49:35 | SYSTEM | Microsoft-Windows-Kernel-PnP | 225: The application \Device\HarddiskVolume2\Windows\System32\svchost.exe with process id 1724 stopped the removal or ejection for the device ACPI\PNP0A08\2&daba3ff&0. Process command line: C:\WINDOWS\system32\svchost.exe -k DcomLaunch -p -s DeviceInstall List of affected devices: STORAGE\Volume\{c67841dd-cd1b-11f0-8722-806e6f6e6963}#0000000001100000
|
| | System | Warning | 223 | 2025-11-29 04:49:35 | SYSTEM | Microsoft-Windows-Kernel-PnP | 225: The application \Device\HarddiskVolume2\Windows\System32\svchost.exe with process id 1732 stopped the removal or ejection for the device ACPI\PNP0A08\2&daba3ff&0. Process command line: C:\WINDOWS\system32\svchost.exe -k NetworkService -p List of affected devices: SCSI\Disk&Ven_&Prod_KINGSTON_SV300S3\4&fefddb&0&020000 STORAGE\Volume\{c67841dd-cd1b-11f0-8722-806e6f6e6963}#0000000001100000
|
| | System | Warning | 223 | 2025-11-29 04:49:35 | SYSTEM | Microsoft-Windows-Kernel-PnP | 225: The application \Device\HarddiskVolume2\Windows\System32\svchost.exe with process id 1740 stopped the removal or ejection for the device ACPI\PNP0A08\2&daba3ff&0. Process command line: C:\WINDOWS\system32\svchost.exe -k netsvcs -p -s wlidsvc List of affected devices: STORAGE\Volume\{c67841dd-cd1b-11f0-8722-806e6f6e6963}#0000000001100000
|
| | System | Warning | 223 | 2025-11-29 04:49:35 | SYSTEM | Microsoft-Windows-Kernel-PnP | 225: The application \Device\HarddiskVolume2\Windows\System32\svchost.exe with process id 1756 stopped the removal or ejection for the device ACPI\PNP0A08\2&daba3ff&0. Process command line: C:\WINDOWS\System32\svchost.exe -k wsappx -p -s ClipSVC List of affected devices: STORAGE\Volume\{c67841dd-cd1b-11f0-8722-806e6f6e6963}#0000000001100000
|
| | System | Warning | 223 | 2025-11-29 04:49:35 | SYSTEM | Microsoft-Windows-Kernel-PnP | 225: The application \Device\HarddiskVolume2\Windows\System32\svchost.exe with process id 1796 stopped the removal or ejection for the device ACPI\PNP0A08\2&daba3ff&0. Process command line: C:\WINDOWS\system32\svchost.exe -k netsvcs -p -s wuauserv List of affected devices: SCSI\Disk&Ven_&Prod_KINGSTON_SV300S3\4&fefddb&0&020000 STORAGE\Volume\{c67841dd-cd1b-11f0-8722-806e6f6e6963}#0000000001100000
|
| | System | Warning | 223 | 2025-11-29 04:49:35 | SYSTEM | Microsoft-Windows-Kernel-PnP | 225: The application \Device\HarddiskVolume2\Windows\System32\svchost.exe with process id 1912 stopped the removal or ejection for the device ACPI\PNP0A08\2&daba3ff&0. Process command line: C:\WINDOWS\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService List of affected devices: STORAGE\Volume\{c67841dd-cd1b-11f0-8722-806e6f6e6963}#0000000001100000
|
| | System | Warning | 223 | 2025-11-29 04:49:35 | SYSTEM | Microsoft-Windows-Kernel-PnP | 225: The application \Device\HarddiskVolume2\Windows\System32\svchost.exe with process id 1968 stopped the removal or ejection for the device ACPI\PNP0A08\2&daba3ff&0. Process command line: C:\WINDOWS\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc List of affected devices: STORAGE\Volume\{c67841dd-cd1b-11f0-8722-806e6f6e6963}#0000000001100000
|
| | System | Warning | 223 | 2025-11-29 04:49:35 | SYSTEM | Microsoft-Windows-Kernel-PnP | 225: The application \Device\HarddiskVolume2\Windows\System32\svchost.exe with process id 2004 stopped the removal or ejection for the device ACPI\PNP0A08\2&daba3ff&0. Process command line: C:\WINDOWS\system32\svchost.exe -k LocalService -p -s nsi List of affected devices: STORAGE\Volume\{c67841dd-cd1b-11f0-8722-806e6f6e6963}#0000000001100000
|
| | System | Warning | 223 | 2025-11-29 04:49:35 | SYSTEM | Microsoft-Windows-Kernel-PnP | 225: The application \Device\HarddiskVolume2\Windows\System32\svchost.exe with process id 2020 stopped the removal or ejection for the device ACPI\PNP0A08\2&daba3ff&0. Process command line: C:\WINDOWS\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s hidserv List of affected devices: STORAGE\Volume\{c67841dd-cd1b-11f0-8722-806e6f6e6963}#0000000001100000
|
| | System | Warning | 223 | 2025-11-29 04:49:35 | SYSTEM | Microsoft-Windows-Kernel-PnP | 225: The application \Device\HarddiskVolume2\Windows\System32\svchost.exe with process id 2044 stopped the removal or ejection for the device ACPI\PNP0A08\2&daba3ff&0. Process command line: C:\WINDOWS\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s AppIDSvc List of affected devices: STORAGE\Volume\{c67841dd-cd1b-11f0-8722-806e6f6e6963}#0000000001100000
|
| | System | Warning | 223 | 2025-11-29 04:49:35 | SYSTEM | Microsoft-Windows-Kernel-PnP | 225: The application \Device\HarddiskVolume2\Program Files (x86)\Microsoft\EdgeWebView\Application\140.0.3485.66\msedgewebview2.exe with process id 2108 stopped the removal or ejection for the device ACPI\PNP0A08\2&daba3ff&0. Process command line: "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\140.0.3485.66\msedgewebview2.exe" --type=renderer --noerrdialogs --user-agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64; Cortana 1.18.9.23723; 10.0.0.0.26200.6584) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.26200 IsWebView2/True (WebView2Version 140.0.3485.66)" --user-data-dir="C:\Users\CogiArt\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\LocalState\EBWebView" --webview-exe-name=SearchHost.exe --webview-exe-version=2125.21002.10.0 --embedded-browser-webview=1 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1.25 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --js-flags="--expose-gc --ms-user-locale=" --time-ticks-at-unix-epoch=-1764419504945838 --launch-time-ticks=247352734 --always-read-main-dll --metrics-shmem-handle=2392,i,14176612957052240401,5255948198628843005,2097152 --field-trial-handle=1844,i,6697581408194740510,13859916280955955461,262144 --enable-features=ForceSWDCompWhenDCompFallbackRequired,msAggressiveCacheTrimming,msCustomDataPartition,msEdgeFluentOverlayScrollbar,msWebView2NoTabForScreenShare,msWebViewAppLifeCycleWorkaround --disable-features=BackForwardCache,BackgroundTabLoadingFromPerformanceManager,CloseOmniboxPopupOnInactiveAreaClick,CollectAVProductsInfo,CollectCodeIntegrityInfo,EnableHangWatcher,FilterAdsOnAbusiveSites,GetWifiProtocol,LoginDetection,MediaFoundationCameraUsageMonitoring,PreconnectToSearch,SafetyHub,SegmentationPlatform,SpareRendererForSitePerProcess,Ukm,WebPayments,msAITrackerClassification,msAbydosForWindowlessWV2,msAffirmVirtualCard,msAllowChromeWebstore,msAllowMSAPrtSSOForNonMSAProfile,msApplicationGuard,msAskBeforeClosingMultipleTabs,msAutoToggleAADPrtSSOForNonAADProfile,msAutofillEdgeCoupons,msAutofillEdgeCouponsAutoApply,msAutofillEdgeServiceRequest,msAutofillEnableEdgeSuggestions,msAutomaticTabFreeze,msBrowserSettingsSupported,msCoarseGeolocationService,msDataProtection,msDesktopMode,msDesktopRewards,msDisableVariationsSeedFetchThrottling,msEEProactiveHistory,msETFOffstoreExtensionFileDataCollection,msETFPasswordTheftDNRActionSignals,msEdgeAdPlatformUI,msEdgeAddWebCapturetoCollections,msEdgeAutofillShowDeployedPassword,msEdgeCaptureSelectionInPDF,msEdgeCloudConfigService,msEdgeCloudConfigServiceV2,msEdgeCohorts,msEdgeCollectionsPrismExperiment1,msEdgeCollectionsPrismOverallMigration,msEdgeComposeNext,msEdgeEnableNurturingFramework,msEdgeEnclavePrefsBasic,msEdgeEnclavePrefsNotification,msEdgeFaviconService,msEdgeHJTelemetry,msEdgeHubAppSkype,msEdgeImageEditorUI,msEdgeLinkDoctor,msEdgeMouseGestureDefaultEnabled,msEdgeMouseGestureSupported,msEdgeNewDeviceFre,msEdgeOnRampFRE,msEdgeOnRampImport,msEdgePDFCMHighlightUX,msEdgePasswordIris,msEdgePasswordIrisSaveBubble,msEdgeProngPersonalization,msEdgeReadingView,msEdgeRose,msEdgeScreenshotUI,msEdgeSendTabToSelf,msEdgeSettingsImport,msEdgeSettingsImportV2,msEdgeShoppingPersistentStorage,msEdgeShoppingUI,msEdgeSmartFind,msEdgeSuperDragDefaultEnabled,msEdgeSuperDragDropSupported,msEdgeTranslate,msEdgeUpdatesMoreMenuPill,msEdgeWebCapture,msEdgeWebCaptureUniformExperience,msEdgeWebContentFilteringFeedback,msEdgeWorkSearchBanner,msEnableCustomJobMemoryLimitsOnXbox,msEnableMIPForPDF,msEnablePdfUpsell,msEnableThirdPartyScanning,msEnableWebSignInCta,msEnableWebToBrowserSignIn,msEndpointDlp,msEntityExtraction,msExtensionTelemetryFramework,msExternalTaskManager,msFileSystemAccessDirectoryIterationBlocklistCheck,msForceBrowserSignIn,msForeignSessionsPage,msGeolocationAccessService,msGeolocationOSLocationPermissionFallback,msGeolocationSQMService,msGeolocationService,msGrowthInfraLaunchSourceLogging,msGuidedSwitchAllowed,msHubPinPersist,msImplicitSignin,msIrm,msIrmv2,msKlarnaVirtualCard,msLlmConsumerDlpPurview,msLoadStatistics,msLogIsEdgePinnedToTaskbarOnLaunch,msMIPCrossTenantPdfViewSupport,msMdatpWebSiteDlp,msNotificationPermissionForPWA,msNumberOfSitesToPin,msNurturingGlobalSitePinningOnCloseModal,msNurturingSitePinningCITopSites,msNurturingSitePinningWithWindowsConsent,msOnHoverSearchInSidebar,msOpenOfficeDocumentsInWebViewer,msPageInteractionRestrictionRevoke,msPasswordBreachDetection,msPdfAnnotationsVisibility,msPdfDataRecovery,msPdfDigitalSignatureRead,msPdfFreeText,msPdfFreeTextForCJK,msPdfHighlightMode,msPdfInking,msPdfKeyphraseSupport,msPdfOOUI,msPdfPopupMarkerRenderer,msPdfShare,msPdfSharedLibrary,msPdfTextNote,msPdfTextNoteMoreMenu,msPdfThumbnailCache,msPdfUnderside,msPdfViewRestore,msPersonalizationUMA,msPriceComparison,msPrintInWebView2,msPromptDefaultHandlerForPDF,msReactiveSearch,msReadAloud,msReadAloudPdf,msRedirectToShoreline,msRevokeExtensions,msSaasDlp,msShoppingTrigger,msShorelineSearch,msShorelineSearchFindOnPageWebUI,msShowOfflineGameEntrance,msShowReadAloudIconInAddressBar,msShowUXForAADPrtSSOForNonAADProfile,msSitePinningWithoutUi,msSmartScreenProtection,msSuspendMessageForNewSessionWhenHavingPendingNavigation,msSyncEdgeCollections,msTabResourceStats,msTokenizationAutofillInlineEnabled,msTouchMode,msTriggeringSignalGenerator,msUserUnderstanding,msVideoSuperResolutionUI,msWalletBuyNow,msWalletCheckout,msWalletDiagnosticDataLogger,msWalletHubEntry,msWalletHubIntlP3,msWalletPartialCard,msWalletPasswordCategorization,msWalletPasswordCategorizationPlatformExpansion,msWalletTokenizationCardMetadata,msWalletTokenizedAutofill,msWebAssist,msWebAssistHistorySearchService,msWebOOUI,msWindowsTaskManager,msWindowsUserActivities,msZipPayVirtualCard --variations-seed-version --mojo-platform-channel-handle=4832 /pfhostedapp:b239454542aeb4426687a343f2ad9726df39e1a8 /prefetch:1 List of affected devices: STORAGE\Volume\{c67841dd-cd1b-11f0-8722-806e6f6e6963}#0000000001100000
|
| | System | Warning | 223 | 2025-11-29 04:49:35 | SYSTEM | Microsoft-Windows-Kernel-PnP | 225: The application \Device\HarddiskVolume2\Windows\System32\dwm.exe with process id 2180 stopped the removal or ejection for the device ACPI\PNP0A08\2&daba3ff&0. Process command line: "dwm.exe" List of affected devices: STORAGE\Volume\{c67841dd-cd1b-11f0-8722-806e6f6e6963}#0000000001100000
|
| | System | Warning | 223 | 2025-11-29 04:49:35 | SYSTEM | Microsoft-Windows-Kernel-PnP | 225: The application \Device\HarddiskVolume2\Windows\System32\svchost.exe with process id 2248 stopped the removal or ejection for the device ACPI\PNP0A08\2&daba3ff&0. Process command line: C:\WINDOWS\system32\svchost.exe -k GPSvcGroup List of affected devices: STORAGE\Volume\{c67841dd-cd1b-11f0-8722-806e6f6e6963}#0000000001100000
|
| | System | Warning | 223 | 2025-11-29 04:49:35 | SYSTEM | Microsoft-Windows-Kernel-PnP | 225: The application \Device\HarddiskVolume2\Windows\System32\svchost.exe with process id 2268 stopped the removal or ejection for the device ACPI\PNP0A08\2&daba3ff&0. Process command line: C:\WINDOWS\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog List of affected devices: STORAGE\Volume\{c67841dd-cd1b-11f0-8722-806e6f6e6963}#0000000001100000
|
| | System | Warning | 223 | 2025-11-29 04:49:35 | SYSTEM | Microsoft-Windows-Kernel-PnP | 225: The application \Device\HarddiskVolume2\Windows\System32\msiexec.exe with process id 2328 stopped the removal or ejection for the device ACPI\PNP0A08\2&daba3ff&0. Process command line: C:\WINDOWS\system32\msiexec.exe /V List of affected devices: STORAGE\Volume\{c67841dd-cd1b-11f0-8722-806e6f6e6963}#0000000001100000
|
| | System | Warning | 223 | 2025-11-29 04:49:35 | SYSTEM | Microsoft-Windows-Kernel-PnP | 225: The application \Device\HarddiskVolume2\Windows\System32\svchost.exe with process id 2332 stopped the removal or ejection for the device ACPI\PNP0A08\2&daba3ff&0. Process command line: C:\WINDOWS\system32\svchost.exe -k NetworkService -p List of affected devices: STORAGE\Volume\{c67841dd-cd1b-11f0-8722-806e6f6e6963}#0000000001100000
|
| | System | Warning | 223 | 2025-11-29 04:49:35 | SYSTEM | Microsoft-Windows-Kernel-PnP | 225: The application \Device\HarddiskVolume2\Windows\System32\svchost.exe with process id 2360 stopped the removal or ejection for the device ACPI\PNP0A08\2&daba3ff&0. Process command line: C:\WINDOWS\system32\svchost.exe -k UserProfileService -p -s ProfSvc List of affected devices: STORAGE\Volume\{c67841dd-cd1b-11f0-8722-806e6f6e6963}#0000000001100000
|
| | System | Warning | 223 | 2025-11-29 04:49:35 | SYSTEM | Microsoft-Windows-Kernel-PnP | 225: The application \Device\HarddiskVolume2\Windows\System32\svchost.exe with process id 2368 stopped the removal or ejection for the device ACPI\PNP0A08\2&daba3ff&0. Process command line: C:\WINDOWS\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s SysMain List of affected devices: STORAGE\Volume\{c67841dd-cd1b-11f0-8722-806e6f6e6963}#0000000001100000
|
| | System | Warning | 223 | 2025-11-29 04:49:35 | SYSTEM | Microsoft-Windows-Kernel-PnP | 225: The application \Device\HarddiskVolume2\Windows\System32\svchost.exe with process id 2376 stopped the removal or ejection for the device ACPI\PNP0A08\2&daba3ff&0. Process command line: C:\WINDOWS\System32\svchost.exe -k netsvcs -p -s Themes List of affected devices: STORAGE\Volume\{c67841dd-cd1b-11f0-8722-806e6f6e6963}#0000000001100000
|
| | System | Warning | 223 | 2025-11-29 04:49:35 | SYSTEM | Microsoft-Windows-Kernel-PnP | 225: The application \Device\HarddiskVolume2\Windows\System32\svchost.exe with process id 2384 stopped the removal or ejection for the device ACPI\PNP0A08\2&daba3ff&0. Process command line: C:\WINDOWS\system32\svchost.exe -k LocalService -p -s EventSystem List of affected devices: STORAGE\Volume\{c67841dd-cd1b-11f0-8722-806e6f6e6963}#0000000001100000
|
| | System | Warning | 223 | 2025-11-29 04:49:35 | SYSTEM | Microsoft-Windows-Kernel-PnP | 225: The application \Device\HarddiskVolume2\Windows\System32\svchost.exe with process id 2524 stopped the removal or ejection for the device ACPI\PNP0A08\2&daba3ff&0. Process command line: C:\WINDOWS\system32\svchost.exe -k netsvcs -p -s Schedule List of affected devices: STORAGE\Volume\{c67841dd-cd1b-11f0-8722-806e6f6e6963}#0000000001100000
|
| | System | Warning | 223 | 2025-11-29 04:49:35 | SYSTEM | Microsoft-Windows-Kernel-PnP | 225: The application \Device\HarddiskVolume2\Windows\System32\svchost.exe with process id 2564 stopped the removal or ejection for the device ACPI\PNP0A08\2&daba3ff&0. Process command line: C:\WINDOWS\system32\svchost.exe -k netsvcsRedirectionGuard -p -s SENS List of affected devices: STORAGE\Volume\{c67841dd-cd1b-11f0-8722-806e6f6e6963}#0000000001100000
|
| | System | Warning | 223 | 2025-11-29 04:49:35 | SYSTEM | Microsoft-Windows-Kernel-PnP | 225: The application \Device\HarddiskVolume2\Windows\System32\svchost.exe with process id 2620 stopped the removal or ejection for the device ACPI\PNP0A08\2&daba3ff&0. Process command line: C:\WINDOWS\system32\svchost.exe -k netsvcs -p -s UserManager List of affected devices: STORAGE\Volume\{c67841dd-cd1b-11f0-8722-806e6f6e6963}#0000000001100000
|
| | System | Warning | 223 | 2025-11-29 04:49:35 | SYSTEM | Microsoft-Windows-Kernel-PnP | 225: The application \Device\HarddiskVolume2\Windows\System32\svchost.exe with process id 2696 stopped the removal or ejection for the device ACPI\PNP0A08\2&daba3ff&0. Process command line: C:\WINDOWS\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder List of affected devices: STORAGE\Volume\{c67841dd-cd1b-11f0-8722-806e6f6e6963}#0000000001100000
|
| | System | Warning | 223 | 2025-11-29 04:49:35 | SYSTEM | Microsoft-Windows-Kernel-PnP | 225: The application \Device\HarddiskVolume2\Windows\System32\svchost.exe with process id 2704 stopped the removal or ejection for the device ACPI\PNP0A08\2&daba3ff&0. Process command line: C:\WINDOWS\system32\svchost.exe -k LocalService -p -s FontCache List of affected devices: STORAGE\Volume\{c67841dd-cd1b-11f0-8722-806e6f6e6963}#0000000001100000
|
| | System | Warning | 223 | 2025-11-29 04:49:35 | SYSTEM | Microsoft-Windows-Kernel-PnP | 225: The application \Device\HarddiskVolume2\AMD\AMD-Software-Installer\Bin64\AMDSoftwareInstaller.exe with process id 2756 stopped the removal or ejection for the device ACPI\PNP0A08\2&daba3ff&0. Process command line: "C:\AMD\AMD-Software-Installer\BIN64\AMDSoftwareInstaller.exe" -CLEANAFTERINSTALL -LAUNCHEDFROMNSIS List of affected devices: STORAGE\Volume\{c67841dd-cd1b-11f0-8722-806e6f6e6963}#0000000001100000
|
| | System | Warning | 223 | 2025-11-29 04:49:35 | SYSTEM | Microsoft-Windows-Kernel-PnP | 225: The application \Device\HarddiskVolume2\Windows\System32\wbem\WmiPrvSE.exe with process id 2800 stopped the removal or ejection for the device ACPI\PNP0A08\2&daba3ff&0. Process command line: C:\WINDOWS\system32\wbem\wmiprvse.exe List of affected devices: -Embedding
|
| | System | Warning | 223 | 2025-11-29 04:49:35 | SYSTEM | Microsoft-Windows-Kernel-PnP | 225: The application \Device\HarddiskVolume2\Program Files (x86)\Microsoft\EdgeWebView\Application\140.0.3485.66\msedgewebview2.exe with process id 2932 stopped the removal or ejection for the device ACPI\PNP0A08\2&daba3ff&0. Process command line: "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\140.0.3485.66\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=SearchHost.exe --webview-exe-version=2125.21002.10.0 --user-data-dir="C:\Users\CogiArt\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\LocalState\EBWebView" --noerrdialogs --disable-features=msSmartScreenProtection --edge-webview-enable-mojo-ipcz --enable-features=msEdgeFluentOverlayScrollbar --user-agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64; Cortana 1.18.9.23723; 10.0.0.0.26200.6584) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.26200 IsWebView2/True (WebView2Version 140.0.3485.66)" --lang=en-US --mojo-named-platform-channel-pipe=6792.7200.3786573828812570330 /pfhostedapp:b239454542aeb4426687a343f2ad9726df39e1a8 List of affected devices: STORAGE\Volume\{c67841dd-cd1b-11f0-8722-806e6f6e6963}#0000000001100000
|
| | System | Warning | 223 | 2025-11-29 04:49:35 | SYSTEM | Microsoft-Windows-Kernel-PnP | 225: The application \Device\HarddiskVolume2\Windows\System32\svchost.exe with process id 2964 stopped the removal or ejection for the device ACPI\PNP0A08\2&daba3ff&0. Process command line: C:\WINDOWS\System32\svchost.exe -k LocalServiceNetworkRestricted -p List of affected devices: HDAUDIO\FUNC_01&VEN_1002&DEV_AA01&SUBSYS_00AA0100&REV_1007\5&2a2a2a73&0&0001 STORAGE\Volume\{c67841dd-cd1b-11f0-8722-806e6f6e6963}#0000000001100000
|
| | System | Warning | 223 | 2025-11-29 04:49:35 | SYSTEM | Microsoft-Windows-Kernel-PnP | 225: The application \Device\HarddiskVolume2\Windows\System32\svchost.exe with process id 3020 stopped the removal or ejection for the device ACPI\PNP0A08\2&daba3ff&0. Process command line: C:\WINDOWS\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TextInputManagementService List of affected devices: STORAGE\Volume\{c67841dd-cd1b-11f0-8722-806e6f6e6963}#0000000001100000
|
| | System | Warning | 223 | 2025-11-29 04:49:35 | SYSTEM | Microsoft-Windows-Kernel-PnP | 225: The application \Device\HarddiskVolume2\Windows\System32\svchost.exe with process id 3068 stopped the removal or ejection for the device ACPI\PNP0A08\2&daba3ff&0. Process command line: C:\WINDOWS\system32\svchost.exe -k LocalServiceNoNetwork -p List of affected devices: STORAGE\Volume\{c67841dd-cd1b-11f0-8722-806e6f6e6963}#0000000001100000
|
| | System | Warning | 223 | 2025-11-29 04:49:35 | SYSTEM | Microsoft-Windows-Kernel-PnP | 225: The application \Device\HarddiskVolume2\Windows\System32\svchost.exe with process id 3096 stopped the removal or ejection for the device ACPI\PNP0A08\2&daba3ff&0. Process command line: C:\WINDOWS\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s DusmSvc List of affected devices: STORAGE\Volume\{c67841dd-cd1b-11f0-8722-806e6f6e6963}#0000000001100000
|
| | System | Warning | 223 | 2025-11-29 04:49:35 | SYSTEM | Microsoft-Windows-Kernel-PnP | 225: The application \Device\HarddiskVolume2\Windows\System32\svchost.exe with process id 3104 stopped the removal or ejection for the device ACPI\PNP0A08\2&daba3ff&0. Process command line: C:\WINDOWS\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp List of affected devices: STORAGE\Volume\{c67841dd-cd1b-11f0-8722-806e6f6e6963}#0000000001100000
|
| | System | Warning | 223 | 2025-11-29 04:49:35 | SYSTEM | Microsoft-Windows-Kernel-PnP | 225: The application \Device\HarddiskVolume2\Windows\System32\svchost.exe with process id 3156 stopped the removal or ejection for the device ACPI\PNP0A08\2&daba3ff&0. Process command line: C:\WINDOWS\System32\svchost.exe -k netsvcs -p List of affected devices: STORAGE\Volume\{c67841dd-cd1b-11f0-8722-806e6f6e6963}#0000000001100000
|
| | System | Warning | 223 | 2025-11-29 04:49:35 | SYSTEM | Microsoft-Windows-Kernel-PnP | 225: The application \Device\HarddiskVolume2\Windows\System32\svchost.exe with process id 3208 stopped the removal or ejection for the device ACPI\PNP0A08\2&daba3ff&0. Process command line: C:\WINDOWS\system32\svchost.exe -k netsvcs -p -s Winmgmt List of affected devices: STORAGE\Volume\{c67841dd-cd1b-11f0-8722-806e6f6e6963}#0000000001100000
|
| | System | Warning | 223 | 2025-11-29 04:49:35 | SYSTEM | Microsoft-Windows-Kernel-PnP | 225: The application \Device\HarddiskVolume2\Windows\System32\svchost.exe with process id 3240 stopped the removal or ejection for the device ACPI\PNP0A08\2&daba3ff&0. Process command line: C:\WINDOWS\system32\svchost.exe -k LocalServiceNoNetworkFirewall -p List of affected devices: STORAGE\Volume\{c67841dd-cd1b-11f0-8722-806e6f6e6963}#0000000001100000
|
| | System | Warning | 223 | 2025-11-29 04:49:35 | SYSTEM | Microsoft-Windows-Kernel-PnP | 225: The application \Device\HarddiskVolume2\Program Files\Windows Defender\MsMpEng.exe with process id 3292 stopped the removal or ejection for the device ACPI\PNP0A08\2&daba3ff&0. Process command line: "C:\Program Files\Windows Defender\MsMpEng.exe" List of affected devices: STORAGE\Volume\{c67841dd-cd1b-11f0-8722-806e6f6e6963}#0000000001100000
|
| | System | Warning | 223 | 2025-11-29 04:49:35 | SYSTEM | Microsoft-Windows-Kernel-PnP | 225: The application \Device\HarddiskVolume2\Windows\System32\svchost.exe with process id 3296 stopped the removal or ejection for the device ACPI\PNP0A08\2&daba3ff&0. Process command line: C:\WINDOWS\system32\svchost.exe -k appmodel -p -s StateRepository List of affected devices: STORAGE\Volume\{c67841dd-cd1b-11f0-8722-806e6f6e6963}#0000000001100000
|
| | System | Warning | 223 | 2025-11-29 04:49:35 | SYSTEM | Microsoft-Windows-Kernel-PnP | 225: The application \Device\HarddiskVolume2\Windows\System32\svchost.exe with process id 3380 stopped the removal or ejection for the device ACPI\PNP0A08\2&daba3ff&0. Process command line: C:\WINDOWS\system32\svchost.exe -k LocalServiceHttp -p List of affected devices: STORAGE\Volume\{c67841dd-cd1b-11f0-8722-806e6f6e6963}#0000000001100000
|
| | System | Warning | 223 | 2025-11-29 04:49:35 | SYSTEM | Microsoft-Windows-Kernel-PnP | 225: The application \Device\HarddiskVolume2\Windows\System32\svchost.exe with process id 3464 stopped the removal or ejection for the device ACPI\PNP0A08\2&daba3ff&0. Process command line: C:\WINDOWS\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Wcmsvc List of affected devices: STORAGE\Volume\{c67841dd-cd1b-11f0-8722-806e6f6e6963}#0000000001100000
|
| | System | Warning | 223 | 2025-11-29 04:49:35 | SYSTEM | Microsoft-Windows-Kernel-PnP | 225: The application \Device\HarddiskVolume2\Windows\System32\svchost.exe with process id 3508 stopped the removal or ejection for the device ACPI\PNP0A08\2&daba3ff&0. Process command line: C:\WINDOWS\System32\svchost.exe -k netsvcs -p -s ShellHWDetection List of affected devices: STORAGE\Volume\{c67841dd-cd1b-11f0-8722-806e6f6e6963}#0000000001100000
|
| | System | Warning | 223 | 2025-11-29 04:49:35 | SYSTEM | Microsoft-Windows-Kernel-PnP | 225: The application \Device\HarddiskVolume2\Windows\System32\audiodg.exe with process id 3520 stopped the removal or ejection for the device ACPI\PNP0A08\2&daba3ff&0. Process command line: C:\WINDOWS\system32\AUDIODG.EXE 0x00000000000005EC List of affected devices: 150
|
| | System | Warning | 223 | 2025-11-29 04:49:35 | SYSTEM | Microsoft-Windows-Kernel-PnP | 225: The application \Device\HarddiskVolume2\Windows\System32\spoolsv.exe with process id 3740 stopped the removal or ejection for the device ACPI\PNP0A08\2&daba3ff&0. Process command line: C:\WINDOWS\System32\spoolsv.exe List of affected devices: STORAGE\Volume\{c67841dd-cd1b-11f0-8722-806e6f6e6963}#0000000001100000
|
| | System | Warning | 223 | 2025-11-29 04:49:35 | SYSTEM | Microsoft-Windows-Kernel-PnP | 225: The application \Device\HarddiskVolume2\Windows\System32\svchost.exe with process id 3860 stopped the removal or ejection for the device ACPI\PNP0A08\2&daba3ff&0. Process command line: C:\WINDOWS\system32\svchost.exe -k WebThreatDefense -p -s webthreatdefsvc List of affected devices: STORAGE\Volume\{c67841dd-cd1b-11f0-8722-806e6f6e6963}#0000000001100000
|
| | System | Warning | 223 | 2025-11-29 04:49:35 | SYSTEM | Microsoft-Windows-Kernel-PnP | 225: The application \Device\HarddiskVolume2\Windows\System32\svchost.exe with process id 3888 stopped the removal or ejection for the device ACPI\PNP0A08\2&daba3ff&0. Process command line: C:\WINDOWS\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation List of affected devices: STORAGE\Volume\{c67841dd-cd1b-11f0-8722-806e6f6e6963}#0000000001100000
|
| | System | Warning | 223 | 2025-11-29 04:49:35 | SYSTEM | Microsoft-Windows-Kernel-PnP | 225: The application \Device\HarddiskVolume2\Windows\System32\svchost.exe with process id 3932 stopped the removal or ejection for the device ACPI\PNP0A08\2&daba3ff&0. Process command line: C:\WINDOWS\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc List of affected devices: STORAGE\Volume\{c67841dd-cd1b-11f0-8722-806e6f6e6963}#0000000001100000
|
| | System | Warning | 223 | 2025-11-29 04:49:35 | SYSTEM | Microsoft-Windows-Kernel-PnP | 225: The application \Device\HarddiskVolume2\Windows\System32\svchost.exe with process id 4008 stopped the removal or ejection for the device ACPI\PNP0A08\2&daba3ff&0. Process command line: C:\WINDOWS\System32\svchost.exe -k utcsvc -p List of affected devices: SCSI\Disk&Ven_&Prod_KINGSTON_SV300S3\4&fefddb&0&020000 STORAGE\Volume\{c67841dd-cd1b-11f0-8722-806e6f6e6963}#0000000001100000
|
| | System | Warning | 223 | 2025-11-29 04:49:35 | SYSTEM | Microsoft-Windows-Kernel-PnP | 225: The application \Device\HarddiskVolume2\Windows\System32\svchost.exe with process id 4020 stopped the removal or ejection for the device ACPI\PNP0A08\2&daba3ff&0. Process command line: C:\WINDOWS\System32\svchost.exe -k NetSvcs -p -s iphlpsvc List of affected devices: STORAGE\Volume\{c67841dd-cd1b-11f0-8722-806e6f6e6963}#0000000001100000
|
| | System | Warning | 223 | 2025-11-29 04:49:35 | SYSTEM | Microsoft-Windows-Kernel-PnP | 225: The application \Device\HarddiskVolume2\Windows\System32\svchost.exe with process id 4028 stopped the removal or ejection for the device ACPI\PNP0A08\2&daba3ff&0. Process command line: C:\WINDOWS\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks List of affected devices: STORAGE\Volume\{c67841dd-cd1b-11f0-8722-806e6f6e6963}#0000000001100000
|
| | System | Warning | 223 | 2025-11-29 04:49:35 | SYSTEM | Microsoft-Windows-Kernel-PnP | 225: The application \Device\HarddiskVolume2\Windows\System32\svchost.exe with process id 4044 stopped the removal or ejection for the device ACPI\PNP0A08\2&daba3ff&0. Process command line: C:\WINDOWS\system32\svchost.exe -k WSAIFabricSvcGroup -p -s WSAIFabricSvc List of affected devices: STORAGE\Volume\{c67841dd-cd1b-11f0-8722-806e6f6e6963}#0000000001100000
|
| | System | Warning | 223 | 2025-11-29 04:49:35 | SYSTEM | Microsoft-Windows-Kernel-PnP | 225: The application \Device\HarddiskVolume2\Windows\System32\svchost.exe with process id 4052 stopped the removal or ejection for the device ACPI\PNP0A08\2&daba3ff&0. Process command line: C:\WINDOWS\system32\svchost.exe -k netsvcs -p -s WpnService List of affected devices: STORAGE\Volume\{c67841dd-cd1b-11f0-8722-806e6f6e6963}#0000000001100000
|
| | System | Warning | 223 | 2025-11-29 04:49:35 | SYSTEM | Microsoft-Windows-Kernel-PnP | 225: The application \Device\HarddiskVolume2\Windows\System32\svchost.exe with process id 4060 stopped the removal or ejection for the device ACPI\PNP0A08\2&daba3ff&0. Process command line: C:\WINDOWS\System32\svchost.exe -k LocalServiceNoNetwork -p -s DPS List of affected devices: STORAGE\Volume\{c67841dd-cd1b-11f0-8722-806e6f6e6963}#0000000001100000
|
| | System | Warning | 223 | 2025-11-29 04:49:35 | SYSTEM | Microsoft-Windows-Kernel-PnP | 225: The application \Device\HarddiskVolume2\Windows\System32\taskhostw.exe with process id 4088 stopped the removal or ejection for the device ACPI\PNP0A08\2&daba3ff&0. Process command line: taskhostw.exe $(Arg0) List of affected devices: STORAGE\Volume\{c67841dd-cd1b-11f0-8722-806e6f6e6963}#0000000001100000
|
| | System | Warning | 223 | 2025-11-29 04:49:35 | SYSTEM | Microsoft-Windows-Kernel-PnP | 225: The application \Device\HarddiskVolume2\Windows\System32\svchost.exe with process id 4308 stopped the removal or ejection for the device ACPI\PNP0A08\2&daba3ff&0. Process command line: C:\WINDOWS\system32\svchost.exe -k netsvcs -p -s LanmanServer List of affected devices: STORAGE\Volume\{c67841dd-cd1b-11f0-8722-806e6f6e6963}#0000000001100000
|
| | System | Warning | 223 | 2025-11-29 04:49:35 | SYSTEM | Microsoft-Windows-Kernel-PnP | 225: The application \Device\HarddiskVolume2\Windows\System32\wbem\WmiPrvSE.exe with process id 4612 stopped the removal or ejection for the device ACPI\PNP0A08\2&daba3ff&0. Process command line: C:\WINDOWS\system32\wbem\wmiprvse.exe List of affected devices: 72
|
| | System | Warning | 223 | 2025-11-29 04:49:35 | SYSTEM | Microsoft-Windows-Kernel-PnP | 225: The application \Device\HarddiskVolume2\Windows\System32\svchost.exe with process id 4724 stopped the removal or ejection for the device ACPI\PNP0A08\2&daba3ff&0. Process command line: C:\WINDOWS\system32\svchost.exe -k netsvcs -p -s wisvc List of affected devices: STORAGE\Volume\{c67841dd-cd1b-11f0-8722-806e6f6e6963}#0000000001100000
|
| | System | Warning | 223 | 2025-11-29 04:49:35 | SYSTEM | Microsoft-Windows-Kernel-PnP | 225: The application \Device\HarddiskVolume2\Windows\System32\sihost.exe with process id 4788 stopped the removal or ejection for the device ACPI\PNP0A08\2&daba3ff&0. Process command line: sihost.exe List of affected devices: STORAGE\Volume\{c67841dd-cd1b-11f0-8722-806e6f6e6963}#0000000001100000
|
| | System | Warning | 223 | 2025-11-29 04:49:35 | SYSTEM | Microsoft-Windows-Kernel-PnP | 225: The application \Device\HarddiskVolume2\Windows\System32\svchost.exe with process id 4824 stopped the removal or ejection for the device ACPI\PNP0A08\2&daba3ff&0. Process command line: C:\WINDOWS\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc List of affected devices: STORAGE\Volume\{c67841dd-cd1b-11f0-8722-806e6f6e6963}#0000000001100000
|
| | System | Warning | 223 | 2025-11-29 04:49:35 | SYSTEM | Microsoft-Windows-Kernel-PnP | 225: The application \Device\HarddiskVolume2\Windows\System32\svchost.exe with process id 4852 stopped the removal or ejection for the device ACPI\PNP0A08\2&daba3ff&0. Process command line: C:\WINDOWS\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s webthreatdefusersvc List of affected devices: STORAGE\Volume\{c67841dd-cd1b-11f0-8722-806e6f6e6963}#0000000001100000
|
| | System | Warning | 223 | 2025-11-29 04:49:35 | SYSTEM | Microsoft-Windows-Kernel-PnP | 225: The application \Device\HarddiskVolume2\Windows\System32\svchost.exe with process id 4880 stopped the removal or ejection for the device ACPI\PNP0A08\2&daba3ff&0. Process command line: C:\WINDOWS\system32\svchost.exe -k UnistackSvcGroup -s WpnUserService List of affected devices: STORAGE\Volume\{c67841dd-cd1b-11f0-8722-806e6f6e6963}#0000000001100000
|
| | System | Warning | 223 | 2025-11-29 04:49:35 | SYSTEM | Microsoft-Windows-Kernel-PnP | 225: The application \Device\HarddiskVolume2\Windows\System32\svchost.exe with process id 4916 stopped the removal or ejection for the device ACPI\PNP0A08\2&daba3ff&0. Process command line: C:\WINDOWS\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DisplayEnhancementService List of affected devices: STORAGE\Volume\{c67841dd-cd1b-11f0-8722-806e6f6e6963}#0000000001100000
|
| | System | Warning | 223 | 2025-11-29 04:49:35 | SYSTEM | Microsoft-Windows-Kernel-PnP | 225: The application \Device\HarddiskVolume2\Windows\System32\ApplicationFrameHost.exe with process id 4940 stopped the removal or ejection for the device ACPI\PNP0A08\2&daba3ff&0. Process command line: C:\WINDOWS\system32\ApplicationFrameHost.exe -Embedding List of affected devices: STORAGE\Volume\{c67841dd-cd1b-11f0-8722-806e6f6e6963}#0000000001100000
|
| | System | Warning | 223 | 2025-11-29 04:49:35 | SYSTEM | Microsoft-Windows-Kernel-PnP | 225: The application \Device\HarddiskVolume2\Windows\System32\taskhostw.exe with process id 4972 stopped the removal or ejection for the device ACPI\PNP0A08\2&daba3ff&0. Process command line: taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E} List of affected devices: SCSI\Disk&Ven_&Prod_KINGSTON_SV300S3\4&fefddb&0&020000 STORAGE\Volume\{c67841dd-cd1b-11f0-8722-806e6f6e6963}#0000000001100000
|
| | System | Warning | 223 | 2025-11-29 04:49:35 | SYSTEM | Microsoft-Windows-Kernel-PnP | 225: The application \Device\HarddiskVolume2\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe with process id 4996 stopped the removal or ejection for the device ACPI\PNP0A08\2&daba3ff&0. Process command line: "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /c List of affected devices: STORAGE\Volume\{c67841dd-cd1b-11f0-8722-806e6f6e6963}#0000000001100000
|
| | System | Warning | 223 | 2025-11-29 04:49:35 | SYSTEM | Microsoft-Windows-Kernel-PnP | 225: The application \Device\HarddiskVolume2\Windows\System32\svchost.exe with process id 5060 stopped the removal or ejection for the device ACPI\PNP0A08\2&daba3ff&0. Process command line: C:\WINDOWS\system32\svchost.exe -k netsvcs -p -s TokenBroker List of affected devices: STORAGE\Volume\{c67841dd-cd1b-11f0-8722-806e6f6e6963}#0000000001100000
|
| | System | Warning | 223 | 2025-11-29 04:49:35 | SYSTEM | Microsoft-Windows-Kernel-PnP | 225: The application \Device\HarddiskVolume2\Windows\System32\svchost.exe with process id 5164 stopped the removal or ejection for the device ACPI\PNP0A08\2&daba3ff&0. Process command line: C:\WINDOWS\system32\svchost.exe -k LocalService -p -s CDPSvc List of affected devices: STORAGE\Volume\{c67841dd-cd1b-11f0-8722-806e6f6e6963}#0000000001100000
|
| | System | Warning | 223 | 2025-11-29 04:49:35 | SYSTEM | Microsoft-Windows-Kernel-PnP | 225: The application \Device\HarddiskVolume2\Windows\System32\DriverStore\FileRepository\u0417877.inf_amd64_8b2c2b61b3f8a9e5\B417004\atiesrxx.exe with process id 5236 stopped the removal or ejection for the device ACPI\PNP0A08\2&daba3ff&0. Process command line: C:\WINDOWS\System32\DriverStore\FileRepository\u0417877.inf_amd64_8b2c2b61b3f8a9e5\B417004\atiesrxx.exe List of affected devices: STORAGE\Volume\{c67841dd-cd1b-11f0-8722-806e6f6e6963}#0000000001100000
|
| | System | Warning | 223 | 2025-11-29 04:49:35 | SYSTEM | Microsoft-Windows-Kernel-PnP | 225: The application \Device\HarddiskVolume2\Program Files (x86)\Microsoft\Edge\Application\msedge.exe with process id 5352 stopped the removal or ejection for the device ACPI\PNP0A08\2&daba3ff&0. Process command line: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --no-pre-read-main-dll --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1.25 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=44 --time-ticks-at-unix-epoch=-1764419504945837 --launch-time-ticks=168913958 --ssd-no-pressure-read-main-dll --metrics-shmem-handle=4460,i,14233452545960282836,2928249594437128450,2097152 --field-trial-handle=2348,i,4383914887142717900,4649832010531238256,262144 --variations-seed-version --mojo-platform-channel-handle=2620 /prefetch:1 List of affected devices: STORAGE\Volume\{c67841dd-cd1b-11f0-8722-806e6f6e6963}#0000000001100000
|
| | System | Warning | 223 | 2025-11-29 04:49:35 | SYSTEM | Microsoft-Windows-Kernel-PnP | 225: The application \Device\HarddiskVolume2\Windows\System32\svchost.exe with process id 5404 stopped the removal or ejection for the device ACPI\PNP0A08\2&daba3ff&0. Process command line: C:\WINDOWS\system32\svchost.exe -k osprivacy -p -s camsvc List of affected devices: STORAGE\Volume\{c67841dd-cd1b-11f0-8722-806e6f6e6963}#0000000001100000
|
| | System | Warning | 223 | 2025-11-29 04:49:35 | SYSTEM | Microsoft-Windows-Kernel-PnP | 225: The application \Device\HarddiskVolume2\Windows\System32\svchost.exe with process id 5412 stopped the removal or ejection for the device ACPI\PNP0A08\2&daba3ff&0. Process command line: C:\WINDOWS\system32\svchost.exe -k wsappx -p -s AppXSvc List of affected devices: STORAGE\Volume\{c67841dd-cd1b-11f0-8722-806e6f6e6963}#0000000001100000
|
| | System | Warning | 223 | 2025-11-29 04:49:35 | SYSTEM | Microsoft-Windows-Kernel-PnP | 225: The application \Device\HarddiskVolume2\Windows\Temp\atieclxx_tmp.exe with process id 5464 stopped the removal or ejection for the device ACPI\PNP0A08\2&daba3ff&0. Process command line: Rescan 327680 List of affected devices: STORAGE\Volume\{c67841dd-cd1b-11f0-8722-806e6f6e6963}#0000000001100000
|
| | System | Warning | 223 | 2025-11-29 04:49:35 | SYSTEM | Microsoft-Windows-Kernel-PnP | 225: The application \Device\HarddiskVolume2\Windows\System32\AggregatorHost.exe with process id 5688 stopped the removal or ejection for the device ACPI\PNP0A08\2&daba3ff&0. Process command line: AggregatorHost.exe List of affected devices: STORAGE\Volume\{c67841dd-cd1b-11f0-8722-806e6f6e6963}#0000000001100000
|
| | System | Warning | 223 | 2025-11-29 04:49:35 | SYSTEM | Microsoft-Windows-Kernel-PnP | 225: The application \Device\HarddiskVolume2\Windows\explorer.exe with process id 5740 stopped the removal or ejection for the device ACPI\PNP0A08\2&daba3ff&0. Process command line: C:\WINDOWS\Explorer.EXE List of affected devices: STORAGE\Volume\{c67841dd-cd1b-11f0-8722-806e6f6e6963}#0000000001100000
|
| | System | Warning | 223 | 2025-11-29 04:49:35 | SYSTEM | Microsoft-Windows-Kernel-PnP | 225: The application \Device\HarddiskVolume2\Windows\servicing\TrustedInstaller.exe with process id 5792 stopped the removal or ejection for the device ACPI\PNP0A08\2&daba3ff&0. Process command line: C:\WINDOWS\servicing\TrustedInstaller.exe List of affected devices: STORAGE\Volume\{c67841dd-cd1b-11f0-8722-806e6f6e6963}#0000000001100000
|
| | System | Warning | 223 | 2025-11-29 04:49:35 | SYSTEM | Microsoft-Windows-Kernel-PnP | 225: The application \Device\HarddiskVolume2\Windows\System32\ShellHost.exe with process id 5796 stopped the removal or ejection for the device ACPI\PNP0A08\2&daba3ff&0. Process command line: "C:\Windows\System32\ShellHost.exe" List of affected devices: STORAGE\Volume\{c67841dd-cd1b-11f0-8722-806e6f6e6963}#0000000001100000
|
| | System | Warning | 223 | 2025-11-29 04:49:35 | SYSTEM | Microsoft-Windows-Kernel-PnP | 225: The application \Device\HarddiskVolume2\Windows\System32\svchost.exe with process id 5908 stopped the removal or ejection for the device ACPI\PNP0A08\2&daba3ff&0. Process command line: C:\WINDOWS\system32\svchost.exe -k netsvcs -p -s Appinfo List of affected devices: STORAGE\Volume\{c67841dd-cd1b-11f0-8722-806e6f6e6963}#0000000001100000
|
| | System | Warning | 223 | 2025-11-29 04:49:35 | SYSTEM | Microsoft-Windows-Kernel-PnP | 225: The application \Device\HarddiskVolume2\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\CrossDeviceResume.exe with process id 6036 stopped the removal or ejection for the device ACPI\PNP0A08\2&daba3ff&0. Process command line: "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\CrossDeviceResume.exe" /tileid MicrosoftWindows.Client.CBS_cw5n1h2txyewy!CrossDeviceResumeApp List of affected devices: STORAGE\Volume\{c67841dd-cd1b-11f0-8722-806e6f6e6963}#0000000001100000
|
| | System | Warning | 223 | 2025-11-29 04:49:35 | SYSTEM | Microsoft-Windows-Kernel-PnP | 225: The application \Device\HarddiskVolume2\Windows\System32\svchost.exe with process id 6128 stopped the removal or ejection for the device ACPI\PNP0A08\2&daba3ff&0. Process command line: C:\WINDOWS\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc List of affected devices: STORAGE\Volume\{c67841dd-cd1b-11f0-8722-806e6f6e6963}#0000000001100000
|
| | System | Warning | 223 | 2025-11-29 04:49:35 | SYSTEM | Microsoft-Windows-Kernel-PnP | 225: The application \Device\HarddiskVolume2\Windows\System32\svchost.exe with process id 6232 stopped the removal or ejection for the device ACPI\PNP0A08\2&daba3ff&0. Process command line: C:\WINDOWS\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s WdiSystemHost List of affected devices: STORAGE\Volume\{c67841dd-cd1b-11f0-8722-806e6f6e6963}#0000000001100000
|
| | System | Warning | 223 | 2025-11-29 04:49:35 | SYSTEM | Microsoft-Windows-Kernel-PnP | 225: The application \Device\HarddiskVolume2\Windows\System32\svchost.exe with process id 6260 stopped the removal or ejection for the device ACPI\PNP0A08\2&daba3ff&0. Process command line: C:\WINDOWS\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s PcaSvc List of affected devices: STORAGE\Volume\{c67841dd-cd1b-11f0-8722-806e6f6e6963}#0000000001100000
|
| | System | Warning | 223 | 2025-11-29 04:49:35 | SYSTEM | Microsoft-Windows-Kernel-PnP | 225: The application \Device\HarddiskVolume2\Windows\System32\svchost.exe with process id 6364 stopped the removal or ejection for the device ACPI\PNP0A08\2&daba3ff&0. Process command line: C:\WINDOWS\System32\svchost.exe -k LocalService -p -s LicenseManager List of affected devices: STORAGE\Volume\{c67841dd-cd1b-11f0-8722-806e6f6e6963}#0000000001100000
|
| | System | Warning | 223 | 2025-11-29 04:49:35 | SYSTEM | Microsoft-Windows-Kernel-PnP | 225: The application \Device\HarddiskVolume2\Windows\System32\svchost.exe with process id 6440 stopped the removal or ejection for the device ACPI\PNP0A08\2&daba3ff&0. Process command line: C:\WINDOWS\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc List of affected devices: STORAGE\Volume\{c67841dd-cd1b-11f0-8722-806e6f6e6963}#0000000001100000
|
| | System | Warning | 223 | 2025-11-29 04:49:35 | SYSTEM | Microsoft-Windows-Kernel-PnP | 225: The application \Device\HarddiskVolume2\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe with process id 6792 stopped the removal or ejection for the device ACPI\PNP0A08\2&daba3ff&0. Process command line: "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca List of affected devices: STORAGE\Volume\{c67841dd-cd1b-11f0-8722-806e6f6e6963}#0000000001100000
|
| | System | Warning | 223 | 2025-11-29 04:49:35 | SYSTEM | Microsoft-Windows-Kernel-PnP | 225: The application \Device\HarddiskVolume2\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe with process id 6816 stopped the removal or ejection for the device ACPI\PNP0A08\2&daba3ff&0. Process command line: "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca List of affected devices: STORAGE\Volume\{c67841dd-cd1b-11f0-8722-806e6f6e6963}#0000000001100000
|
| | System | Warning | 223 | 2025-11-29 04:49:35 | SYSTEM | Microsoft-Windows-Kernel-PnP | 225: The application \Device\HarddiskVolume2\Windows\System32\RuntimeBroker.exe with process id 7004 stopped the removal or ejection for the device ACPI\PNP0A08\2&daba3ff&0. Process command line: C:\Windows\System32\RuntimeBroker.exe -Embedding List of affected devices: STORAGE\Volume\{c67841dd-cd1b-11f0-8722-806e6f6e6963}#0000000001100000
|
| | System | Warning | 223 | 2025-11-29 04:49:35 | SYSTEM | Microsoft-Windows-Kernel-PnP | 225: The application \Device\HarddiskVolume2\Windows\System32\svchost.exe with process id 7096 stopped the removal or ejection for the device ACPI\PNP0A08\2&daba3ff&0. Process command line: C:\WINDOWS\system32\svchost.exe -k UdkSvcGroup -s UdkUserSvc List of affected devices: STORAGE\Volume\{c67841dd-cd1b-11f0-8722-806e6f6e6963}#0000000001100000
|
| | System | Warning | 223 | 2025-11-29 04:49:35 | SYSTEM | Microsoft-Windows-Kernel-PnP | 225: The application \Device\HarddiskVolume2\Windows\System32\RuntimeBroker.exe with process id 7116 stopped the removal or ejection for the device ACPI\PNP0A08\2&daba3ff&0. Process command line: C:\Windows\System32\RuntimeBroker.exe -Embedding List of affected devices: STORAGE\Volume\{c67841dd-cd1b-11f0-8722-806e6f6e6963}#0000000001100000
|
| | System | Warning | 223 | 2025-11-29 04:49:35 | SYSTEM | Microsoft-Windows-Kernel-PnP | 225: The application \Device\HarddiskVolume2\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.5074_none_a5532eb7772ad4c4\TiWorker.exe with process id 7208 stopped the removal or ejection for the device ACPI\PNP0A08\2&daba3ff&0. Process command line: C:\WINDOWS\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.5074_none_a5532eb7772ad4c4\TiWorker.exe -Embedding List of affected devices: STORAGE\Volume\{c67841dd-cd1b-11f0-8722-806e6f6e6963}#0000000001100000
|
| | System | Warning | 223 | 2025-11-29 04:49:35 | SYSTEM | Microsoft-Windows-Kernel-PnP | 225: The application \Device\HarddiskVolume2\Windows\System32\svchost.exe with process id 7336 stopped the removal or ejection for the device ACPI\PNP0A08\2&daba3ff&0. Process command line: C:\WINDOWS\system32\svchost.exe -k whesvc -p -s whesvc List of affected devices: STORAGE\Volume\{c67841dd-cd1b-11f0-8722-806e6f6e6963}#0000000001100000
|
| | System | Warning | 223 | 2025-11-29 04:49:35 | SYSTEM | Microsoft-Windows-Kernel-PnP | 225: The application \Device\HarddiskVolume2\Windows\System32\svchost.exe with process id 7404 stopped the removal or ejection for the device ACPI\PNP0A08\2&daba3ff&0. Process command line: C:\WINDOWS\System32\svchost.exe -k NetworkService -p List of affected devices: STORAGE\Volume\{c67841dd-cd1b-11f0-8722-806e6f6e6963}#0000000001100000
|
| | System | Warning | 223 | 2025-11-29 04:49:35 | SYSTEM | Microsoft-Windows-Kernel-PnP | 225: The application \Device\HarddiskVolume2\Program Files\Windows Defender\NisSrv.exe with process id 7660 stopped the removal or ejection for the device ACPI\PNP0A08\2&daba3ff&0. Process command line: "C:\Program Files\Windows Defender\NisSrv.exe" List of affected devices: STORAGE\Volume\{c67841dd-cd1b-11f0-8722-806e6f6e6963}#0000000001100000
|
| | System | Warning | 223 | 2025-11-29 04:49:35 | SYSTEM | Microsoft-Windows-Kernel-PnP | 225: The application \Device\HarddiskVolume2\Windows\System32\ctfmon.exe with process id 8060 stopped the removal or ejection for the device ACPI\PNP0A08\2&daba3ff&0. Process command line: /QuitInfo:0000000000000284;0000000000000288; List of affected devices: STORAGE\Volume\{c67841dd-cd1b-11f0-8722-806e6f6e6963}#0000000001100000
|
| | System | Warning | 223 | 2025-11-29 04:49:35 | SYSTEM | Microsoft-Windows-Kernel-PnP | 225: The application \Device\HarddiskVolume2\Windows\System32\svchost.exe with process id 8156 stopped the removal or ejection for the device ACPI\PNP0A08\2&daba3ff&0. Process command line: C:\WINDOWS\System32\svchost.exe -k LocalSystemNetworkRestricted -p List of affected devices: STORAGE\Volume\{c67841dd-cd1b-11f0-8722-806e6f6e6963}#0000000001100000
|
| | System | Warning | 223 | 2025-11-29 04:49:35 | SYSTEM | Microsoft-Windows-Kernel-PnP | 225: The application \Device\HarddiskVolume2\Program Files (x86)\Microsoft\EdgeWebView\Application\140.0.3485.66\msedgewebview2.exe with process id 8196 stopped the removal or ejection for the device ACPI\PNP0A08\2&daba3ff&0. Process command line: "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\140.0.3485.66\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\CogiArt\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\LocalState\EBWebView /prefetch:4 /pfhostedapp:b239454542aeb4426687a343f2ad9726df39e1a8 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\CogiArt\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\LocalState\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=140.0.7339.133 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\140.0.3485.66\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=140.0.3485.66 --initial-client-data=0x178,0x17c,0x180,0x138,0x188,0x7fff2c8a2200,0x7fff2c8a220c,0x7fff2c8a2218 List of affected devices: STORAGE\Volume\{c67841dd-cd1b-11f0-8722-806e6f6e6963}#0000000001100000
|
| | System | Warning | 223 | 2025-11-29 04:49:35 | SYSTEM | Microsoft-Windows-Kernel-PnP | 225: The application \Device\HarddiskVolume2\Program Files (x86)\Microsoft\EdgeWebView\Application\140.0.3485.66\msedgewebview2.exe with process id 8448 stopped the removal or ejection for the device ACPI\PNP0A08\2&daba3ff&0. Process command line: "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\140.0.3485.66\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64; Cortana 1.18.9.23723; 10.0.0.0.26200.6584) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.26200 IsWebView2/True (WebView2Version 140.0.3485.66)" --user-data-dir="C:\Users\CogiArt\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\LocalState\EBWebView" --webview-exe-name=SearchHost.exe --webview-exe-version=2125.21002.10.0 --embedded-browser-webview=1 --no-pre-read-main-dll --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1680,i,2146040270215223487,1041600286210841220,262144 --field-trial-handle=1844,i,6697581408194740510,13859916280955955461,262144 --enable-features=ForceSWDCompWhenDCompFallbackRequired,msAggressiveCacheTrimming,msCustomDataPartition,msEdgeFluentOverlayScrollbar,msWebView2NoTabForScreenShare,msWebViewAppLifeCycleWorkaround --disable-features=BackForwardCache,BackgroundTabLoadingFromPerformanceManager,CloseOmniboxPopupOnInactiveAreaClick,CollectAVProductsInfo,CollectCodeIntegrityInfo,EnableHangWatcher,FilterAdsOnAbusiveSites,GetWifiProtocol,LoginDetection,MediaFoundationCameraUsageMonitoring,PreconnectToSearch,SafetyHub,SegmentationPlatform,SpareRendererForSitePerProcess,Ukm,WebPayments,msAITrackerClassification,msAbydosForWindowlessWV2,msAffirmVirtualCard,msAllowChromeWebstore,msAllowMSAPrtSSOForNonMSAProfile,msApplicationGuard,msAskBeforeClosingMultipleTabs,msAutoToggleAADPrtSSOForNonAADProfile,msAutofillEdgeCoupons,msAutofillEdgeCouponsAutoApply,msAutofillEdgeServiceRequest,msAutofillEnableEdgeSuggestions,msAutomaticTabFreeze,msBrowserSettingsSupported,msCoarseGeolocationService,msDataProtection,msDesktopMode,msDesktopRewards,msDisableVariationsSeedFetchThrottling,msEEProactiveHistory,msETFOffstoreExtensionFileDataCollection,msETFPasswordTheftDNRActionSignals,msEdgeAdPlatformUI,msEdgeAddWebCapturetoCollections,msEdgeAutofillShowDeployedPassword,msEdgeCaptureSelectionInPDF,msEdgeCloudConfigService,msEdgeCloudConfigServiceV2,msEdgeCohorts,msEdgeCollectionsPrismExperiment1,msEdgeCollectionsPrismOverallMigration,msEdgeComposeNext,msEdgeEnableNurturingFramework,msEdgeEnclavePrefsBasic,msEdgeEnclavePrefsNotification,msEdgeFaviconService,msEdgeHJTelemetry,msEdgeHubAppSkype,msEdgeImageEditorUI,msEdgeLinkDoctor,msEdgeMouseGestureDefaultEnabled,msEdgeMouseGestureSupported,msEdgeNewDeviceFre,msEdgeOnRampFRE,msEdgeOnRampImport,msEdgePDFCMHighlightUX,msEdgePasswordIris,msEdgePasswordIrisSaveBubble,msEdgeProngPersonalization,msEdgeReadingView,msEdgeRose,msEdgeScreenshotUI,msEdgeSendTabToSelf,msEdgeSettingsImport,msEdgeSettingsImportV2,msEdgeShoppingPersistentStorage,msEdgeShoppingUI,msEdgeSmartFind,msEdgeSuperDragDefaultEnabled,msEdgeSuperDragDropSupported,msEdgeTranslate,msEdgeUpdatesMoreMenuPill,msEdgeWebCapture,msEdgeWebCaptureUniformExperience,msEdgeWebContentFilteringFeedback,msEdgeWorkSearchBanner,msEnableCustomJobMemoryLimitsOnXbox,msEnableMIPForPDF,msEnablePdfUpsell,msEnableThirdPartyScanning,msEnableWebSignInCta,msEnableWebToBrowserSignIn,msEndpointDlp,msEntityExtraction,msExtensionTelemetryFramework,msExternalTaskManager,msFileSystemAccessDirectoryIterationBlocklistCheck,msForceBrowserSignIn,msForeignSessionsPage,msGeolocationAccessService,msGeolocationOSLocationPermissionFallback,msGeolocationSQMService,msGeolocationService,msGrowthInfraLaunchSourceLogging,msGuidedSwitchAllowed,msHubPinPersist,msImplicitSignin,msIrm,msIrmv2,msKlarnaVirtualCard,msLlmConsumerDlpPurview,msLoadStatistics,msLogIsEdgePinnedToTaskbarOnLaunch,msMIPCrossTenantPdfViewSupport,msMdatpWebSiteDlp,msNotificationPermissionForPWA,msNumberOfSitesToPin,msNurturingGlobalSitePinningOnCloseModal,msNurturingSitePinningCITopSites,msNurturingSitePinningWithWindowsConsent,msOnHoverSearchInSidebar,msOpenOfficeDocumentsInWebViewer,msPageInteractionRestrictionRevoke,msPasswordBreachDetection,msPdfAnnotationsVisibility,msPdfDataRecovery,msPdfDigitalSignatureRead,msPdfFreeText,msPdfFreeTextForCJK,msPdfHighlightMode,msPdfInking,msPdfKeyphraseSupport,msPdfOOUI,msPdfPopupMarkerRenderer,msPdfShare,msPdfSharedLibrary,msPdfTextNote,msPdfTextNoteMoreMenu,msPdfThumbnailCache,msPdfUnderside,msPdfViewRestore,msPersonalizationUMA,msPriceComparison,msPrintInWebView2,msPromptDefaultHandlerForPDF,msReactiveSearch,msReadAloud,msReadAloudPdf,msRedirectToShoreline,msRevokeExtensions,msSaasDlp,msShoppingTrigger,msShorelineSearch,msShorelineSearchFindOnPageWebUI,msShowOfflineGameEntrance,msShowReadAloudIconInAddressBar,msShowUXForAADPrtSSOForNonAADProfile,msSitePinningWithoutUi,msSmartScreenProtection,msSuspendMessageForNewSessionWhenHavingPendingNavigation,msSyncEdgeCollections,msTabResourceStats,msTokenizationAutofillInlineEnabled,msTouchMode,msTriggeringSignalGenerator,msUserUnderstanding,msVideoSuperResolutionUI,msWalletBuyNow,msWalletCheckout,msWalletDiagnosticDataLogger,msWalletHubEntry,msWalletHubIntlP3,msWalletPartialCard,msWalletPasswordCategorization,msWalletPasswordCategorizationPlatformExpansion,msWalletTokenizationCardMetadata,msWalletTokenizedAutofill,msWebAssist,msWebAssistHistorySearchService,msWebOOUI,msWindowsTaskManager,msWindowsUserActivities,msZipPayVirtualCard --variations-seed-version --mojo-platform-channel-handle=1832 /prefetch:2 /pfhostedapp:b239454542aeb4426687a343f2ad9726df39e1a8 List of affected devices: STORAGE\Volume\{c67841dd-cd1b-11f0-8722-806e6f6e6963}#0000000001100000
|
| | System | Warning | 223 | 2025-11-29 04:49:35 | SYSTEM | Microsoft-Windows-Kernel-PnP | 225: The application \Device\HarddiskVolume2\Program Files (x86)\Microsoft\EdgeWebView\Application\140.0.3485.66\msedgewebview2.exe with process id 8544 stopped the removal or ejection for the device ACPI\PNP0A08\2&daba3ff&0. Process command line: "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\140.0.3485.66\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64; Cortana 1.18.9.23723; 10.0.0.0.26200.6584) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.26200 IsWebView2/True (WebView2Version 140.0.3485.66)" --user-data-dir="C:\Users\CogiArt\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\LocalState\EBWebView" --webview-exe-name=SearchHost.exe --webview-exe-version=2125.21002.10.0 --embedded-browser-webview=1 --always-read-main-dll --metrics-shmem-handle=2176,i,12606121700463249393,6780851667607998830,524288 --field-trial-handle=1844,i,6697581408194740510,13859916280955955461,262144 --enable-features=ForceSWDCompWhenDCompFallbackRequired,msAggressiveCacheTrimming,msCustomDataPartition,msEdgeFluentOverlayScrollbar,msWebView2NoTabForScreenShare,msWebViewAppLifeCycleWorkaround --disable-features=BackForwardCache,BackgroundTabLoadingFromPerformanceManager,CloseOmniboxPopupOnInactiveAreaClick,CollectAVProductsInfo,CollectCodeIntegrityInfo,EnableHangWatcher,FilterAdsOnAbusiveSites,GetWifiProtocol,LoginDetection,MediaFoundationCameraUsageMonitoring,PreconnectToSearch,SafetyHub,SegmentationPlatform,SpareRendererForSitePerProcess,Ukm,WebPayments,msAITrackerClassification,msAbydosForWindowlessWV2,msAffirmVirtualCard,msAllowChromeWebstore,msAllowMSAPrtSSOForNonMSAProfile,msApplicationGuard,msAskBeforeClosingMultipleTabs,msAutoToggleAADPrtSSOForNonAADProfile,msAutofillEdgeCoupons,msAutofillEdgeCouponsAutoApply,msAutofillEdgeServiceRequest,msAutofillEnableEdgeSuggestions,msAutomaticTabFreeze,msBrowserSettingsSupported,msCoarseGeolocationService,msDataProtection,msDesktopMode,msDesktopRewards,msDisableVariationsSeedFetchThrottling,msEEProactiveHistory,msETFOffstoreExtensionFileDataCollection,msETFPasswordTheftDNRActionSignals,msEdgeAdPlatformUI,msEdgeAddWebCapturetoCollections,msEdgeAutofillShowDeployedPassword,msEdgeCaptureSelectionInPDF,msEdgeCloudConfigService,msEdgeCloudConfigServiceV2,msEdgeCohorts,msEdgeCollectionsPrismExperiment1,msEdgeCollectionsPrismOverallMigration,msEdgeComposeNext,msEdgeEnableNurturingFramework,msEdgeEnclavePrefsBasic,msEdgeEnclavePrefsNotification,msEdgeFaviconService,msEdgeHJTelemetry,msEdgeHubAppSkype,msEdgeImageEditorUI,msEdgeLinkDoctor,msEdgeMouseGestureDefaultEnabled,msEdgeMouseGestureSupported,msEdgeNewDeviceFre,msEdgeOnRampFRE,msEdgeOnRampImport,msEdgePDFCMHighlightUX,msEdgePasswordIris,msEdgePasswordIrisSaveBubble,msEdgeProngPersonalization,msEdgeReadingView,msEdgeRose,msEdgeScreenshotUI,msEdgeSendTabToSelf,msEdgeSettingsImport,msEdgeSettingsImportV2,msEdgeShoppingPersistentStorage,msEdgeShoppingUI,msEdgeSmartFind,msEdgeSuperDragDefaultEnabled,msEdgeSuperDragDropSupported,msEdgeTranslate,msEdgeUpdatesMoreMenuPill,msEdgeWebCapture,msEdgeWebCaptureUniformExperience,msEdgeWebContentFilteringFeedback,msEdgeWorkSearchBanner,msEnableCustomJobMemoryLimitsOnXbox,msEnableMIPForPDF,msEnablePdfUpsell,msEnableThirdPartyScanning,msEnableWebSignInCta,msEnableWebToBrowserSignIn,msEndpointDlp,msEntityExtraction,msExtensionTelemetryFramework,msExternalTaskManager,msFileSystemAccessDirectoryIterationBlocklistCheck,msForceBrowserSignIn,msForeignSessionsPage,msGeolocationAccessService,msGeolocationOSLocationPermissionFallback,msGeolocationSQMService,msGeolocationService,msGrowthInfraLaunchSourceLogging,msGuidedSwitchAllowed,msHubPinPersist,msImplicitSignin,msIrm,msIrmv2,msKlarnaVirtualCard,msLlmConsumerDlpPurview,msLoadStatistics,msLogIsEdgePinnedToTaskbarOnLaunch,msMIPCrossTenantPdfViewSupport,msMdatpWebSiteDlp,msNotificationPermissionForPWA,msNumberOfSitesToPin,msNurturingGlobalSitePinningOnCloseModal,msNurturingSitePinningCITopSites,msNurturingSitePinningWithWindowsConsent,msOnHoverSearchInSidebar,msOpenOfficeDocumentsInWebViewer,msPageInteractionRestrictionRevoke,msPasswordBreachDetection,msPdfAnnotationsVisibility,msPdfDataRecovery,msPdfDigitalSignatureRead,msPdfFreeText,msPdfFreeTextForCJK,msPdfHighlightMode,msPdfInking,msPdfKeyphraseSupport,msPdfOOUI,msPdfPopupMarkerRenderer,msPdfShare,msPdfSharedLibrary,msPdfTextNote,msPdfTextNoteMoreMenu,msPdfThumbnailCache,msPdfUnderside,msPdfViewRestore,msPersonalizationUMA,msPriceComparison,msPrintInWebView2,msPromptDefaultHandlerForPDF,msReactiveSearch,msReadAloud,msReadAloudPdf,msRedirectToShoreline,msRevokeExtensions,msSaasDlp,msShoppingTrigger,msShorelineSearch,msShorelineSearchFindOnPageWebUI,msShowOfflineGameEntrance,msShowReadAloudIconInAddressBar,msShowUXForAADPrtSSOForNonAADProfile,msSitePinningWithoutUi,msSmartScreenProtection,msSuspendMessageForNewSessionWhenHavingPendingNavigation,msSyncEdgeCollections,msTabResourceStats,msTokenizationAutofillInlineEnabled,msTouchMode,msTriggeringSignalGenerator,msUserUnderstanding,msVideoSuperResolutionUI,msWalletBuyNow,msWalletCheckout,msWalletDiagnosticDataLogger,msWalletHubEntry,msWalletHubIntlP3,msWalletPartialCard,msWalletPasswordCategorization,msWalletPasswordCategorizationPlatformExpansion,msWalletTokenizationCardMetadata,msWalletTokenizedAutofill,msWebAssist,msWebAssistHistorySearchService,msWebOOUI,msWindowsTaskManager,msWindowsUserActivities,msZipPayVirtualCard --variations-seed-version --mojo-platform-channel-handle=2164 /prefetch:11 /pfhostedapp:b239454542aeb4426687a343f2ad9726df39e1a8 List of affected devices: STORAGE\Volume\{c67841dd-cd1b-11f0-8722-806e6f6e6963}#0000000001100000
|
| | System | Warning | 223 | 2025-11-29 04:49:35 | SYSTEM | Microsoft-Windows-Kernel-PnP | 225: The application \Device\HarddiskVolume2\Program Files (x86)\Microsoft\EdgeWebView\Application\140.0.3485.66\msedgewebview2.exe with process id 8672 stopped the removal or ejection for the device ACPI\PNP0A08\2&daba3ff&0. Process command line: "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\140.0.3485.66\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64; Cortana 1.18.9.23723; 10.0.0.0.26200.6584) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.26200 IsWebView2/True (WebView2Version 140.0.3485.66)" --user-data-dir="C:\Users\CogiArt\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\LocalState\EBWebView" --webview-exe-name=SearchHost.exe --webview-exe-version=2125.21002.10.0 --embedded-browser-webview=1 --always-read-main-dll --metrics-shmem-handle=2476,i,6803141820668948687,5530864620902532028,524288 --field-trial-handle=1844,i,6697581408194740510,13859916280955955461,262144 --enable-features=ForceSWDCompWhenDCompFallbackRequired,msAggressiveCacheTrimming,msCustomDataPartition,msEdgeFluentOverlayScrollbar,msWebView2NoTabForScreenShare,msWebViewAppLifeCycleWorkaround --disable-features=BackForwardCache,BackgroundTabLoadingFromPerformanceManager,CloseOmniboxPopupOnInactiveAreaClick,CollectAVProductsInfo,CollectCodeIntegrityInfo,EnableHangWatcher,FilterAdsOnAbusiveSites,GetWifiProtocol,LoginDetection,MediaFoundationCameraUsageMonitoring,PreconnectToSearch,SafetyHub,SegmentationPlatform,SpareRendererForSitePerProcess,Ukm,WebPayments,msAITrackerClassification,msAbydosForWindowlessWV2,msAffirmVirtualCard,msAllowChromeWebstore,msAllowMSAPrtSSOForNonMSAProfile,msApplicationGuard,msAskBeforeClosingMultipleTabs,msAutoToggleAADPrtSSOForNonAADProfile,msAutofillEdgeCoupons,msAutofillEdgeCouponsAutoApply,msAutofillEdgeServiceRequest,msAutofillEnableEdgeSuggestions,msAutomaticTabFreeze,msBrowserSettingsSupported,msCoarseGeolocationService,msDataProtection,msDesktopMode,msDesktopRewards,msDisableVariationsSeedFetchThrottling,msEEProactiveHistory,msETFOffstoreExtensionFileDataCollection,msETFPasswordTheftDNRActionSignals,msEdgeAdPlatformUI,msEdgeAddWebCapturetoCollections,msEdgeAutofillShowDeployedPassword,msEdgeCaptureSelectionInPDF,msEdgeCloudConfigService,msEdgeCloudConfigServiceV2,msEdgeCohorts,msEdgeCollectionsPrismExperiment1,msEdgeCollectionsPrismOverallMigration,msEdgeComposeNext,msEdgeEnableNurturingFramework,msEdgeEnclavePrefsBasic,msEdgeEnclavePrefsNotification,msEdgeFaviconService,msEdgeHJTelemetry,msEdgeHubAppSkype,msEdgeImageEditorUI,msEdgeLinkDoctor,msEdgeMouseGestureDefaultEnabled,msEdgeMouseGestureSupported,msEdgeNewDeviceFre,msEdgeOnRampFRE,msEdgeOnRampImport,msEdgePDFCMHighlightUX,msEdgePasswordIris,msEdgePasswordIrisSaveBubble,msEdgeProngPersonalization,msEdgeReadingView,msEdgeRose,msEdgeScreenshotUI,msEdgeSendTabToSelf,msEdgeSettingsImport,msEdgeSettingsImportV2,msEdgeShoppingPersistentStorage,msEdgeShoppingUI,msEdgeSmartFind,msEdgeSuperDragDefaultEnabled,msEdgeSuperDragDropSupported,msEdgeTranslate,msEdgeUpdatesMoreMenuPill,msEdgeWebCapture,msEdgeWebCaptureUniformExperience,msEdgeWebContentFilteringFeedback,msEdgeWorkSearchBanner,msEnableCustomJobMemoryLimitsOnXbox,msEnableMIPForPDF,msEnablePdfUpsell,msEnableThirdPartyScanning,msEnableWebSignInCta,msEnableWebToBrowserSignIn,msEndpointDlp,msEntityExtraction,msExtensionTelemetryFramework,msExternalTaskManager,msFileSystemAccessDirectoryIterationBlocklistCheck,msForceBrowserSignIn,msForeignSessionsPage,msGeolocationAccessService,msGeolocationOSLocationPermissionFallback,msGeolocationSQMService,msGeolocationService,msGrowthInfraLaunchSourceLogging,msGuidedSwitchAllowed,msHubPinPersist,msImplicitSignin,msIrm,msIrmv2,msKlarnaVirtualCard,msLlmConsumerDlpPurview,msLoadStatistics,msLogIsEdgePinnedToTaskbarOnLaunch,msMIPCrossTenantPdfViewSupport,msMdatpWebSiteDlp,msNotificationPermissionForPWA,msNumberOfSitesToPin,msNurturingGlobalSitePinningOnCloseModal,msNurturingSitePinningCITopSites,msNurturingSitePinningWithWindowsConsent,msOnHoverSearchInSidebar,msOpenOfficeDocumentsInWebViewer,msPageInteractionRestrictionRevoke,msPasswordBreachDetection,msPdfAnnotationsVisibility,msPdfDataRecovery,msPdfDigitalSignatureRead,msPdfFreeText,msPdfFreeTextForCJK,msPdfHighlightMode,msPdfInking,msPdfKeyphraseSupport,msPdfOOUI,msPdfPopupMarkerRenderer,msPdfShare,msPdfSharedLibrary,msPdfTextNote,msPdfTextNoteMoreMenu,msPdfThumbnailCache,msPdfUnderside,msPdfViewRestore,msPersonalizationUMA,msPriceComparison,msPrintInWebView2,msPromptDefaultHandlerForPDF,msReactiveSearch,msReadAloud,msReadAloudPdf,msRedirectToShoreline,msRevokeExtensions,msSaasDlp,msShoppingTrigger,msShorelineSearch,msShorelineSearchFindOnPageWebUI,msShowOfflineGameEntrance,msShowReadAloudIconInAddressBar,msShowUXForAADPrtSSOForNonAADProfile,msSitePinningWithoutUi,msSmartScreenProtection,msSuspendMessageForNewSessionWhenHavingPendingNavigation,msSyncEdgeCollections,msTabResourceStats,msTokenizationAutofillInlineEnabled,msTouchMode,msTriggeringSignalGenerator,msUserUnderstanding,msVideoSuperResolutionUI,msWalletBuyNow,msWalletCheckout,msWalletDiagnosticDataLogger,msWalletHubEntry,msWalletHubIntlP3,msWalletPartialCard,msWalletPasswordCategorization,msWalletPasswordCategorizationPlatformExpansion,msWalletTokenizationCardMetadata,msWalletTokenizedAutofill,msWebAssist,msWebAssistHistorySearchService,msWebOOUI,msWindowsTaskManager,msWindowsUserActivities,msZipPayVirtualCard --variations-seed-version --mojo-platform-channel-handle=2488 /prefetch:13 /pfhostedapp:b239454542aeb4426687a343f2ad9726df39e1a8 List of affected devices: STORAGE\Volume\{c67841dd-cd1b-11f0-8722-806e6f6e6963}#0000000001100000
|
| | System | Warning | 223 | 2025-11-29 04:49:35 | SYSTEM | Microsoft-Windows-Kernel-PnP | 225: The application \Device\HarddiskVolume2\Windows\System32\svchost.exe with process id 8904 stopped the removal or ejection for the device ACPI\PNP0A08\2&daba3ff&0. Process command line: C:\WINDOWS\system32\svchost.exe -k LocalService -p -s NPSMSvc List of affected devices: STORAGE\Volume\{c67841dd-cd1b-11f0-8722-806e6f6e6963}#0000000001100000
|
| | System | Warning | 223 | 2025-11-29 04:49:35 | SYSTEM | Microsoft-Windows-Kernel-PnP | 225: The application \Device\HarddiskVolume2\Windows\System32\svchost.exe with process id 9208 stopped the removal or ejection for the device ACPI\PNP0A08\2&daba3ff&0. Process command line: C:\WINDOWS\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts List of affected devices: STORAGE\Volume\{c67841dd-cd1b-11f0-8722-806e6f6e6963}#0000000001100000
|
| | System | Warning | 223 | 2025-11-29 04:49:35 | SYSTEM | Microsoft-Windows-Kernel-PnP | 225: The application \Device\HarddiskVolume2\Windows\System32\SearchIndexer.exe with process id 9292 stopped the removal or ejection for the device ACPI\PNP0A08\2&daba3ff&0. Process command line: C:\WINDOWS\system32\SearchIndexer.exe /Embedding List of affected devices: STORAGE\Volume\{c67841dd-cd1b-11f0-8722-806e6f6e6963}#0000000001100000
|
| | System | Warning | 223 | 2025-11-29 04:49:35 | SYSTEM | Microsoft-Windows-Kernel-PnP | 225: The application \Device\HarddiskVolume2\Program Files (x86)\Microsoft\Edge\Application\msedge.exe with process id 9308 stopped the removal or ejection for the device ACPI\PNP0A08\2&daba3ff&0. Process command line: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --no-pre-read-main-dll --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1.25 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --time-ticks-at-unix-epoch=-1764419504945837 --launch-time-ticks=117745552 --skip-read-main-dll --metrics-shmem-handle=8260,i,1647140191953158479,2709063737171939114,2097152 --field-trial-handle=2348,i,4383914887142717900,4649832010531238256,262144 --variations-seed-version --mojo-platform-channel-handle=8244 /prefetch:1 List of affected devices: STORAGE\Volume\{c67841dd-cd1b-11f0-8722-806e6f6e6963}#0000000001100000
|
| | System | Warning | 223 | 2025-11-29 04:49:35 | SYSTEM | Microsoft-Windows-Kernel-PnP | 225: The application \Device\HarddiskVolume2\Program Files (x86)\Microsoft\Edge\Application\msedge.exe with process id 9472 stopped the removal or ejection for the device ACPI\PNP0A08\2&daba3ff&0. Process command line: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --no-pre-read-main-dll --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1.25 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --time-ticks-at-unix-epoch=-1764419504945837 --launch-time-ticks=115995249 --skip-read-main-dll --metrics-shmem-handle=5564,i,6162628953556025520,8274258594588635617,2097152 --field-trial-handle=2348,i,4383914887142717900,4649832010531238256,262144 --variations-seed-version --mojo-platform-channel-handle=5676 /prefetch:1 List of affected devices: STORAGE\Volume\{c67841dd-cd1b-11f0-8722-806e6f6e6963}#0000000001100000
|
| | System | Warning | 223 | 2025-11-29 04:49:35 | SYSTEM | Microsoft-Windows-Kernel-PnP | 225: The application \Device\HarddiskVolume2\Windows\System32\smartscreen.exe with process id 9568 stopped the removal or ejection for the device ACPI\PNP0A08\2&daba3ff&0. Process command line: C:\Windows\System32\smartscreen.exe -Embedding List of affected devices: STORAGE\Volume\{c67841dd-cd1b-11f0-8722-806e6f6e6963}#0000000001100000
|
| | System | Warning | 223 | 2025-11-29 04:49:35 | SYSTEM | Microsoft-Windows-Kernel-PnP | 225: The application \Device\HarddiskVolume2\Windows\System32\SecurityHealthSystray.exe with process id 9676 stopped the removal or ejection for the device ACPI\PNP0A08\2&daba3ff&0. Process command line: "C:\Windows\System32\SecurityHealthSystray.exe" List of affected devices: STORAGE\Volume\{c67841dd-cd1b-11f0-8722-806e6f6e6963}#0000000001100000
|
| | System | Warning | 223 | 2025-11-29 04:49:35 | SYSTEM | Microsoft-Windows-Kernel-PnP | 225: The application \Device\HarddiskVolume2\Windows\System32\SecurityHealthService.exe with process id 9696 stopped the removal or ejection for the device ACPI\PNP0A08\2&daba3ff&0. Process command line: C:\WINDOWS\system32\SecurityHealthService.exe List of affected devices: STORAGE\Volume\{c67841dd-cd1b-11f0-8722-806e6f6e6963}#0000000001100000
|
| | System | Warning | 223 | 2025-11-29 04:49:35 | SYSTEM | Microsoft-Windows-Kernel-PnP | 225: The application \Device\HarddiskVolume2\Program Files (x86)\Microsoft\Edge\Application\msedge.exe with process id 9760 stopped the removal or ejection for the device ACPI\PNP0A08\2&daba3ff&0. Process command line: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start List of affected devices: STORAGE\Volume\{c67841dd-cd1b-11f0-8722-806e6f6e6963}#0000000001100000
|
| | System | Warning | 223 | 2025-11-29 04:49:35 | SYSTEM | Microsoft-Windows-Kernel-PnP | 225: The application \Device\HarddiskVolume2\Program Files (x86)\Microsoft\Edge\Application\msedge.exe with process id 9796 stopped the removal or ejection for the device ACPI\PNP0A08\2&daba3ff&0. Process command line: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\CogiArt\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\CogiArt\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=140.0.7339.133 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=140.0.3485.66 --initial-client-data=0x26c,0x270,0x274,0x268,0x27c,0x7fff2c8a2200,0x7fff2c8a220c,0x7fff2c8a2218 List of affected devices: STORAGE\Volume\{c67841dd-cd1b-11f0-8722-806e6f6e6963}#0000000001100000
|
| | System | Warning | 223 | 2025-11-29 04:49:35 | SYSTEM | Microsoft-Windows-Kernel-PnP | 225: The application \Device\HarddiskVolume2\Program Files (x86)\Microsoft\Edge\Application\msedge.exe with process id 10000 stopped the removal or ejection for the device ACPI\PNP0A08\2&daba3ff&0. Process command line: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --startup-read-main-dll --metrics-shmem-handle=2092,i,4887180018940892193,14466571100499298652,262144 --field-trial-handle=2348,i,4383914887142717900,4649832010531238256,262144 --variations-seed-version --mojo-platform-channel-handle=2316 /prefetch:2 List of affected devices: STORAGE\Volume\{c67841dd-cd1b-11f0-8722-806e6f6e6963}#0000000001100000
|
| | System | Warning | 223 | 2025-11-29 04:49:35 | SYSTEM | Microsoft-Windows-Kernel-PnP | 225: The application \Device\HarddiskVolume2\Program Files (x86)\Microsoft\Edge\Application\msedge.exe with process id 10008 stopped the removal or ejection for the device ACPI\PNP0A08\2&daba3ff&0. Process command line: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --startup-read-main-dll --metrics-shmem-handle=2380,i,10255135448204520466,12585701750255230017,524288 --field-trial-handle=2348,i,4383914887142717900,4649832010531238256,262144 --variations-seed-version --mojo-platform-channel-handle=2496 /prefetch:11 List of affected devices: STORAGE\Volume\{c67841dd-cd1b-11f0-8722-806e6f6e6963}#0000000001100000
|
| | System | Warning | 223 | 2025-11-29 04:49:35 | SYSTEM | Microsoft-Windows-Kernel-PnP | 225: The application \Device\HarddiskVolume2\Program Files (x86)\Microsoft\Edge\Application\msedge.exe with process id 10068 stopped the removal or ejection for the device ACPI\PNP0A08\2&daba3ff&0. Process command line: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --startup-read-main-dll --metrics-shmem-handle=2864,i,17973114004821567313,17809559298368817542,524288 --field-trial-handle=2348,i,4383914887142717900,4649832010531238256,262144 --variations-seed-version --mojo-platform-channel-handle=2924 /prefetch:13 List of affected devices: STORAGE\Volume\{c67841dd-cd1b-11f0-8722-806e6f6e6963}#0000000001100000
|
| | System | Warning | 223 | 2025-11-29 04:49:35 | SYSTEM | Microsoft-Windows-Kernel-PnP | 225: The application \Device\HarddiskVolume2\Windows\System32\svchost.exe with process id 10272 stopped the removal or ejection for the device ACPI\PNP0A08\2&daba3ff&0. Process command line: C:\WINDOWS\system32\svchost.exe -k netsvcs -p -s UsoSvc List of affected devices: STORAGE\Volume\{c67841dd-cd1b-11f0-8722-806e6f6e6963}#0000000001100000
|
| | System | Warning | 223 | 2025-11-29 04:49:35 | SYSTEM | Microsoft-Windows-Kernel-PnP | 225: The application \Device\HarddiskVolume2\Program Files (x86)\Microsoft\Edge\Application\msedge.exe with process id 10540 stopped the removal or ejection for the device ACPI\PNP0A08\2&daba3ff&0. Process command line: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_xpay_wallet.mojom.EdgeXPayWalletService --lang=en-US --service-sandbox-type=utility --no-pre-read-main-dll --ssd-no-pressure-read-main-dll --metrics-shmem-handle=4448,i,11909205831824291996,13949259313870513099,524288 --field-trial-handle=2348,i,4383914887142717900,4649832010531238256,262144 --variations-seed-version --mojo-platform-channel-handle=9828 /prefetch:14 List of affected devices: STORAGE\Volume\{c67841dd-cd1b-11f0-8722-806e6f6e6963}#0000000001100000
|
| | System | Warning | 223 | 2025-11-29 04:49:35 | SYSTEM | Microsoft-Windows-Kernel-PnP | 225: The application \Device\HarddiskVolume2\Windows\System32\dllhost.exe with process id 10568 stopped the removal or ejection for the device ACPI\PNP0A08\2&daba3ff&0. Process command line: "C:\WINDOWS\system32\DllHost.exe" /Processid:{CA6CC9F1-867A-481E-951E-A28C5E4F01EA} List of affected devices: STORAGE\Volume\{c67841dd-cd1b-11f0-8722-806e6f6e6963}#0000000001100000
|
| | System | Warning | 223 | 2025-11-29 04:49:35 | SYSTEM | Microsoft-Windows-Kernel-PnP | 225: The application \Device\HarddiskVolume2\Users\CogiArt\AppData\Local\Microsoft\OneDrive\OneDrive.exe with process id 10620 stopped the removal or ejection for the device ACPI\PNP0A08\2&daba3ff&0. Process command line: "C:\Users\CogiArt\AppData\Local\Microsoft\OneDrive\OneDrive.exe" /background List of affected devices: STORAGE\Volume\{c67841dd-cd1b-11f0-8722-806e6f6e6963}#0000000001100000
|
| | System | Warning | 223 | 2025-11-29 04:49:35 | SYSTEM | Microsoft-Windows-Kernel-PnP | 225: The application \Device\HarddiskVolume2\Windows\System32\svchost.exe with process id 10652 stopped the removal or ejection for the device ACPI\PNP0A08\2&daba3ff&0. Process command line: C:\WINDOWS\system32\svchost.exe -k netsvcs -p -s lfsvc List of affected devices: STORAGE\Volume\{c67841dd-cd1b-11f0-8722-806e6f6e6963}#0000000001100000
|
| | System | Warning | 223 | 2025-11-29 04:49:35 | SYSTEM | Microsoft-Windows-Kernel-PnP | 225: The application \Device\HarddiskVolume2\Windows\System32\svchost.exe with process id 10820 stopped the removal or ejection for the device ACPI\PNP0A08\2&daba3ff&0. Process command line: C:\WINDOWS\System32\svchost.exe -k netsvcs -p -s BITS List of affected devices: SCSI\Disk&Ven_&Prod_KINGSTON_SV300S3\4&fefddb&0&020000 STORAGE\Volume\{c67841dd-cd1b-11f0-8722-806e6f6e6963}#0000000001100000
|
| | System | Warning | 223 | 2025-11-29 04:49:35 | SYSTEM | Microsoft-Windows-Kernel-PnP | 225: The application \Device\HarddiskVolume2\Windows\System32\svchost.exe with process id 10884 stopped the removal or ejection for the device ACPI\PNP0A08\2&daba3ff&0. Process command line: C:\WINDOWS\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s SSDPSRV List of affected devices: STORAGE\Volume\{c67841dd-cd1b-11f0-8722-806e6f6e6963}#0000000001100000
|
| | System | Warning | 223 | 2025-11-29 04:49:35 | SYSTEM | Microsoft-Windows-Kernel-PnP | 225: The application \Device\HarddiskVolume2\Windows\System32\UsoClient.exe with process id 11044 stopped the removal or ejection for the device ACPI\PNP0A08\2&daba3ff&0. Process command line: "C:\Windows\System32\usoclient.exe" StartStoreBizCritUpdates HzqGXM5/eESB4sKm.1 List of affected devices: STORAGE\Volume\{c67841dd-cd1b-11f0-8722-806e6f6e6963}#0000000001100000
|
| | System | Warning | 223 | 2025-11-29 04:49:35 | SYSTEM | Microsoft-Windows-Kernel-PnP | 225: The application \Device\HarddiskVolume2\Windows\System32\amdfendrsr.exe with process id 11192 stopped the removal or ejection for the device ACPI\PNP0A08\2&daba3ff&0. Process command line: C:\WINDOWS\System32\amdfendrsr.exe List of affected devices: STORAGE\Volume\{c67841dd-cd1b-11f0-8722-806e6f6e6963}#0000000001100000
|
| | System | Warning | 223 | 2025-11-29 04:49:35 | SYSTEM | Microsoft-Windows-Kernel-PnP | 225: The application \Device\HarddiskVolume2\Program Files (x86)\Microsoft\Edge\Application\msedge.exe with process id 11376 stopped the removal or ejection for the device ACPI\PNP0A08\2&daba3ff&0. Process command line: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --no-pre-read-main-dll --skip-read-main-dll --metrics-shmem-handle=4028,i,2623425999095553841,275752566819237121,524288 --field-trial-handle=2348,i,4383914887142717900,4649832010531238256,262144 --variations-seed-version --mojo-platform-channel-handle=7460 /prefetch:14 List of affected devices: STORAGE\Volume\{c67841dd-cd1b-11f0-8722-806e6f6e6963}#0000000001100000
|
| | System | Warning | 223 | 2025-11-29 04:49:35 | SYSTEM | Microsoft-Windows-Kernel-PnP | 225: The application \Device\HarddiskVolume2\Windows\System32\RuntimeBroker.exe with process id 11432 stopped the removal or ejection for the device ACPI\PNP0A08\2&daba3ff&0. Process command line: C:\Windows\System32\RuntimeBroker.exe -Embedding List of affected devices: STORAGE\Volume\{c67841dd-cd1b-11f0-8722-806e6f6e6963}#0000000001100000
|
| | System | Warning | 223 | 2025-11-29 04:49:35 | SYSTEM | Microsoft-Windows-Kernel-PnP | 225: The application \Device\HarddiskVolume2\Windows\System32\DriverStore\FileRepository\u0417877.inf_amd64_8b2c2b61b3f8a9e5\B417004\atieclxx.exe with process id 11976 stopped the removal or ejection for the device ACPI\PNP0A08\2&daba3ff&0. Process command line: atieclxx List of affected devices: STORAGE\Volume\{c67841dd-cd1b-11f0-8722-806e6f6e6963}#0000000001100000
|
| | System | Warning | 223 | 2025-11-29 04:49:35 | SYSTEM | Microsoft-Windows-Kernel-PnP | 225: The application \Device\HarddiskVolume2\Windows\System32\drvinst.exe with process id 12188 stopped the removal or ejection for the device ACPI\PNP0A08\2&daba3ff&0. Process command line: DrvInst.exe "2" "11" "ACPI\PNP0A08\2&DABA3FF&0" "C:\WINDOWS\System32\DriverStore\FileRepository\pci.inf_amd64_dd399fb824aa0057\pci.inf" "pci.inf:4ac8f80c3f7bb336:PCI_ROOT:10.0.26100.5074:*pnp0a08," "43ab78ba3" "0000000000000224" "45f9" List of affected devices: STORAGE\Volume\{c67841dd-cd1b-11f0-8722-806e6f6e6963}#0000000001100000
|
| | System | Warning | 223 | 2025-11-29 04:49:35 | SYSTEM | Microsoft-Windows-Kernel-PnP | 225: The application \Device\HarddiskVolume2\Program Files (x86)\Microsoft\Edge\Application\msedge.exe with process id 12520 stopped the removal or ejection for the device ACPI\PNP0A08\2&daba3ff&0. Process command line: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --no-pre-read-main-dll --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1.25 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --time-ticks-at-unix-epoch=-1764419504945837 --launch-time-ticks=101673525 --skip-read-main-dll --metrics-shmem-handle=5536,i,12393851022284184564,4650058075989229088,2097152 --field-trial-handle=2348,i,4383914887142717900,4649832010531238256,262144 --variations-seed-version --mojo-platform-channel-handle=5852 /prefetch:1 List of affected devices: STORAGE\Volume\{c67841dd-cd1b-11f0-8722-806e6f6e6963}#0000000001100000
|
| | System | Warning | 223 | 2025-11-29 04:49:35 | SYSTEM | Microsoft-Windows-Kernel-PnP | 225: The application \Device\HarddiskVolume2\Program Files (x86)\Microsoft\Edge\Application\msedge.exe with process id 12640 stopped the removal or ejection for the device ACPI\PNP0A08\2&daba3ff&0. Process command line: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --no-pre-read-main-dll --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1.25 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --time-ticks-at-unix-epoch=-1764419504945837 --launch-time-ticks=117268181 --skip-read-main-dll --metrics-shmem-handle=5148,i,16092209981013059392,10708454124285461251,2097152 --field-trial-handle=2348,i,4383914887142717900,4649832010531238256,262144 --variations-seed-version --mojo-platform-channel-handle=6140 /prefetch:1 List of affected devices: STORAGE\Volume\{c67841dd-cd1b-11f0-8722-806e6f6e6963}#0000000001100000
|
| | System | Warning | 223 | 2025-11-29 04:49:35 | SYSTEM | Microsoft-Windows-Kernel-PnP | 225: The application \Device\HarddiskVolume2\Program Files (x86)\Microsoft\Edge\Application\msedge.exe with process id 12668 stopped the removal or ejection for the device ACPI\PNP0A08\2&daba3ff&0. Process command line: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --no-pre-read-main-dll --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1.25 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --time-ticks-at-unix-epoch=-1764419504945837 --launch-time-ticks=116335786 --skip-read-main-dll --metrics-shmem-handle=6320,i,10244184655814670071,11558143151516782913,2097152 --field-trial-handle=2348,i,4383914887142717900,4649832010531238256,262144 --variations-seed-version --mojo-platform-channel-handle=5832 /prefetch:1 List of affected devices: STORAGE\Volume\{c67841dd-cd1b-11f0-8722-806e6f6e6963}#0000000001100000
|
| | System | Warning | 223 | 2025-11-29 04:49:35 | SYSTEM | Microsoft-Windows-Kernel-PnP | 225: The application \Device\HarddiskVolume2\Windows\System32\svchost.exe with process id 12712 stopped the removal or ejection for the device ACPI\PNP0A08\2&daba3ff&0. Process command line: C:\WINDOWS\system32\svchost.exe -k UnistackSvcGroup List of affected devices: SCSI\Disk&Ven_&Prod_KINGSTON_SV300S3\4&fefddb&0&020000 STORAGE\Volume\{c67841dd-cd1b-11f0-8722-806e6f6e6963}#0000000001100000
|
| | System | Warning | 223 | 2025-11-29 04:49:35 | SYSTEM | Microsoft-Windows-Kernel-PnP | 225: The application \Device\HarddiskVolume2\Program Files (x86)\Microsoft\Edge\Application\msedge.exe with process id 12980 stopped the removal or ejection for the device ACPI\PNP0A08\2&daba3ff&0. Process command line: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --no-pre-read-main-dll --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1.25 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --time-ticks-at-unix-epoch=-1764419504945837 --launch-time-ticks=116189806 --skip-read-main-dll --metrics-shmem-handle=8088,i,7777093429136874999,3959979172431801871,2097152 --field-trial-handle=2348,i,4383914887142717900,4649832010531238256,262144 --variations-seed-version --mojo-platform-channel-handle=6156 /prefetch:1 List of affected devices: STORAGE\Volume\{c67841dd-cd1b-11f0-8722-806e6f6e6963}#0000000001100000
|
| | System | Warning | 223 | 2025-11-29 04:49:35 | SYSTEM | Microsoft-Windows-Kernel-PnP | 225: The application \Device\HarddiskVolume2\Windows\UUS\amd64\MoUsoCoreWorker.exe with process id 13036 stopped the removal or ejection for the device ACPI\PNP0A08\2&daba3ff&0. Process command line: "C:\WINDOWS\uus\AMD64\MoUsoCoreWorker.exe" useprivatenamespaces List of affected devices: STORAGE\Volume\{c67841dd-cd1b-11f0-8722-806e6f6e6963}#0000000001100000
|
| | System | Warning | 223 | 2025-11-29 04:49:35 | SYSTEM | Microsoft-Windows-Kernel-PnP | 225: The application \Device\HarddiskVolume2\Program Files (x86)\Microsoft\Edge\Application\msedge.exe with process id 13236 stopped the removal or ejection for the device ACPI\PNP0A08\2&daba3ff&0. Process command line: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --no-pre-read-main-dll --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1.25 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --time-ticks-at-unix-epoch=-1764419504945837 --launch-time-ticks=102672044 --skip-read-main-dll --metrics-shmem-handle=8184,i,12941509890726566974,1273642130367469043,2097152 --field-trial-handle=2348,i,4383914887142717900,4649832010531238256,262144 --variations-seed-version --mojo-platform-channel-handle=8068 /prefetch:1 List of affected devices: STORAGE\Volume\{c67841dd-cd1b-11f0-8722-806e6f6e6963}#0000000001100000
|
| | System | Warning | 223 | 2025-11-29 04:49:35 | SYSTEM | Microsoft-Windows-Kernel-PnP | 225: The application \Device\HarddiskVolume2\Windows\System32\dllhost.exe with process id 13452 stopped the removal or ejection for the device ACPI\PNP0A08\2&daba3ff&0. Process command line: C:\WINDOWS\system32\DllHost.exe /Processid:{6C752774-29FB-4E50-8BB1-97098425A77C} List of affected devices: STORAGE\Volume\{c67841dd-cd1b-11f0-8722-806e6f6e6963}#0000000001100000
|
| | System | Warning | 223 | 2025-11-29 04:49:35 | SYSTEM | Microsoft-Windows-Kernel-PnP | 225: The application \Device\HarddiskVolume2\Windows\System32\svchost.exe with process id 13564 stopped the removal or ejection for the device ACPI\PNP0A08\2&daba3ff&0. Process command line: C:\WINDOWS\System32\svchost.exe -k AppReadiness -p -s AppReadiness List of affected devices: STORAGE\Volume\{c67841dd-cd1b-11f0-8722-806e6f6e6963}#0000000001100000
|
| | System | Warning | 223 | 2025-11-29 04:49:35 | SYSTEM | Microsoft-Windows-Kernel-PnP | 225: The application \Device\HarddiskVolume2\Windows\System32\svchost.exe with process id 13592 stopped the removal or ejection for the device ACPI\PNP0A08\2&daba3ff&0. Process command line: C:\WINDOWS\system32\svchost.exe -k InvSvcGroup -p -s InventorySvc List of affected devices: STORAGE\Volume\{c67841dd-cd1b-11f0-8722-806e6f6e6963}#0000000001100000
|
| | System | Warning | 223 | 2025-11-29 04:49:35 | SYSTEM | Microsoft-Windows-Kernel-PnP | 225: The application \Device\HarddiskVolume2\Program Files (x86)\Microsoft\Edge\Application\msedge.exe with process id 13644 stopped the removal or ejection for the device ACPI\PNP0A08\2&daba3ff&0. Process command line: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --no-pre-read-main-dll --skip-read-main-dll --metrics-shmem-handle=10144,i,12788395599204181742,6960392208927655569,524288 --field-trial-handle=2348,i,4383914887142717900,4649832010531238256,262144 --variations-seed-version --mojo-platform-channel-handle=9900 /prefetch:14 List of affected devices: STORAGE\Volume\{c67841dd-cd1b-11f0-8722-806e6f6e6963}#0000000001100000
|
| | System | Warning | 223 | 2025-11-29 04:49:35 | SYSTEM | Microsoft-Windows-Kernel-PnP | 225: The application \Device\HarddiskVolume2\Windows\System32\dxgiadaptercache.exe with process id 13704 stopped the removal or ejection for the device ACPI\PNP0A08\2&daba3ff&0. Process command line: "C:\WINDOWS\system32\dxgiadaptercache.exe" List of affected devices: STORAGE\Volume\{c67841dd-cd1b-11f0-8722-806e6f6e6963}#0000000001100000
|
| | System | Warning | 223 | 2025-11-29 04:49:35 | SYSTEM | Microsoft-Windows-Kernel-PnP | 225: The application \Device\HarddiskVolume2\Windows\System32\svchost.exe with process id 13720 stopped the removal or ejection for the device ACPI\PNP0A08\2&daba3ff&0. Process command line: C:\WINDOWS\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s wscsvc List of affected devices: STORAGE\Volume\{c67841dd-cd1b-11f0-8722-806e6f6e6963}#0000000001100000
|
| | System | Warning | 223 | 2025-11-29 04:49:35 | SYSTEM | Microsoft-Windows-Kernel-PnP | 225: The application \Device\HarddiskVolume2\Windows\System32\svchost.exe with process id 14168 stopped the removal or ejection for the device ACPI\PNP0A08\2&daba3ff&0. Process command line: C:\WINDOWS\system32\svchost.exe -k netsvcs -p -s DsmSvc List of affected devices: STORAGE\Volume\{c67841dd-cd1b-11f0-8722-806e6f6e6963}#0000000001100000
|
| | System | Warning | 223 | 2025-11-29 04:49:35 | SYSTEM | Microsoft-Windows-Kernel-PnP | 225: The application \Device\HarddiskVolume2\Users\CogiArt\AppData\Local\Microsoft\OneDrive\25.087.0506.0001\FileCoAuth.exe with process id 14176 stopped the removal or ejection for the device ACPI\PNP0A08\2&daba3ff&0. Process command line: "C:\Users\CogiArt\AppData\Local\Microsoft\OneDrive\25.087.0506.0001\FileCoAuth.exe" -Embedding List of affected devices: STORAGE\Volume\{c67841dd-cd1b-11f0-8722-806e6f6e6963}#0000000001100000
|
| | System | Warning | 223 | 2025-11-29 04:49:41 | SYSTEM | Microsoft-Windows-Kernel-PnP | 225: The application \Device\HarddiskVolume2\Windows\System32\svchost.exe with process id 4824 stopped the removal or ejection for the device ACPI\PNP0A08\2&daba3ff&0. Process command line: C:\WINDOWS\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc List of affected devices: STORAGE\Volume\{c67841dd-cd1b-11f0-8722-806e6f6e6963}#0000000001100000
|
| | System | Warning | 223 | 2025-11-29 04:49:41 | SYSTEM | Microsoft-Windows-Kernel-PnP | 225: The application \Device\HarddiskVolume2\Windows\System32\svchost.exe with process id 4852 stopped the removal or ejection for the device ACPI\PNP0A08\2&daba3ff&0. Process command line: C:\WINDOWS\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s webthreatdefusersvc List of affected devices: STORAGE\Volume\{c67841dd-cd1b-11f0-8722-806e6f6e6963}#0000000001100000
|
| | System | Warning | 223 | 2025-11-29 04:49:41 | SYSTEM | Microsoft-Windows-Kernel-PnP | 225: The application \Device\HarddiskVolume2\Windows\System32\svchost.exe with process id 4880 stopped the removal or ejection for the device ACPI\PNP0A08\2&daba3ff&0. Process command line: C:\WINDOWS\system32\svchost.exe -k UnistackSvcGroup -s WpnUserService List of affected devices: STORAGE\Volume\{c67841dd-cd1b-11f0-8722-806e6f6e6963}#0000000001100000
|
| | System | Warning | 223 | 2025-11-29 04:49:41 | SYSTEM | Microsoft-Windows-Kernel-PnP | 225: The application \Device\HarddiskVolume2\Windows\System32\svchost.exe with process id 4916 stopped the removal or ejection for the device ACPI\PNP0A08\2&daba3ff&0. Process command line: C:\WINDOWS\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DisplayEnhancementService List of affected devices: STORAGE\Volume\{c67841dd-cd1b-11f0-8722-806e6f6e6963}#0000000001100000
|
| | System | Warning | 223 | 2025-11-29 04:49:41 | SYSTEM | Microsoft-Windows-Kernel-PnP | 225: The application \Device\HarddiskVolume2\Windows\System32\ApplicationFrameHost.exe with process id 4940 stopped the removal or ejection for the device ACPI\PNP0A08\2&daba3ff&0. Process command line: C:\WINDOWS\system32\ApplicationFrameHost.exe -Embedding List of affected devices: STORAGE\Volume\{c67841dd-cd1b-11f0-8722-806e6f6e6963}#0000000001100000
|
| | System | Warning | 223 | 2025-11-29 04:49:41 | SYSTEM | Microsoft-Windows-Kernel-PnP | 225: The application \Device\HarddiskVolume2\Windows\System32\taskhostw.exe with process id 4972 stopped the removal or ejection for the device ACPI\PNP0A08\2&daba3ff&0. Process command line: taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E} List of affected devices: SCSI\Disk&Ven_&Prod_KINGSTON_SV300S3\4&fefddb&0&020000 STORAGE\Volume\{c67841dd-cd1b-11f0-8722-806e6f6e6963}#0000000001100000
|
| | System | Warning | 223 | 2025-11-29 04:49:41 | SYSTEM | Microsoft-Windows-Kernel-PnP | 225: The application \Device\HarddiskVolume2\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe with process id 4996 stopped the removal or ejection for the device ACPI\PNP0A08\2&daba3ff&0. Process command line: "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /c List of affected devices: STORAGE\Volume\{c67841dd-cd1b-11f0-8722-806e6f6e6963}#0000000001100000
|
| | System | Warning | 223 | 2025-11-29 04:49:41 | SYSTEM | Microsoft-Windows-Kernel-PnP | 225: The application \Device\HarddiskVolume2\Windows\System32\svchost.exe with process id 5060 stopped the removal or ejection for the device ACPI\PNP0A08\2&daba3ff&0. Process command line: C:\WINDOWS\system32\svchost.exe -k netsvcs -p -s TokenBroker List of affected devices: STORAGE\Volume\{c67841dd-cd1b-11f0-8722-806e6f6e6963}#0000000001100000
|
| | System | Warning | 223 | 2025-11-29 04:49:41 | SYSTEM | Microsoft-Windows-Kernel-PnP | 225: The application \Device\HarddiskVolume2\Windows\System32\svchost.exe with process id 5164 stopped the removal or ejection for the device ACPI\PNP0A08\2&daba3ff&0. Process command line: C:\WINDOWS\system32\svchost.exe -k LocalService -p -s CDPSvc List of affected devices: STORAGE\Volume\{c67841dd-cd1b-11f0-8722-806e6f6e6963}#0000000001100000
|
| | System | Warning | 223 | 2025-11-29 04:49:41 | SYSTEM | Microsoft-Windows-Kernel-PnP | 225: The application \Device\HarddiskVolume2\Windows\System32\DriverStore\FileRepository\u0417877.inf_amd64_8b2c2b61b3f8a9e5\B417004\atiesrxx.exe with process id 5236 stopped the removal or ejection for the device ACPI\PNP0A08\2&daba3ff&0. Process command line: C:\WINDOWS\System32\DriverStore\FileRepository\u0417877.inf_amd64_8b2c2b61b3f8a9e5\B417004\atiesrxx.exe List of affected devices: STORAGE\Volume\{c67841dd-cd1b-11f0-8722-806e6f6e6963}#0000000001100000
|
| | System | Warning | 223 | 2025-11-29 04:49:41 | SYSTEM | Microsoft-Windows-Kernel-PnP | 225: The application \Device\HarddiskVolume2\Program Files (x86)\Microsoft\Edge\Application\msedge.exe with process id 5352 stopped the removal or ejection for the device ACPI\PNP0A08\2&daba3ff&0. Process command line: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --no-pre-read-main-dll --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1.25 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=44 --time-ticks-at-unix-epoch=-1764419504945837 --launch-time-ticks=168913958 --ssd-no-pressure-read-main-dll --metrics-shmem-handle=4460,i,14233452545960282836,2928249594437128450,2097152 --field-trial-handle=2348,i,4383914887142717900,4649832010531238256,262144 --variations-seed-version --mojo-platform-channel-handle=2620 /prefetch:1 List of affected devices: STORAGE\Volume\{c67841dd-cd1b-11f0-8722-806e6f6e6963}#0000000001100000
|
| | System | Warning | 223 | 2025-11-29 04:49:41 | SYSTEM | Microsoft-Windows-Kernel-PnP | 225: The application \Device\HarddiskVolume2\Windows\System32\svchost.exe with process id 5404 stopped the removal or ejection for the device ACPI\PNP0A08\2&daba3ff&0. Process command line: C:\WINDOWS\system32\svchost.exe -k osprivacy -p -s camsvc List of affected devices: STORAGE\Volume\{c67841dd-cd1b-11f0-8722-806e6f6e6963}#0000000001100000
|
| | System | Warning | 223 | 2025-11-29 04:49:41 | SYSTEM | Microsoft-Windows-Kernel-PnP | 225: The application \Device\HarddiskVolume2\Windows\System32\svchost.exe with process id 5412 stopped the removal or ejection for the device ACPI\PNP0A08\2&daba3ff&0. Process command line: C:\WINDOWS\system32\svchost.exe -k wsappx -p -s AppXSvc List of affected devices: STORAGE\Volume\{c67841dd-cd1b-11f0-8722-806e6f6e6963}#0000000001100000
|
| | System | Warning | 223 | 2025-11-29 04:49:41 | SYSTEM | Microsoft-Windows-Kernel-PnP | 225: The application \Device\HarddiskVolume2\Windows\System32\AggregatorHost.exe with process id 5688 stopped the removal or ejection for the device ACPI\PNP0A08\2&daba3ff&0. Process command line: AggregatorHost.exe List of affected devices: STORAGE\Volume\{c67841dd-cd1b-11f0-8722-806e6f6e6963}#0000000001100000
|
| | System | Warning | 223 | 2025-11-29 04:49:41 | SYSTEM | Microsoft-Windows-Kernel-PnP | 225: The application \Device\HarddiskVolume2\Windows\explorer.exe with process id 5740 stopped the removal or ejection for the device ACPI\PNP0A08\2&daba3ff&0. Process command line: C:\WINDOWS\Explorer.EXE List of affected devices: STORAGE\Volume\{c67841dd-cd1b-11f0-8722-806e6f6e6963}#0000000001100000
|
| | System | Warning | 223 | 2025-11-29 04:49:41 | SYSTEM | Microsoft-Windows-Kernel-PnP | 225: The application \Device\HarddiskVolume2\Windows\servicing\TrustedInstaller.exe with process id 5792 stopped the removal or ejection for the device ACPI\PNP0A08\2&daba3ff&0. Process command line: C:\WINDOWS\servicing\TrustedInstaller.exe List of affected devices: STORAGE\Volume\{c67841dd-cd1b-11f0-8722-806e6f6e6963}#0000000001100000
|
| | System | Warning | 223 | 2025-11-29 04:49:41 | SYSTEM | Microsoft-Windows-Kernel-PnP | 225: The application \Device\HarddiskVolume2\Windows\System32\ShellHost.exe with process id 5796 stopped the removal or ejection for the device ACPI\PNP0A08\2&daba3ff&0. Process command line: "C:\Windows\System32\ShellHost.exe" List of affected devices: STORAGE\Volume\{c67841dd-cd1b-11f0-8722-806e6f6e6963}#0000000001100000
|
| | System | Warning | 223 | 2025-11-29 04:49:41 | SYSTEM | Microsoft-Windows-Kernel-PnP | 225: The application \Device\HarddiskVolume2\Windows\System32\svchost.exe with process id 5908 stopped the removal or ejection for the device ACPI\PNP0A08\2&daba3ff&0. Process command line: C:\WINDOWS\system32\svchost.exe -k netsvcs -p -s Appinfo List of affected devices: STORAGE\Volume\{c67841dd-cd1b-11f0-8722-806e6f6e6963}#0000000001100000
|
| | System | Warning | 223 | 2025-11-29 04:49:41 | SYSTEM | Microsoft-Windows-Kernel-PnP | 225: The application \Device\HarddiskVolume2\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\CrossDeviceResume.exe with process id 6036 stopped the removal or ejection for the device ACPI\PNP0A08\2&daba3ff&0. Process command line: "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\CrossDeviceResume.exe" /tileid MicrosoftWindows.Client.CBS_cw5n1h2txyewy!CrossDeviceResumeApp List of affected devices: STORAGE\Volume\{c67841dd-cd1b-11f0-8722-806e6f6e6963}#0000000001100000
|
| | System | Warning | 223 | 2025-11-29 04:49:41 | SYSTEM | Microsoft-Windows-Kernel-PnP | 225: The application \Device\HarddiskVolume2\Windows\System32\svchost.exe with process id 6128 stopped the removal or ejection for the device ACPI\PNP0A08\2&daba3ff&0. Process command line: C:\WINDOWS\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc List of affected devices: STORAGE\Volume\{c67841dd-cd1b-11f0-8722-806e6f6e6963}#0000000001100000
|
| | System | Warning | 223 | 2025-11-29 04:49:41 | SYSTEM | Microsoft-Windows-Kernel-PnP | 225: The application \Device\HarddiskVolume2\Windows\System32\svchost.exe with process id 6232 stopped the removal or ejection for the device ACPI\PNP0A08\2&daba3ff&0. Process command line: C:\WINDOWS\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s WdiSystemHost List of affected devices: STORAGE\Volume\{c67841dd-cd1b-11f0-8722-806e6f6e6963}#0000000001100000
|
| | System | Warning | 223 | 2025-11-29 04:49:41 | SYSTEM | Microsoft-Windows-Kernel-PnP | 225: The application \Device\HarddiskVolume2\Windows\System32\svchost.exe with process id 6260 stopped the removal or ejection for the device ACPI\PNP0A08\2&daba3ff&0. Process command line: C:\WINDOWS\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s PcaSvc List of affected devices: STORAGE\Volume\{c67841dd-cd1b-11f0-8722-806e6f6e6963}#0000000001100000
|
| | System | Warning | 223 | 2025-11-29 04:49:41 | SYSTEM | Microsoft-Windows-Kernel-PnP | 225: The application \Device\HarddiskVolume2\Windows\System32\svchost.exe with process id 6364 stopped the removal or ejection for the device ACPI\PNP0A08\2&daba3ff&0. Process command line: C:\WINDOWS\System32\svchost.exe -k LocalService -p -s LicenseManager List of affected devices: STORAGE\Volume\{c67841dd-cd1b-11f0-8722-806e6f6e6963}#0000000001100000
|
| | System | Warning | 223 | 2025-11-29 04:49:41 | SYSTEM | Microsoft-Windows-Kernel-PnP | 225: The application \Device\HarddiskVolume2\Windows\System32\svchost.exe with process id 6440 stopped the removal or ejection for the device ACPI\PNP0A08\2&daba3ff&0. Process command line: C:\WINDOWS\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc List of affected devices: STORAGE\Volume\{c67841dd-cd1b-11f0-8722-806e6f6e6963}#0000000001100000
|
| | System | Warning | 223 | 2025-11-29 04:49:41 | SYSTEM | Microsoft-Windows-Kernel-PnP | 225: The application \Device\HarddiskVolume2\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe with process id 6792 stopped the removal or ejection for the device ACPI\PNP0A08\2&daba3ff&0. Process command line: "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca List of affected devices: STORAGE\Volume\{c67841dd-cd1b-11f0-8722-806e6f6e6963}#0000000001100000
|
| | System | Warning | 223 | 2025-11-29 04:49:41 | SYSTEM | Microsoft-Windows-Kernel-PnP | 225: The application \Device\HarddiskVolume2\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe with process id 6816 stopped the removal or ejection for the device ACPI\PNP0A08\2&daba3ff&0. Process command line: "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca List of affected devices: STORAGE\Volume\{c67841dd-cd1b-11f0-8722-806e6f6e6963}#0000000001100000
|
| | System | Warning | 223 | 2025-11-29 04:49:41 | SYSTEM | Microsoft-Windows-Kernel-PnP | 225: The application \Device\HarddiskVolume2\Windows\System32\RuntimeBroker.exe with process id 7004 stopped the removal or ejection for the device ACPI\PNP0A08\2&daba3ff&0. Process command line: C:\Windows\System32\RuntimeBroker.exe -Embedding List of affected devices: STORAGE\Volume\{c67841dd-cd1b-11f0-8722-806e6f6e6963}#0000000001100000
|
| | System | Warning | 223 | 2025-11-29 04:49:41 | SYSTEM | Microsoft-Windows-Kernel-PnP | 225: The application \Device\HarddiskVolume2\Windows\System32\svchost.exe with process id 7096 stopped the removal or ejection for the device ACPI\PNP0A08\2&daba3ff&0. Process command line: C:\WINDOWS\system32\svchost.exe -k UdkSvcGroup -s UdkUserSvc List of affected devices: STORAGE\Volume\{c67841dd-cd1b-11f0-8722-806e6f6e6963}#0000000001100000
|
| | System | Warning | 223 | 2025-11-29 04:49:41 | SYSTEM | Microsoft-Windows-Kernel-PnP | 225: The application \Device\HarddiskVolume2\Windows\System32\RuntimeBroker.exe with process id 7116 stopped the removal or ejection for the device ACPI\PNP0A08\2&daba3ff&0. Process command line: C:\Windows\System32\RuntimeBroker.exe -Embedding List of affected devices: STORAGE\Volume\{c67841dd-cd1b-11f0-8722-806e6f6e6963}#0000000001100000
|
| | System | Warning | 223 | 2025-11-29 04:49:41 | SYSTEM | Microsoft-Windows-Kernel-PnP | 225: The application \Device\HarddiskVolume2\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.5074_none_a5532eb7772ad4c4\TiWorker.exe with process id 7208 stopped the removal or ejection for the device ACPI\PNP0A08\2&daba3ff&0. Process command line: C:\WINDOWS\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.5074_none_a5532eb7772ad4c4\TiWorker.exe -Embedding List of affected devices: STORAGE\Volume\{c67841dd-cd1b-11f0-8722-806e6f6e6963}#0000000001100000
|
| | System | Warning | 223 | 2025-11-29 04:49:41 | SYSTEM | Microsoft-Windows-Kernel-PnP | 225: The application \Device\HarddiskVolume2\Windows\System32\svchost.exe with process id 7336 stopped the removal or ejection for the device ACPI\PNP0A08\2&daba3ff&0. Process command line: C:\WINDOWS\system32\svchost.exe -k whesvc -p -s whesvc List of affected devices: STORAGE\Volume\{c67841dd-cd1b-11f0-8722-806e6f6e6963}#0000000001100000
|
| | System | Warning | 223 | 2025-11-29 04:49:41 | SYSTEM | Microsoft-Windows-Kernel-PnP | 225: The application \Device\HarddiskVolume2\Windows\System32\svchost.exe with process id 7404 stopped the removal or ejection for the device ACPI\PNP0A08\2&daba3ff&0. Process command line: C:\WINDOWS\System32\svchost.exe -k NetworkService -p List of affected devices: STORAGE\Volume\{c67841dd-cd1b-11f0-8722-806e6f6e6963}#0000000001100000
|
| | System | Warning | 223 | 2025-11-29 04:49:41 | SYSTEM | Microsoft-Windows-Kernel-PnP | 225: The application \Device\HarddiskVolume2\Program Files\Windows Defender\NisSrv.exe with process id 7660 stopped the removal or ejection for the device ACPI\PNP0A08\2&daba3ff&0. Process command line: "C:\Program Files\Windows Defender\NisSrv.exe" List of affected devices: STORAGE\Volume\{c67841dd-cd1b-11f0-8722-806e6f6e6963}#0000000001100000
|
| | System | Warning | 223 | 2025-11-29 04:49:41 | SYSTEM | Microsoft-Windows-Kernel-PnP | 225: The application \Device\HarddiskVolume2\Windows\System32\ctfmon.exe with process id 8060 stopped the removal or ejection for the device ACPI\PNP0A08\2&daba3ff&0. Process command line: /QuitInfo:0000000000000284;0000000000000288; List of affected devices: STORAGE\Volume\{c67841dd-cd1b-11f0-8722-806e6f6e6963}#0000000001100000
|
| | System | Warning | 223 | 2025-11-29 04:49:41 | SYSTEM | Microsoft-Windows-Kernel-PnP | 225: The application \Device\HarddiskVolume2\Windows\System32\svchost.exe with process id 8156 stopped the removal or ejection for the device ACPI\PNP0A08\2&daba3ff&0. Process command line: C:\WINDOWS\System32\svchost.exe -k LocalSystemNetworkRestricted -p List of affected devices: STORAGE\Volume\{c67841dd-cd1b-11f0-8722-806e6f6e6963}#0000000001100000
|
| | System | Warning | 223 | 2025-11-29 04:49:41 | SYSTEM | Microsoft-Windows-Kernel-PnP | 225: The application \Device\HarddiskVolume2\Program Files (x86)\Microsoft\EdgeWebView\Application\140.0.3485.66\msedgewebview2.exe with process id 8196 stopped the removal or ejection for the device ACPI\PNP0A08\2&daba3ff&0. Process command line: "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\140.0.3485.66\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\CogiArt\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\LocalState\EBWebView /prefetch:4 /pfhostedapp:b239454542aeb4426687a343f2ad9726df39e1a8 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\CogiArt\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\LocalState\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=140.0.7339.133 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\140.0.3485.66\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=140.0.3485.66 --initial-client-data=0x178,0x17c,0x180,0x138,0x188,0x7fff2c8a2200,0x7fff2c8a220c,0x7fff2c8a2218 List of affected devices: STORAGE\Volume\{c67841dd-cd1b-11f0-8722-806e6f6e6963}#0000000001100000
|
| | System | Warning | 223 | 2025-11-29 04:49:41 | SYSTEM | Microsoft-Windows-Kernel-PnP | 225: The application \Device\HarddiskVolume2\Program Files (x86)\Microsoft\EdgeWebView\Application\140.0.3485.66\msedgewebview2.exe with process id 8448 stopped the removal or ejection for the device ACPI\PNP0A08\2&daba3ff&0. Process command line: "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\140.0.3485.66\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64; Cortana 1.18.9.23723; 10.0.0.0.26200.6584) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.26200 IsWebView2/True (WebView2Version 140.0.3485.66)" --user-data-dir="C:\Users\CogiArt\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\LocalState\EBWebView" --webview-exe-name=SearchHost.exe --webview-exe-version=2125.21002.10.0 --embedded-browser-webview=1 --no-pre-read-main-dll --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1680,i,2146040270215223487,1041600286210841220,262144 --field-trial-handle=1844,i,6697581408194740510,13859916280955955461,262144 --enable-features=ForceSWDCompWhenDCompFallbackRequired,msAggressiveCacheTrimming,msCustomDataPartition,msEdgeFluentOverlayScrollbar,msWebView2NoTabForScreenShare,msWebViewAppLifeCycleWorkaround --disable-features=BackForwardCache,BackgroundTabLoadingFromPerformanceManager,CloseOmniboxPopupOnInactiveAreaClick,CollectAVProductsInfo,CollectCodeIntegrityInfo,EnableHangWatcher,FilterAdsOnAbusiveSites,GetWifiProtocol,LoginDetection,MediaFoundationCameraUsageMonitoring,PreconnectToSearch,SafetyHub,SegmentationPlatform,SpareRendererForSitePerProcess,Ukm,WebPayments,msAITrackerClassification,msAbydosForWindowlessWV2,msAffirmVirtualCard,msAllowChromeWebstore,msAllowMSAPrtSSOForNonMSAProfile,msApplicationGuard,msAskBeforeClosingMultipleTabs,msAutoToggleAADPrtSSOForNonAADProfile,msAutofillEdgeCoupons,msAutofillEdgeCouponsAutoApply,msAutofillEdgeServiceRequest,msAutofillEnableEdgeSuggestions,msAutomaticTabFreeze,msBrowserSettingsSupported,msCoarseGeolocationService,msDataProtection,msDesktopMode,msDesktopRewards,msDisableVariationsSeedFetchThrottling,msEEProactiveHistory,msETFOffstoreExtensionFileDataCollection,msETFPasswordTheftDNRActionSignals,msEdgeAdPlatformUI,msEdgeAddWebCapturetoCollections,msEdgeAutofillShowDeployedPassword,msEdgeCaptureSelectionInPDF,msEdgeCloudConfigService,msEdgeCloudConfigServiceV2,msEdgeCohorts,msEdgeCollectionsPrismExperiment1,msEdgeCollectionsPrismOverallMigration,msEdgeComposeNext,msEdgeEnableNurturingFramework,msEdgeEnclavePrefsBasic,msEdgeEnclavePrefsNotification,msEdgeFaviconService,msEdgeHJTelemetry,msEdgeHubAppSkype,msEdgeImageEditorUI,msEdgeLinkDoctor,msEdgeMouseGestureDefaultEnabled,msEdgeMouseGestureSupported,msEdgeNewDeviceFre,msEdgeOnRampFRE,msEdgeOnRampImport,msEdgePDFCMHighlightUX,msEdgePasswordIris,msEdgePasswordIrisSaveBubble,msEdgeProngPersonalization,msEdgeReadingView,msEdgeRose,msEdgeScreenshotUI,msEdgeSendTabToSelf,msEdgeSettingsImport,msEdgeSettingsImportV2,msEdgeShoppingPersistentStorage,msEdgeShoppingUI,msEdgeSmartFind,msEdgeSuperDragDefaultEnabled,msEdgeSuperDragDropSupported,msEdgeTranslate,msEdgeUpdatesMoreMenuPill,msEdgeWebCapture,msEdgeWebCaptureUniformExperience,msEdgeWebContentFilteringFeedback,msEdgeWorkSearchBanner,msEnableCustomJobMemoryLimitsOnXbox,msEnableMIPForPDF,msEnablePdfUpsell,msEnableThirdPartyScanning,msEnableWebSignInCta,msEnableWebToBrowserSignIn,msEndpointDlp,msEntityExtraction,msExtensionTelemetryFramework,msExternalTaskManager,msFileSystemAccessDirectoryIterationBlocklistCheck,msForceBrowserSignIn,msForeignSessionsPage,msGeolocationAccessService,msGeolocationOSLocationPermissionFallback,msGeolocationSQMService,msGeolocationService,msGrowthInfraLaunchSourceLogging,msGuidedSwitchAllowed,msHubPinPersist,msImplicitSignin,msIrm,msIrmv2,msKlarnaVirtualCard,msLlmConsumerDlpPurview,msLoadStatistics,msLogIsEdgePinnedToTaskbarOnLaunch,msMIPCrossTenantPdfViewSupport,msMdatpWebSiteDlp,msNotificationPermissionForPWA,msNumberOfSitesToPin,msNurturingGlobalSitePinningOnCloseModal,msNurturingSitePinningCITopSites,msNurturingSitePinningWithWindowsConsent,msOnHoverSearchInSidebar,msOpenOfficeDocumentsInWebViewer,msPageInteractionRestrictionRevoke,msPasswordBreachDetection,msPdfAnnotationsVisibility,msPdfDataRecovery,msPdfDigitalSignatureRead,msPdfFreeText,msPdfFreeTextForCJK,msPdfHighlightMode,msPdfInking,msPdfKeyphraseSupport,msPdfOOUI,msPdfPopupMarkerRenderer,msPdfShare,msPdfSharedLibrary,msPdfTextNote,msPdfTextNoteMoreMenu,msPdfThumbnailCache,msPdfUnderside,msPdfViewRestore,msPersonalizationUMA,msPriceComparison,msPrintInWebView2,msPromptDefaultHandlerForPDF,msReactiveSearch,msReadAloud,msReadAloudPdf,msRedirectToShoreline,msRevokeExtensions,msSaasDlp,msShoppingTrigger,msShorelineSearch,msShorelineSearchFindOnPageWebUI,msShowOfflineGameEntrance,msShowReadAloudIconInAddressBar,msShowUXForAADPrtSSOForNonAADProfile,msSitePinningWithoutUi,msSmartScreenProtection,msSuspendMessageForNewSessionWhenHavingPendingNavigation,msSyncEdgeCollections,msTabResourceStats,msTokenizationAutofillInlineEnabled,msTouchMode,msTriggeringSignalGenerator,msUserUnderstanding,msVideoSuperResolutionUI,msWalletBuyNow,msWalletCheckout,msWalletDiagnosticDataLogger,msWalletHubEntry,msWalletHubIntlP3,msWalletPartialCard,msWalletPasswordCategorization,msWalletPasswordCategorizationPlatformExpansion,msWalletTokenizationCardMetadata,msWalletTokenizedAutofill,msWebAssist,msWebAssistHistorySearchService,msWebOOUI,msWindowsTaskManager,msWindowsUserActivities,msZipPayVirtualCard --variations-seed-version --mojo-platform-channel-handle=1832 /prefetch:2 /pfhostedapp:b239454542aeb4426687a343f2ad9726df39e1a8 List of affected devices: STORAGE\Volume\{c67841dd-cd1b-11f0-8722-806e6f6e6963}#0000000001100000
|
| | System | Warning | 223 | 2025-11-29 04:49:41 | SYSTEM | Microsoft-Windows-Kernel-PnP | 225: The application \Device\HarddiskVolume2\Program Files (x86)\Microsoft\EdgeWebView\Application\140.0.3485.66\msedgewebview2.exe with process id 8544 stopped the removal or ejection for the device ACPI\PNP0A08\2&daba3ff&0. Process command line: "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\140.0.3485.66\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64; Cortana 1.18.9.23723; 10.0.0.0.26200.6584) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.26200 IsWebView2/True (WebView2Version 140.0.3485.66)" --user-data-dir="C:\Users\CogiArt\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\LocalState\EBWebView" --webview-exe-name=SearchHost.exe --webview-exe-version=2125.21002.10.0 --embedded-browser-webview=1 --always-read-main-dll --metrics-shmem-handle=2176,i,12606121700463249393,6780851667607998830,524288 --field-trial-handle=1844,i,6697581408194740510,13859916280955955461,262144 --enable-features=ForceSWDCompWhenDCompFallbackRequired,msAggressiveCacheTrimming,msCustomDataPartition,msEdgeFluentOverlayScrollbar,msWebView2NoTabForScreenShare,msWebViewAppLifeCycleWorkaround --disable-features=BackForwardCache,BackgroundTabLoadingFromPerformanceManager,CloseOmniboxPopupOnInactiveAreaClick,CollectAVProductsInfo,CollectCodeIntegrityInfo,EnableHangWatcher,FilterAdsOnAbusiveSites,GetWifiProtocol,LoginDetection,MediaFoundationCameraUsageMonitoring,PreconnectToSearch,SafetyHub,SegmentationPlatform,SpareRendererForSitePerProcess,Ukm,WebPayments,msAITrackerClassification,msAbydosForWindowlessWV2,msAffirmVirtualCard,msAllowChromeWebstore,msAllowMSAPrtSSOForNonMSAProfile,msApplicationGuard,msAskBeforeClosingMultipleTabs,msAutoToggleAADPrtSSOForNonAADProfile,msAutofillEdgeCoupons,msAutofillEdgeCouponsAutoApply,msAutofillEdgeServiceRequest,msAutofillEnableEdgeSuggestions,msAutomaticTabFreeze,msBrowserSettingsSupported,msCoarseGeolocationService,msDataProtection,msDesktopMode,msDesktopRewards,msDisableVariationsSeedFetchThrottling,msEEProactiveHistory,msETFOffstoreExtensionFileDataCollection,msETFPasswordTheftDNRActionSignals,msEdgeAdPlatformUI,msEdgeAddWebCapturetoCollections,msEdgeAutofillShowDeployedPassword,msEdgeCaptureSelectionInPDF,msEdgeCloudConfigService,msEdgeCloudConfigServiceV2,msEdgeCohorts,msEdgeCollectionsPrismExperiment1,msEdgeCollectionsPrismOverallMigration,msEdgeComposeNext,msEdgeEnableNurturingFramework,msEdgeEnclavePrefsBasic,msEdgeEnclavePrefsNotification,msEdgeFaviconService,msEdgeHJTelemetry,msEdgeHubAppSkype,msEdgeImageEditorUI,msEdgeLinkDoctor,msEdgeMouseGestureDefaultEnabled,msEdgeMouseGestureSupported,msEdgeNewDeviceFre,msEdgeOnRampFRE,msEdgeOnRampImport,msEdgePDFCMHighlightUX,msEdgePasswordIris,msEdgePasswordIrisSaveBubble,msEdgeProngPersonalization,msEdgeReadingView,msEdgeRose,msEdgeScreenshotUI,msEdgeSendTabToSelf,msEdgeSettingsImport,msEdgeSettingsImportV2,msEdgeShoppingPersistentStorage,msEdgeShoppingUI,msEdgeSmartFind,msEdgeSuperDragDefaultEnabled,msEdgeSuperDragDropSupported,msEdgeTranslate,msEdgeUpdatesMoreMenuPill,msEdgeWebCapture,msEdgeWebCaptureUniformExperience,msEdgeWebContentFilteringFeedback,msEdgeWorkSearchBanner,msEnableCustomJobMemoryLimitsOnXbox,msEnableMIPForPDF,msEnablePdfUpsell,msEnableThirdPartyScanning,msEnableWebSignInCta,msEnableWebToBrowserSignIn,msEndpointDlp,msEntityExtraction,msExtensionTelemetryFramework,msExternalTaskManager,msFileSystemAccessDirectoryIterationBlocklistCheck,msForceBrowserSignIn,msForeignSessionsPage,msGeolocationAccessService,msGeolocationOSLocationPermissionFallback,msGeolocationSQMService,msGeolocationService,msGrowthInfraLaunchSourceLogging,msGuidedSwitchAllowed,msHubPinPersist,msImplicitSignin,msIrm,msIrmv2,msKlarnaVirtualCard,msLlmConsumerDlpPurview,msLoadStatistics,msLogIsEdgePinnedToTaskbarOnLaunch,msMIPCrossTenantPdfViewSupport,msMdatpWebSiteDlp,msNotificationPermissionForPWA,msNumberOfSitesToPin,msNurturingGlobalSitePinningOnCloseModal,msNurturingSitePinningCITopSites,msNurturingSitePinningWithWindowsConsent,msOnHoverSearchInSidebar,msOpenOfficeDocumentsInWebViewer,msPageInteractionRestrictionRevoke,msPasswordBreachDetection,msPdfAnnotationsVisibility,msPdfDataRecovery,msPdfDigitalSignatureRead,msPdfFreeText,msPdfFreeTextForCJK,msPdfHighlightMode,msPdfInking,msPdfKeyphraseSupport,msPdfOOUI,msPdfPopupMarkerRenderer,msPdfShare,msPdfSharedLibrary,msPdfTextNote,msPdfTextNoteMoreMenu,msPdfThumbnailCache,msPdfUnderside,msPdfViewRestore,msPersonalizationUMA,msPriceComparison,msPrintInWebView2,msPromptDefaultHandlerForPDF,msReactiveSearch,msReadAloud,msReadAloudPdf,msRedirectToShoreline,msRevokeExtensions,msSaasDlp,msShoppingTrigger,msShorelineSearch,msShorelineSearchFindOnPageWebUI,msShowOfflineGameEntrance,msShowReadAloudIconInAddressBar,msShowUXForAADPrtSSOForNonAADProfile,msSitePinningWithoutUi,msSmartScreenProtection,msSuspendMessageForNewSessionWhenHavingPendingNavigation,msSyncEdgeCollections,msTabResourceStats,msTokenizationAutofillInlineEnabled,msTouchMode,msTriggeringSignalGenerator,msUserUnderstanding,msVideoSuperResolutionUI,msWalletBuyNow,msWalletCheckout,msWalletDiagnosticDataLogger,msWalletHubEntry,msWalletHubIntlP3,msWalletPartialCard,msWalletPasswordCategorization,msWalletPasswordCategorizationPlatformExpansion,msWalletTokenizationCardMetadata,msWalletTokenizedAutofill,msWebAssist,msWebAssistHistorySearchService,msWebOOUI,msWindowsTaskManager,msWindowsUserActivities,msZipPayVirtualCard --variations-seed-version --mojo-platform-channel-handle=2164 /prefetch:11 /pfhostedapp:b239454542aeb4426687a343f2ad9726df39e1a8 List of affected devices: STORAGE\Volume\{c67841dd-cd1b-11f0-8722-806e6f6e6963}#0000000001100000
|
| | System | Warning | 223 | 2025-11-29 04:49:41 | SYSTEM | Microsoft-Windows-Kernel-PnP | 225: The application \Device\HarddiskVolume2\Program Files (x86)\Microsoft\EdgeWebView\Application\140.0.3485.66\msedgewebview2.exe with process id 8672 stopped the removal or ejection for the device ACPI\PNP0A08\2&daba3ff&0. Process command line: "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\140.0.3485.66\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64; Cortana 1.18.9.23723; 10.0.0.0.26200.6584) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.26200 IsWebView2/True (WebView2Version 140.0.3485.66)" --user-data-dir="C:\Users\CogiArt\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\LocalState\EBWebView" --webview-exe-name=SearchHost.exe --webview-exe-version=2125.21002.10.0 --embedded-browser-webview=1 --always-read-main-dll --metrics-shmem-handle=2476,i,6803141820668948687,5530864620902532028,524288 --field-trial-handle=1844,i,6697581408194740510,13859916280955955461,262144 --enable-features=ForceSWDCompWhenDCompFallbackRequired,msAggressiveCacheTrimming,msCustomDataPartition,msEdgeFluentOverlayScrollbar,msWebView2NoTabForScreenShare,msWebViewAppLifeCycleWorkaround --disable-features=BackForwardCache,BackgroundTabLoadingFromPerformanceManager,CloseOmniboxPopupOnInactiveAreaClick,CollectAVProductsInfo,CollectCodeIntegrityInfo,EnableHangWatcher,FilterAdsOnAbusiveSites,GetWifiProtocol,LoginDetection,MediaFoundationCameraUsageMonitoring,PreconnectToSearch,SafetyHub,SegmentationPlatform,SpareRendererForSitePerProcess,Ukm,WebPayments,msAITrackerClassification,msAbydosForWindowlessWV2,msAffirmVirtualCard,msAllowChromeWebstore,msAllowMSAPrtSSOForNonMSAProfile,msApplicationGuard,msAskBeforeClosingMultipleTabs,msAutoToggleAADPrtSSOForNonAADProfile,msAutofillEdgeCoupons,msAutofillEdgeCouponsAutoApply,msAutofillEdgeServiceRequest,msAutofillEnableEdgeSuggestions,msAutomaticTabFreeze,msBrowserSettingsSupported,msCoarseGeolocationService,msDataProtection,msDesktopMode,msDesktopRewards,msDisableVariationsSeedFetchThrottling,msEEProactiveHistory,msETFOffstoreExtensionFileDataCollection,msETFPasswordTheftDNRActionSignals,msEdgeAdPlatformUI,msEdgeAddWebCapturetoCollections,msEdgeAutofillShowDeployedPassword,msEdgeCaptureSelectionInPDF,msEdgeCloudConfigService,msEdgeCloudConfigServiceV2,msEdgeCohorts,msEdgeCollectionsPrismExperiment1,msEdgeCollectionsPrismOverallMigration,msEdgeComposeNext,msEdgeEnableNurturingFramework,msEdgeEnclavePrefsBasic,msEdgeEnclavePrefsNotification,msEdgeFaviconService,msEdgeHJTelemetry,msEdgeHubAppSkype,msEdgeImageEditorUI,msEdgeLinkDoctor,msEdgeMouseGestureDefaultEnabled,msEdgeMouseGestureSupported,msEdgeNewDeviceFre,msEdgeOnRampFRE,msEdgeOnRampImport,msEdgePDFCMHighlightUX,msEdgePasswordIris,msEdgePasswordIrisSaveBubble,msEdgeProngPersonalization,msEdgeReadingView,msEdgeRose,msEdgeScreenshotUI,msEdgeSendTabToSelf,msEdgeSettingsImport,msEdgeSettingsImportV2,msEdgeShoppingPersistentStorage,msEdgeShoppingUI,msEdgeSmartFind,msEdgeSuperDragDefaultEnabled,msEdgeSuperDragDropSupported,msEdgeTranslate,msEdgeUpdatesMoreMenuPill,msEdgeWebCapture,msEdgeWebCaptureUniformExperience,msEdgeWebContentFilteringFeedback,msEdgeWorkSearchBanner,msEnableCustomJobMemoryLimitsOnXbox,msEnableMIPForPDF,msEnablePdfUpsell,msEnableThirdPartyScanning,msEnableWebSignInCta,msEnableWebToBrowserSignIn,msEndpointDlp,msEntityExtraction,msExtensionTelemetryFramework,msExternalTaskManager,msFileSystemAccessDirectoryIterationBlocklistCheck,msForceBrowserSignIn,msForeignSessionsPage,msGeolocationAccessService,msGeolocationOSLocationPermissionFallback,msGeolocationSQMService,msGeolocationService,msGrowthInfraLaunchSourceLogging,msGuidedSwitchAllowed,msHubPinPersist,msImplicitSignin,msIrm,msIrmv2,msKlarnaVirtualCard,msLlmConsumerDlpPurview,msLoadStatistics,msLogIsEdgePinnedToTaskbarOnLaunch,msMIPCrossTenantPdfViewSupport,msMdatpWebSiteDlp,msNotificationPermissionForPWA,msNumberOfSitesToPin,msNurturingGlobalSitePinningOnCloseModal,msNurturingSitePinningCITopSites,msNurturingSitePinningWithWindowsConsent,msOnHoverSearchInSidebar,msOpenOfficeDocumentsInWebViewer,msPageInteractionRestrictionRevoke,msPasswordBreachDetection,msPdfAnnotationsVisibility,msPdfDataRecovery,msPdfDigitalSignatureRead,msPdfFreeText,msPdfFreeTextForCJK,msPdfHighlightMode,msPdfInking,msPdfKeyphraseSupport,msPdfOOUI,msPdfPopupMarkerRenderer,msPdfShare,msPdfSharedLibrary,msPdfTextNote,msPdfTextNoteMoreMenu,msPdfThumbnailCache,msPdfUnderside,msPdfViewRestore,msPersonalizationUMA,msPriceComparison,msPrintInWebView2,msPromptDefaultHandlerForPDF,msReactiveSearch,msReadAloud,msReadAloudPdf,msRedirectToShoreline,msRevokeExtensions,msSaasDlp,msShoppingTrigger,msShorelineSearch,msShorelineSearchFindOnPageWebUI,msShowOfflineGameEntrance,msShowReadAloudIconInAddressBar,msShowUXForAADPrtSSOForNonAADProfile,msSitePinningWithoutUi,msSmartScreenProtection,msSuspendMessageForNewSessionWhenHavingPendingNavigation,msSyncEdgeCollections,msTabResourceStats,msTokenizationAutofillInlineEnabled,msTouchMode,msTriggeringSignalGenerator,msUserUnderstanding,msVideoSuperResolutionUI,msWalletBuyNow,msWalletCheckout,msWalletDiagnosticDataLogger,msWalletHubEntry,msWalletHubIntlP3,msWalletPartialCard,msWalletPasswordCategorization,msWalletPasswordCategorizationPlatformExpansion,msWalletTokenizationCardMetadata,msWalletTokenizedAutofill,msWebAssist,msWebAssistHistorySearchService,msWebOOUI,msWindowsTaskManager,msWindowsUserActivities,msZipPayVirtualCard --variations-seed-version --mojo-platform-channel-handle=2488 /prefetch:13 /pfhostedapp:b239454542aeb4426687a343f2ad9726df39e1a8 List of affected devices: STORAGE\Volume\{c67841dd-cd1b-11f0-8722-806e6f6e6963}#0000000001100000
|
| | System | Warning | 223 | 2025-11-29 04:49:41 | SYSTEM | Microsoft-Windows-Kernel-PnP | 225: The application \Device\HarddiskVolume2\Windows\System32\svchost.exe with process id 8904 stopped the removal or ejection for the device ACPI\PNP0A08\2&daba3ff&0. Process command line: C:\WINDOWS\system32\svchost.exe -k LocalService -p -s NPSMSvc List of affected devices: STORAGE\Volume\{c67841dd-cd1b-11f0-8722-806e6f6e6963}#0000000001100000
|
| | System | Warning | 223 | 2025-11-29 04:49:41 | SYSTEM | Microsoft-Windows-Kernel-PnP | 225: The application \Device\HarddiskVolume2\Windows\System32\svchost.exe with process id 9208 stopped the removal or ejection for the device ACPI\PNP0A08\2&daba3ff&0. Process command line: C:\WINDOWS\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts List of affected devices: STORAGE\Volume\{c67841dd-cd1b-11f0-8722-806e6f6e6963}#0000000001100000
|
| | System | Warning | 223 | 2025-11-29 04:49:41 | SYSTEM | Microsoft-Windows-Kernel-PnP | 225: The application \Device\HarddiskVolume2\Windows\System32\SearchIndexer.exe with process id 9292 stopped the removal or ejection for the device ACPI\PNP0A08\2&daba3ff&0. Process command line: C:\WINDOWS\system32\SearchIndexer.exe /Embedding List of affected devices: STORAGE\Volume\{c67841dd-cd1b-11f0-8722-806e6f6e6963}#0000000001100000
|
| | System | Warning | 223 | 2025-11-29 04:49:41 | SYSTEM | Microsoft-Windows-Kernel-PnP | 225: The application \Device\HarddiskVolume2\Program Files (x86)\Microsoft\Edge\Application\msedge.exe with process id 9308 stopped the removal or ejection for the device ACPI\PNP0A08\2&daba3ff&0. Process command line: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --no-pre-read-main-dll --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1.25 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --time-ticks-at-unix-epoch=-1764419504945837 --launch-time-ticks=117745552 --skip-read-main-dll --metrics-shmem-handle=8260,i,1647140191953158479,2709063737171939114,2097152 --field-trial-handle=2348,i,4383914887142717900,4649832010531238256,262144 --variations-seed-version --mojo-platform-channel-handle=8244 /prefetch:1 List of affected devices: STORAGE\Volume\{c67841dd-cd1b-11f0-8722-806e6f6e6963}#0000000001100000
|
| | System | Warning | 223 | 2025-11-29 04:49:41 | SYSTEM | Microsoft-Windows-Kernel-PnP | 225: The application \Device\HarddiskVolume2\Program Files (x86)\Microsoft\Edge\Application\msedge.exe with process id 9472 stopped the removal or ejection for the device ACPI\PNP0A08\2&daba3ff&0. Process command line: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --no-pre-read-main-dll --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1.25 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --time-ticks-at-unix-epoch=-1764419504945837 --launch-time-ticks=115995249 --skip-read-main-dll --metrics-shmem-handle=5564,i,6162628953556025520,8274258594588635617,2097152 --field-trial-handle=2348,i,4383914887142717900,4649832010531238256,262144 --variations-seed-version --mojo-platform-channel-handle=5676 /prefetch:1 List of affected devices: STORAGE\Volume\{c67841dd-cd1b-11f0-8722-806e6f6e6963}#0000000001100000
|
| | System | Warning | 223 | 2025-11-29 04:49:41 | SYSTEM | Microsoft-Windows-Kernel-PnP | 225: The application \Device\HarddiskVolume2\Windows\System32\smartscreen.exe with process id 9568 stopped the removal or ejection for the device ACPI\PNP0A08\2&daba3ff&0. Process command line: C:\Windows\System32\smartscreen.exe -Embedding List of affected devices: STORAGE\Volume\{c67841dd-cd1b-11f0-8722-806e6f6e6963}#0000000001100000
|
| | System | Warning | 223 | 2025-11-29 04:49:41 | SYSTEM | Microsoft-Windows-Kernel-PnP | 225: The application \Device\HarddiskVolume2\Windows\System32\SecurityHealthSystray.exe with process id 9676 stopped the removal or ejection for the device ACPI\PNP0A08\2&daba3ff&0. Process command line: "C:\Windows\System32\SecurityHealthSystray.exe" List of affected devices: STORAGE\Volume\{c67841dd-cd1b-11f0-8722-806e6f6e6963}#0000000001100000
|
| | System | Warning | 223 | 2025-11-29 04:49:41 | SYSTEM | Microsoft-Windows-Kernel-PnP | 225: The application \Device\HarddiskVolume2\Windows\System32\SecurityHealthService.exe with process id 9696 stopped the removal or ejection for the device ACPI\PNP0A08\2&daba3ff&0. Process command line: C:\WINDOWS\system32\SecurityHealthService.exe List of affected devices: STORAGE\Volume\{c67841dd-cd1b-11f0-8722-806e6f6e6963}#0000000001100000
|
| | System | Warning | 223 | 2025-11-29 04:49:41 | SYSTEM | Microsoft-Windows-Kernel-PnP | 225: The application \Device\HarddiskVolume2\Program Files (x86)\Microsoft\Edge\Application\msedge.exe with process id 9760 stopped the removal or ejection for the device ACPI\PNP0A08\2&daba3ff&0. Process command line: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start List of affected devices: STORAGE\Volume\{c67841dd-cd1b-11f0-8722-806e6f6e6963}#0000000001100000
|
| | System | Warning | 223 | 2025-11-29 04:49:41 | SYSTEM | Microsoft-Windows-Kernel-PnP | 225: The application \Device\HarddiskVolume2\Program Files (x86)\Microsoft\Edge\Application\msedge.exe with process id 9796 stopped the removal or ejection for the device ACPI\PNP0A08\2&daba3ff&0. Process command line: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\CogiArt\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\CogiArt\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=140.0.7339.133 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=140.0.3485.66 --initial-client-data=0x26c,0x270,0x274,0x268,0x27c,0x7fff2c8a2200,0x7fff2c8a220c,0x7fff2c8a2218 List of affected devices: STORAGE\Volume\{c67841dd-cd1b-11f0-8722-806e6f6e6963}#0000000001100000
|
| | System | Warning | 223 | 2025-11-29 04:49:41 | SYSTEM | Microsoft-Windows-Kernel-PnP | 225: The application \Device\HarddiskVolume2\Program Files (x86)\Microsoft\Edge\Application\msedge.exe with process id 10000 stopped the removal or ejection for the device ACPI\PNP0A08\2&daba3ff&0. Process command line: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --startup-read-main-dll --metrics-shmem-handle=2092,i,4887180018940892193,14466571100499298652,262144 --field-trial-handle=2348,i,4383914887142717900,4649832010531238256,262144 --variations-seed-version --mojo-platform-channel-handle=2316 /prefetch:2 List of affected devices: STORAGE\Volume\{c67841dd-cd1b-11f0-8722-806e6f6e6963}#0000000001100000
|
| | System | Warning | 223 | 2025-11-29 04:49:41 | SYSTEM | Microsoft-Windows-Kernel-PnP | 225: The application \Device\HarddiskVolume2\Program Files (x86)\Microsoft\Edge\Application\msedge.exe with process id 10008 stopped the removal or ejection for the device ACPI\PNP0A08\2&daba3ff&0. Process command line: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --startup-read-main-dll --metrics-shmem-handle=2380,i,10255135448204520466,12585701750255230017,524288 --field-trial-handle=2348,i,4383914887142717900,4649832010531238256,262144 --variations-seed-version --mojo-platform-channel-handle=2496 /prefetch:11 List of affected devices: STORAGE\Volume\{c67841dd-cd1b-11f0-8722-806e6f6e6963}#0000000001100000
|
| | System | Warning | 223 | 2025-11-29 04:49:41 | SYSTEM | Microsoft-Windows-Kernel-PnP | 225: The application \Device\HarddiskVolume2\Program Files (x86)\Microsoft\Edge\Application\msedge.exe with process id 10068 stopped the removal or ejection for the device ACPI\PNP0A08\2&daba3ff&0. Process command line: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --startup-read-main-dll --metrics-shmem-handle=2864,i,17973114004821567313,17809559298368817542,524288 --field-trial-handle=2348,i,4383914887142717900,4649832010531238256,262144 --variations-seed-version --mojo-platform-channel-handle=2924 /prefetch:13 List of affected devices: STORAGE\Volume\{c67841dd-cd1b-11f0-8722-806e6f6e6963}#0000000001100000
|
| | System | Warning | 223 | 2025-11-29 04:49:41 | SYSTEM | Microsoft-Windows-Kernel-PnP | 225: The application \Device\HarddiskVolume2\Windows\System32\svchost.exe with process id 10272 stopped the removal or ejection for the device ACPI\PNP0A08\2&daba3ff&0. Process command line: C:\WINDOWS\system32\svchost.exe -k netsvcs -p -s UsoSvc List of affected devices: STORAGE\Volume\{c67841dd-cd1b-11f0-8722-806e6f6e6963}#0000000001100000
|
| | System | Warning | 223 | 2025-11-29 04:49:41 | SYSTEM | Microsoft-Windows-Kernel-PnP | 225: The application \Device\HarddiskVolume2\Program Files (x86)\Microsoft\Edge\Application\msedge.exe with process id 10540 stopped the removal or ejection for the device ACPI\PNP0A08\2&daba3ff&0. Process command line: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_xpay_wallet.mojom.EdgeXPayWalletService --lang=en-US --service-sandbox-type=utility --no-pre-read-main-dll --ssd-no-pressure-read-main-dll --metrics-shmem-handle=4448,i,11909205831824291996,13949259313870513099,524288 --field-trial-handle=2348,i,4383914887142717900,4649832010531238256,262144 --variations-seed-version --mojo-platform-channel-handle=9828 /prefetch:14 List of affected devices: STORAGE\Volume\{c67841dd-cd1b-11f0-8722-806e6f6e6963}#0000000001100000
|
| | System | Warning | 223 | 2025-11-29 04:49:41 | SYSTEM | Microsoft-Windows-Kernel-PnP | 225: The application \Device\HarddiskVolume2\Windows\System32\dllhost.exe with process id 10568 stopped the removal or ejection for the device ACPI\PNP0A08\2&daba3ff&0. Process command line: "C:\WINDOWS\system32\DllHost.exe" /Processid:{CA6CC9F1-867A-481E-951E-A28C5E4F01EA} List of affected devices: STORAGE\Volume\{c67841dd-cd1b-11f0-8722-806e6f6e6963}#0000000001100000
|
| | System | Warning | 223 | 2025-11-29 04:49:41 | SYSTEM | Microsoft-Windows-Kernel-PnP | 225: The application \Device\HarddiskVolume2\Users\CogiArt\AppData\Local\Microsoft\OneDrive\OneDrive.exe with process id 10620 stopped the removal or ejection for the device ACPI\PNP0A08\2&daba3ff&0. Process command line: "C:\Users\CogiArt\AppData\Local\Microsoft\OneDrive\OneDrive.exe" /background List of affected devices: STORAGE\Volume\{c67841dd-cd1b-11f0-8722-806e6f6e6963}#0000000001100000
|
| | System | Warning | 223 | 2025-11-29 04:49:41 | SYSTEM | Microsoft-Windows-Kernel-PnP | 225: The application \Device\HarddiskVolume2\Windows\System32\svchost.exe with process id 10652 stopped the removal or ejection for the device ACPI\PNP0A08\2&daba3ff&0. Process command line: C:\WINDOWS\system32\svchost.exe -k netsvcs -p -s lfsvc List of affected devices: STORAGE\Volume\{c67841dd-cd1b-11f0-8722-806e6f6e6963}#0000000001100000
|
| | System | Warning | 223 | 2025-11-29 04:49:41 | SYSTEM | Microsoft-Windows-Kernel-PnP | 225: The application \Device\HarddiskVolume2\Windows\System32\svchost.exe with process id 10820 stopped the removal or ejection for the device ACPI\PNP0A08\2&daba3ff&0. Process command line: C:\WINDOWS\System32\svchost.exe -k netsvcs -p -s BITS List of affected devices: SCSI\Disk&Ven_&Prod_KINGSTON_SV300S3\4&fefddb&0&020000 STORAGE\Volume\{c67841dd-cd1b-11f0-8722-806e6f6e6963}#0000000001100000
|
| | System | Warning | 223 | 2025-11-29 04:49:41 | SYSTEM | Microsoft-Windows-Kernel-PnP | 225: The application \Device\HarddiskVolume2\Windows\System32\svchost.exe with process id 10884 stopped the removal or ejection for the device ACPI\PNP0A08\2&daba3ff&0. Process command line: C:\WINDOWS\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s SSDPSRV List of affected devices: STORAGE\Volume\{c67841dd-cd1b-11f0-8722-806e6f6e6963}#0000000001100000
|
| | System | Warning | 223 | 2025-11-29 04:49:41 | SYSTEM | Microsoft-Windows-Kernel-PnP | 225: The application \Device\HarddiskVolume2\Windows\System32\UsoClient.exe with process id 11044 stopped the removal or ejection for the device ACPI\PNP0A08\2&daba3ff&0. Process command line: "C:\Windows\System32\usoclient.exe" StartStoreBizCritUpdates HzqGXM5/eESB4sKm.1 List of affected devices: STORAGE\Volume\{c67841dd-cd1b-11f0-8722-806e6f6e6963}#0000000001100000
|
| | System | Warning | 223 | 2025-11-29 04:49:41 | SYSTEM | Microsoft-Windows-Kernel-PnP | 225: The application \Device\HarddiskVolume2\Windows\System32\drvinst.exe with process id 11172 stopped the removal or ejection for the device ACPI\PNP0A08\2&daba3ff&0. Process command line: DrvInst.exe "2" "11" "ACPI\PNP0A08\2&DABA3FF&0" "C:\WINDOWS\System32\DriverStore\FileRepository\amdkmpfd.inf_amd64_9c0484d38bf2fd6e\amdkmpfd.inf" "oem3.inf:c7937652a1b7534c:AMDKMPFD_Install:23.10.0.2:acpi\pnp0a08," "43ab78ba3" "0000000000000234" "45f9" List of affected devices: STORAGE\Volume\{c67841dd-cd1b-11f0-8722-806e6f6e6963}#0000000001100000
|
| | System | Warning | 223 | 2025-11-29 04:49:41 | SYSTEM | Microsoft-Windows-Kernel-PnP | 225: The application \Device\HarddiskVolume2\Program Files (x86)\Microsoft\Edge\Application\msedge.exe with process id 11376 stopped the removal or ejection for the device ACPI\PNP0A08\2&daba3ff&0. Process command line: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --no-pre-read-main-dll --skip-read-main-dll --metrics-shmem-handle=4028,i,2623425999095553841,275752566819237121,524288 --field-trial-handle=2348,i,4383914887142717900,4649832010531238256,262144 --variations-seed-version --mojo-platform-channel-handle=7460 /prefetch:14 List of affected devices: STORAGE\Volume\{c67841dd-cd1b-11f0-8722-806e6f6e6963}#0000000001100000
|
| | System | Warning | 223 | 2025-11-29 04:49:41 | SYSTEM | Microsoft-Windows-Kernel-PnP | 225: The application \Device\HarddiskVolume2\Windows\System32\RuntimeBroker.exe with process id 11432 stopped the removal or ejection for the device ACPI\PNP0A08\2&daba3ff&0. Process command line: C:\Windows\System32\RuntimeBroker.exe -Embedding List of affected devices: STORAGE\Volume\{c67841dd-cd1b-11f0-8722-806e6f6e6963}#0000000001100000
|
| | System | Warning | 223 | 2025-11-29 04:49:41 | SYSTEM | Microsoft-Windows-Kernel-PnP | 225: The application \Device\HarddiskVolume2\Windows\System32\DriverStore\FileRepository\u0417877.inf_amd64_8b2c2b61b3f8a9e5\B417004\atieclxx.exe with process id 11976 stopped the removal or ejection for the device ACPI\PNP0A08\2&daba3ff&0. Process command line: atieclxx List of affected devices: STORAGE\Volume\{c67841dd-cd1b-11f0-8722-806e6f6e6963}#0000000001100000
|
| | System | Warning | 223 | 2025-11-29 04:49:41 | SYSTEM | Microsoft-Windows-Kernel-PnP | 225: The application \Device\HarddiskVolume2\Program Files (x86)\Microsoft\Edge\Application\msedge.exe with process id 12520 stopped the removal or ejection for the device ACPI\PNP0A08\2&daba3ff&0. Process command line: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --no-pre-read-main-dll --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1.25 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --time-ticks-at-unix-epoch=-1764419504945837 --launch-time-ticks=101673525 --skip-read-main-dll --metrics-shmem-handle=5536,i,12393851022284184564,4650058075989229088,2097152 --field-trial-handle=2348,i,4383914887142717900,4649832010531238256,262144 --variations-seed-version --mojo-platform-channel-handle=5852 /prefetch:1 List of affected devices: STORAGE\Volume\{c67841dd-cd1b-11f0-8722-806e6f6e6963}#0000000001100000
|
| | System | Warning | 223 | 2025-11-29 04:49:41 | SYSTEM | Microsoft-Windows-Kernel-PnP | 225: The application \Device\HarddiskVolume2\Program Files (x86)\Microsoft\Edge\Application\msedge.exe with process id 12640 stopped the removal or ejection for the device ACPI\PNP0A08\2&daba3ff&0. Process command line: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --no-pre-read-main-dll --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1.25 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --time-ticks-at-unix-epoch=-1764419504945837 --launch-time-ticks=117268181 --skip-read-main-dll --metrics-shmem-handle=5148,i,16092209981013059392,10708454124285461251,2097152 --field-trial-handle=2348,i,4383914887142717900,4649832010531238256,262144 --variations-seed-version --mojo-platform-channel-handle=6140 /prefetch:1 List of affected devices: STORAGE\Volume\{c67841dd-cd1b-11f0-8722-806e6f6e6963}#0000000001100000
|
| | System | Warning | 223 | 2025-11-29 04:49:41 | SYSTEM | Microsoft-Windows-Kernel-PnP | 225: The application \Device\HarddiskVolume2\Program Files (x86)\Microsoft\Edge\Application\msedge.exe with process id 12668 stopped the removal or ejection for the device ACPI\PNP0A08\2&daba3ff&0. Process command line: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --no-pre-read-main-dll --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1.25 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --time-ticks-at-unix-epoch=-1764419504945837 --launch-time-ticks=116335786 --skip-read-main-dll --metrics-shmem-handle=6320,i,10244184655814670071,11558143151516782913,2097152 --field-trial-handle=2348,i,4383914887142717900,4649832010531238256,262144 --variations-seed-version --mojo-platform-channel-handle=5832 /prefetch:1 List of affected devices: STORAGE\Volume\{c67841dd-cd1b-11f0-8722-806e6f6e6963}#0000000001100000
|
| | System | Warning | 223 | 2025-11-29 04:49:41 | SYSTEM | Microsoft-Windows-Kernel-PnP | 225: The application \Device\HarddiskVolume2\Windows\System32\svchost.exe with process id 12712 stopped the removal or ejection for the device ACPI\PNP0A08\2&daba3ff&0. Process command line: C:\WINDOWS\system32\svchost.exe -k UnistackSvcGroup List of affected devices: SCSI\Disk&Ven_&Prod_KINGSTON_SV300S3\4&fefddb&0&020000 STORAGE\Volume\{c67841dd-cd1b-11f0-8722-806e6f6e6963}#0000000001100000
|
| | System | Warning | 223 | 2025-11-29 04:49:41 | SYSTEM | Microsoft-Windows-Kernel-PnP | 225: The application \Device\HarddiskVolume2\Program Files (x86)\Microsoft\Edge\Application\msedge.exe with process id 12980 stopped the removal or ejection for the device ACPI\PNP0A08\2&daba3ff&0. Process command line: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --no-pre-read-main-dll --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1.25 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --time-ticks-at-unix-epoch=-1764419504945837 --launch-time-ticks=116189806 --skip-read-main-dll --metrics-shmem-handle=8088,i,7777093429136874999,3959979172431801871,2097152 --field-trial-handle=2348,i,4383914887142717900,4649832010531238256,262144 --variations-seed-version --mojo-platform-channel-handle=6156 /prefetch:1 List of affected devices: STORAGE\Volume\{c67841dd-cd1b-11f0-8722-806e6f6e6963}#0000000001100000
|
| | System | Warning | 223 | 2025-11-29 04:49:41 | SYSTEM | Microsoft-Windows-Kernel-PnP | 225: The application \Device\HarddiskVolume2\Windows\UUS\amd64\MoUsoCoreWorker.exe with process id 13036 stopped the removal or ejection for the device ACPI\PNP0A08\2&daba3ff&0. Process command line: "C:\WINDOWS\uus\AMD64\MoUsoCoreWorker.exe" useprivatenamespaces List of affected devices: STORAGE\Volume\{c67841dd-cd1b-11f0-8722-806e6f6e6963}#0000000001100000
|
| | System | Warning | 223 | 2025-11-29 04:49:41 | SYSTEM | Microsoft-Windows-Kernel-PnP | 225: The application \Device\HarddiskVolume2\Program Files (x86)\Microsoft\Edge\Application\msedge.exe with process id 13236 stopped the removal or ejection for the device ACPI\PNP0A08\2&daba3ff&0. Process command line: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --no-pre-read-main-dll --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1.25 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --time-ticks-at-unix-epoch=-1764419504945837 --launch-time-ticks=102672044 --skip-read-main-dll --metrics-shmem-handle=8184,i,12941509890726566974,1273642130367469043,2097152 --field-trial-handle=2348,i,4383914887142717900,4649832010531238256,262144 --variations-seed-version --mojo-platform-channel-handle=8068 /prefetch:1 List of affected devices: STORAGE\Volume\{c67841dd-cd1b-11f0-8722-806e6f6e6963}#0000000001100000
|
| | System | Warning | 223 | 2025-11-29 04:49:41 | SYSTEM | Microsoft-Windows-Kernel-PnP | 225: The application \Device\HarddiskVolume2\Windows\System32\dllhost.exe with process id 13452 stopped the removal or ejection for the device ACPI\PNP0A08\2&daba3ff&0. Process command line: C:\WINDOWS\system32\DllHost.exe /Processid:{6C752774-29FB-4E50-8BB1-97098425A77C} List of affected devices: STORAGE\Volume\{c67841dd-cd1b-11f0-8722-806e6f6e6963}#0000000001100000
|
| | System | Warning | 223 | 2025-11-29 04:49:41 | SYSTEM | Microsoft-Windows-Kernel-PnP | 225: The application \Device\HarddiskVolume2\Windows\System32\dllhost.exe with process id 13516 stopped the removal or ejection for the device ACPI\PNP0A08\2&daba3ff&0. Process command line: C:\WINDOWS\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5} List of affected devices: STORAGE\Volume\{c67841dd-cd1b-11f0-8722-806e6f6e6963}#0000000001100000
|
| | System | Warning | 223 | 2025-11-29 04:49:41 | SYSTEM | Microsoft-Windows-Kernel-PnP | 225: The application \Device\HarddiskVolume2\Windows\System32\svchost.exe with process id 13564 stopped the removal or ejection for the device ACPI\PNP0A08\2&daba3ff&0. Process command line: C:\WINDOWS\System32\svchost.exe -k AppReadiness -p -s AppReadiness List of affected devices: STORAGE\Volume\{c67841dd-cd1b-11f0-8722-806e6f6e6963}#0000000001100000
|
| | System | Warning | 223 | 2025-11-29 04:49:41 | SYSTEM | Microsoft-Windows-Kernel-PnP | 225: The application \Device\HarddiskVolume2\Windows\System32\svchost.exe with process id 13592 stopped the removal or ejection for the device ACPI\PNP0A08\2&daba3ff&0. Process command line: C:\WINDOWS\system32\svchost.exe -k InvSvcGroup -p -s InventorySvc List of affected devices: STORAGE\Volume\{c67841dd-cd1b-11f0-8722-806e6f6e6963}#0000000001100000
|
| | System | Warning | 223 | 2025-11-29 04:49:41 | SYSTEM | Microsoft-Windows-Kernel-PnP | 225: The application \Device\HarddiskVolume2\Program Files (x86)\Microsoft\Edge\Application\msedge.exe with process id 13644 stopped the removal or ejection for the device ACPI\PNP0A08\2&daba3ff&0. Process command line: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --no-pre-read-main-dll --skip-read-main-dll --metrics-shmem-handle=10144,i,12788395599204181742,6960392208927655569,524288 --field-trial-handle=2348,i,4383914887142717900,4649832010531238256,262144 --variations-seed-version --mojo-platform-channel-handle=9900 /prefetch:14 List of affected devices: STORAGE\Volume\{c67841dd-cd1b-11f0-8722-806e6f6e6963}#0000000001100000
|
| | System | Warning | 223 | 2025-11-29 04:49:41 | SYSTEM | Microsoft-Windows-Kernel-PnP | 225: The application \Device\HarddiskVolume2\Windows\System32\svchost.exe with process id 13720 stopped the removal or ejection for the device ACPI\PNP0A08\2&daba3ff&0. Process command line: C:\WINDOWS\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s wscsvc List of affected devices: STORAGE\Volume\{c67841dd-cd1b-11f0-8722-806e6f6e6963}#0000000001100000
|
| | System | Warning | 223 | 2025-11-29 04:49:41 | SYSTEM | Microsoft-Windows-Kernel-PnP | 225: The application \Device\HarddiskVolume2\Windows\System32\svchost.exe with process id 14168 stopped the removal or ejection for the device ACPI\PNP0A08\2&daba3ff&0. Process command line: C:\WINDOWS\system32\svchost.exe -k netsvcs -p -s DsmSvc List of affected devices: STORAGE\Volume\{c67841dd-cd1b-11f0-8722-806e6f6e6963}#0000000001100000
|
| | System | Warning | 223 | 2025-11-29 04:49:41 | SYSTEM | Microsoft-Windows-Kernel-PnP | 225: The application \Device\HarddiskVolume2\Users\CogiArt\AppData\Local\Microsoft\OneDrive\25.087.0506.0001\FileCoAuth.exe with process id 14176 stopped the removal or ejection for the device ACPI\PNP0A08\2&daba3ff&0. Process command line: "C:\Users\CogiArt\AppData\Local\Microsoft\OneDrive\25.087.0506.0001\FileCoAuth.exe" -Embedding List of affected devices: STORAGE\Volume\{c67841dd-cd1b-11f0-8722-806e6f6e6963}#0000000001100000
|
| | System | Warning | 223 | 2025-11-29 04:49:41 | SYSTEM | Microsoft-Windows-Kernel-PnP | 225: The application \Device\HarddiskVolume2\Windows\System32\drvinst.exe with process id 14192 stopped the removal or ejection for the device ACPI\PNP0A08\2&daba3ff&0. Process command line: DrvInst.exe "2" "201" "ROOT\AMDSAFD&FUN_01&REV_01\0000" "C:\WINDOWS\System32\DriverStore\FileRepository\amdsafd.inf_amd64_960126269e89c62e\amdsafd.inf" "oem10.inf:*:*:1.0.0.9:Root\AMDSAFD&FUN_01&REV_01," "49df71c6f" "0000000000000200" "45f9" List of affected devices: STORAGE\Volume\{c67841dd-cd1b-11f0-8722-806e6f6e6963}#0000000001100000
|
| | System | Warning | 223 | 2025-11-29 04:49:41 | SYSTEM | Microsoft-Windows-Kernel-PnP | 225: The application System with process id 4 stopped the removal or ejection for the device ACPI\PNP0A08\2&daba3ff&0. Process command line: List of affected devices: STORAGE\Volume\{c67841dd-cd1b-11f0-8722-806e6f6e6963}#0000000001100000 STORAGE\Volume\{c67841dd-cd1b-11f0-8722-806e6f6e6963}#0000001BC4900000 STORAGE\Volume\{c67841ed-cd1b-11f0-8722-806e6f6e6963}#0000000000005000
|
| | System | Warning | 223 | 2025-11-29 04:49:41 | SYSTEM | Microsoft-Windows-Kernel-PnP | 225: The application \Device\HarddiskVolume2\Windows\System32\smss.exe with process id 872 stopped the removal or ejection for the device ACPI\PNP0A08\2&daba3ff&0. Process command line: \SystemRoot\System32\smss.exe List of affected devices: STORAGE\Volume\{c67841dd-cd1b-11f0-8722-806e6f6e6963}#0000000001100000
|
| | System | Warning | 223 | 2025-11-29 04:49:41 | SYSTEM | Microsoft-Windows-Kernel-PnP | 225: The application \Device\HarddiskVolume2\Windows\System32\csrss.exe with process id 952 stopped the removal or ejection for the device ACPI\PNP0A08\2&daba3ff&0. Process command line: %SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16 List of affected devices: STORAGE\Volume\{c67841dd-cd1b-11f0-8722-806e6f6e6963}#0000000001100000
|
| | System | Warning | 223 | 2025-11-29 04:49:41 | SYSTEM | Microsoft-Windows-Kernel-PnP | 225: The application \Device\HarddiskVolume2\Windows\System32\wininit.exe with process id 1080 stopped the removal or ejection for the device ACPI\PNP0A08\2&daba3ff&0. Process command line: wininit.exe List of affected devices: STORAGE\Volume\{c67841dd-cd1b-11f0-8722-806e6f6e6963}#0000000001100000
|
| | System | Warning | 223 | 2025-11-29 04:49:41 | SYSTEM | Microsoft-Windows-Kernel-PnP | 225: The application \Device\HarddiskVolume2\Windows\System32\csrss.exe with process id 1088 stopped the removal or ejection for the device ACPI\PNP0A08\2&daba3ff&0. Process command line: %SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16 List of affected devices: STORAGE\Volume\{c67841dd-cd1b-11f0-8722-806e6f6e6963}#0000000001100000
|
| | System | Warning | 223 | 2025-11-29 04:49:41 | SYSTEM | Microsoft-Windows-Kernel-PnP | 225: The application \Device\HarddiskVolume2\Windows\System32\winlogon.exe with process id 1152 stopped the removal or ejection for the device ACPI\PNP0A08\2&daba3ff&0. Process command line: winlogon.exe List of affected devices: STORAGE\Volume\{c67841dd-cd1b-11f0-8722-806e6f6e6963}#0000000001100000
|
| | System | Warning | 223 | 2025-11-29 04:49:41 | SYSTEM | Microsoft-Windows-Kernel-PnP | 225: The application \Device\HarddiskVolume2\Windows\System32\services.exe with process id 1224 stopped the removal or ejection for the device ACPI\PNP0A08\2&daba3ff&0. Process command line: C:\WINDOWS\system32\services.exe List of affected devices: STORAGE\Volume\{c67841dd-cd1b-11f0-8722-806e6f6e6963}#0000000001100000
|
| | System | Warning | 223 | 2025-11-29 04:49:41 | SYSTEM | Microsoft-Windows-Kernel-PnP | 225: The application \Device\HarddiskVolume2\Windows\System32\lsass.exe with process id 1244 stopped the removal or ejection for the device ACPI\PNP0A08\2&daba3ff&0. Process command line: C:\WINDOWS\system32\lsass.exe List of affected devices: STORAGE\Volume\{c67841dd-cd1b-11f0-8722-806e6f6e6963}#0000000001100000
|
| | System | Warning | 223 | 2025-11-29 04:49:41 | SYSTEM | Microsoft-Windows-Kernel-PnP | 225: The application \Device\HarddiskVolume2\Windows\System32\svchost.exe with process id 1324 stopped the removal or ejection for the device ACPI\PNP0A08\2&daba3ff&0. Process command line: C:\WINDOWS\System32\svchost.exe -k netprofm -p -s netprofm List of affected devices: STORAGE\Volume\{c67841dd-cd1b-11f0-8722-806e6f6e6963}#0000000001100000
|
| | System | Warning | 223 | 2025-11-29 04:49:41 | SYSTEM | Microsoft-Windows-Kernel-PnP | 225: The application \Device\HarddiskVolume2\Windows\System32\svchost.exe with process id 1380 stopped the removal or ejection for the device ACPI\PNP0A08\2&daba3ff&0. Process command line: C:\WINDOWS\system32\svchost.exe -k DcomLaunch -p List of affected devices: SCSI\Disk&Ven_&Prod_KINGSTON_SV300S3\4&fefddb&0&020000 STORAGE\Volume\{c67841dd-cd1b-11f0-8722-806e6f6e6963}#0000000001100000
|
| | System | Warning | 223 | 2025-11-29 04:49:41 | SYSTEM | Microsoft-Windows-Kernel-PnP | 225: The application \Device\HarddiskVolume2\Windows\System32\fontdrvhost.exe with process id 1412 stopped the removal or ejection for the device ACPI\PNP0A08\2&daba3ff&0. Process command line: "fontdrvhost.exe" List of affected devices: STORAGE\Volume\{c67841dd-cd1b-11f0-8722-806e6f6e6963}#0000000001100000
|
| | System | Warning | 223 | 2025-11-29 04:49:41 | SYSTEM | Microsoft-Windows-Kernel-PnP | 225: The application \Device\HarddiskVolume2\Windows\System32\fontdrvhost.exe with process id 1420 stopped the removal or ejection for the device ACPI\PNP0A08\2&daba3ff&0. Process command line: "fontdrvhost.exe" List of affected devices: STORAGE\Volume\{c67841dd-cd1b-11f0-8722-806e6f6e6963}#0000000001100000
|
| | System | Warning | 223 | 2025-11-29 04:49:41 | SYSTEM | Microsoft-Windows-Kernel-PnP | 225: The application \Device\HarddiskVolume2\Windows\System32\svchost.exe with process id 1504 stopped the removal or ejection for the device ACPI\PNP0A08\2&daba3ff&0. Process command line: C:\WINDOWS\system32\svchost.exe -k RPCSS -p List of affected devices: STORAGE\Volume\{c67841dd-cd1b-11f0-8722-806e6f6e6963}#0000000001100000
|
| | System | Warning | 223 | 2025-11-29 04:49:41 | SYSTEM | Microsoft-Windows-Kernel-PnP | 225: The application \Device\HarddiskVolume2\Windows\System32\svchost.exe with process id 1552 stopped the removal or ejection for the device ACPI\PNP0A08\2&daba3ff&0. Process command line: C:\WINDOWS\system32\svchost.exe -k DcomLaunch -p -s LSM List of affected devices: STORAGE\Volume\{c67841dd-cd1b-11f0-8722-806e6f6e6963}#0000000001100000
|
| | System | Warning | 223 | 2025-11-29 04:49:41 | SYSTEM | Microsoft-Windows-Kernel-PnP | 225: The application \Device\HarddiskVolume2\Windows\ImmersiveControlPanel\SystemSettings.exe with process id 1708 stopped the removal or ejection for the device ACPI\PNP0A08\2&daba3ff&0. Process command line: "C:\Windows\ImmersiveControlPanel\SystemSettings.exe" -ServerName:microsoft.windows.immersivecontrolpanel List of affected devices: STORAGE\Volume\{c67841dd-cd1b-11f0-8722-806e6f6e6963}#0000000001100000
|
| | System | Warning | 223 | 2025-11-29 04:49:41 | SYSTEM | Microsoft-Windows-Kernel-PnP | 225: The application \Device\HarddiskVolume2\Windows\System32\svchost.exe with process id 1724 stopped the removal or ejection for the device ACPI\PNP0A08\2&daba3ff&0. Process command line: C:\WINDOWS\system32\svchost.exe -k DcomLaunch -p -s DeviceInstall List of affected devices: STORAGE\Volume\{c67841dd-cd1b-11f0-8722-806e6f6e6963}#0000000001100000
|
| | System | Warning | 223 | 2025-11-29 04:49:41 | SYSTEM | Microsoft-Windows-Kernel-PnP | 225: The application \Device\HarddiskVolume2\Windows\System32\svchost.exe with process id 1732 stopped the removal or ejection for the device ACPI\PNP0A08\2&daba3ff&0. Process command line: C:\WINDOWS\system32\svchost.exe -k NetworkService -p List of affected devices: SCSI\Disk&Ven_&Prod_KINGSTON_SV300S3\4&fefddb&0&020000 STORAGE\Volume\{c67841dd-cd1b-11f0-8722-806e6f6e6963}#0000000001100000
|
| | System | Warning | 223 | 2025-11-29 04:49:41 | SYSTEM | Microsoft-Windows-Kernel-PnP | 225: The application \Device\HarddiskVolume2\Windows\System32\svchost.exe with process id 1740 stopped the removal or ejection for the device ACPI\PNP0A08\2&daba3ff&0. Process command line: C:\WINDOWS\system32\svchost.exe -k netsvcs -p -s wlidsvc List of affected devices: STORAGE\Volume\{c67841dd-cd1b-11f0-8722-806e6f6e6963}#0000000001100000
|
| | System | Warning | 223 | 2025-11-29 04:49:41 | SYSTEM | Microsoft-Windows-Kernel-PnP | 225: The application \Device\HarddiskVolume2\Windows\System32\svchost.exe with process id 1756 stopped the removal or ejection for the device ACPI\PNP0A08\2&daba3ff&0. Process command line: C:\WINDOWS\System32\svchost.exe -k wsappx -p -s ClipSVC List of affected devices: STORAGE\Volume\{c67841dd-cd1b-11f0-8722-806e6f6e6963}#0000000001100000
|
| | System | Warning | 223 | 2025-11-29 04:49:41 | SYSTEM | Microsoft-Windows-Kernel-PnP | 225: The application \Device\HarddiskVolume2\Windows\System32\svchost.exe with process id 1796 stopped the removal or ejection for the device ACPI\PNP0A08\2&daba3ff&0. Process command line: C:\WINDOWS\system32\svchost.exe -k netsvcs -p -s wuauserv List of affected devices: SCSI\Disk&Ven_&Prod_KINGSTON_SV300S3\4&fefddb&0&020000 STORAGE\Volume\{c67841dd-cd1b-11f0-8722-806e6f6e6963}#0000000001100000
|
| | System | Warning | 223 | 2025-11-29 04:49:41 | SYSTEM | Microsoft-Windows-Kernel-PnP | 225: The application \Device\HarddiskVolume2\Windows\System32\svchost.exe with process id 1912 stopped the removal or ejection for the device ACPI\PNP0A08\2&daba3ff&0. Process command line: C:\WINDOWS\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService List of affected devices: STORAGE\Volume\{c67841dd-cd1b-11f0-8722-806e6f6e6963}#0000000001100000
|
| | System | Warning | 223 | 2025-11-29 04:49:41 | SYSTEM | Microsoft-Windows-Kernel-PnP | 225: The application \Device\HarddiskVolume2\Windows\System32\svchost.exe with process id 1968 stopped the removal or ejection for the device ACPI\PNP0A08\2&daba3ff&0. Process command line: C:\WINDOWS\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc List of affected devices: STORAGE\Volume\{c67841dd-cd1b-11f0-8722-806e6f6e6963}#0000000001100000
|
| | System | Warning | 223 | 2025-11-29 04:49:41 | SYSTEM | Microsoft-Windows-Kernel-PnP | 225: The application \Device\HarddiskVolume2\Windows\System32\svchost.exe with process id 2004 stopped the removal or ejection for the device ACPI\PNP0A08\2&daba3ff&0. Process command line: C:\WINDOWS\system32\svchost.exe -k LocalService -p -s nsi List of affected devices: STORAGE\Volume\{c67841dd-cd1b-11f0-8722-806e6f6e6963}#0000000001100000
|
| | System | Warning | 223 | 2025-11-29 04:49:41 | SYSTEM | Microsoft-Windows-Kernel-PnP | 225: The application \Device\HarddiskVolume2\Windows\System32\svchost.exe with process id 2020 stopped the removal or ejection for the device ACPI\PNP0A08\2&daba3ff&0. Process command line: C:\WINDOWS\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s hidserv List of affected devices: STORAGE\Volume\{c67841dd-cd1b-11f0-8722-806e6f6e6963}#0000000001100000
|
| | System | Warning | 223 | 2025-11-29 04:49:41 | SYSTEM | Microsoft-Windows-Kernel-PnP | 225: The application \Device\HarddiskVolume2\Windows\System32\svchost.exe with process id 2044 stopped the removal or ejection for the device ACPI\PNP0A08\2&daba3ff&0. Process command line: C:\WINDOWS\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s AppIDSvc List of affected devices: STORAGE\Volume\{c67841dd-cd1b-11f0-8722-806e6f6e6963}#0000000001100000
|
| | System | Warning | 223 | 2025-11-29 04:49:41 | SYSTEM | Microsoft-Windows-Kernel-PnP | 225: The application \Device\HarddiskVolume2\Program Files (x86)\Microsoft\EdgeWebView\Application\140.0.3485.66\msedgewebview2.exe with process id 2108 stopped the removal or ejection for the device ACPI\PNP0A08\2&daba3ff&0. Process command line: "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\140.0.3485.66\msedgewebview2.exe" --type=renderer --noerrdialogs --user-agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64; Cortana 1.18.9.23723; 10.0.0.0.26200.6584) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.26200 IsWebView2/True (WebView2Version 140.0.3485.66)" --user-data-dir="C:\Users\CogiArt\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\LocalState\EBWebView" --webview-exe-name=SearchHost.exe --webview-exe-version=2125.21002.10.0 --embedded-browser-webview=1 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1.25 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --js-flags="--expose-gc --ms-user-locale=" --time-ticks-at-unix-epoch=-1764419504945838 --launch-time-ticks=247352734 --always-read-main-dll --metrics-shmem-handle=2392,i,14176612957052240401,5255948198628843005,2097152 --field-trial-handle=1844,i,6697581408194740510,13859916280955955461,262144 --enable-features=ForceSWDCompWhenDCompFallbackRequired,msAggressiveCacheTrimming,msCustomDataPartition,msEdgeFluentOverlayScrollbar,msWebView2NoTabForScreenShare,msWebViewAppLifeCycleWorkaround --disable-features=BackForwardCache,BackgroundTabLoadingFromPerformanceManager,CloseOmniboxPopupOnInactiveAreaClick,CollectAVProductsInfo,CollectCodeIntegrityInfo,EnableHangWatcher,FilterAdsOnAbusiveSites,GetWifiProtocol,LoginDetection,MediaFoundationCameraUsageMonitoring,PreconnectToSearch,SafetyHub,SegmentationPlatform,SpareRendererForSitePerProcess,Ukm,WebPayments,msAITrackerClassification,msAbydosForWindowlessWV2,msAffirmVirtualCard,msAllowChromeWebstore,msAllowMSAPrtSSOForNonMSAProfile,msApplicationGuard,msAskBeforeClosingMultipleTabs,msAutoToggleAADPrtSSOForNonAADProfile,msAutofillEdgeCoupons,msAutofillEdgeCouponsAutoApply,msAutofillEdgeServiceRequest,msAutofillEnableEdgeSuggestions,msAutomaticTabFreeze,msBrowserSettingsSupported,msCoarseGeolocationService,msDataProtection,msDesktopMode,msDesktopRewards,msDisableVariationsSeedFetchThrottling,msEEProactiveHistory,msETFOffstoreExtensionFileDataCollection,msETFPasswordTheftDNRActionSignals,msEdgeAdPlatformUI,msEdgeAddWebCapturetoCollections,msEdgeAutofillShowDeployedPassword,msEdgeCaptureSelectionInPDF,msEdgeCloudConfigService,msEdgeCloudConfigServiceV2,msEdgeCohorts,msEdgeCollectionsPrismExperiment1,msEdgeCollectionsPrismOverallMigration,msEdgeComposeNext,msEdgeEnableNurturingFramework,msEdgeEnclavePrefsBasic,msEdgeEnclavePrefsNotification,msEdgeFaviconService,msEdgeHJTelemetry,msEdgeHubAppSkype,msEdgeImageEditorUI,msEdgeLinkDoctor,msEdgeMouseGestureDefaultEnabled,msEdgeMouseGestureSupported,msEdgeNewDeviceFre,msEdgeOnRampFRE,msEdgeOnRampImport,msEdgePDFCMHighlightUX,msEdgePasswordIris,msEdgePasswordIrisSaveBubble,msEdgeProngPersonalization,msEdgeReadingView,msEdgeRose,msEdgeScreenshotUI,msEdgeSendTabToSelf,msEdgeSettingsImport,msEdgeSettingsImportV2,msEdgeShoppingPersistentStorage,msEdgeShoppingUI,msEdgeSmartFind,msEdgeSuperDragDefaultEnabled,msEdgeSuperDragDropSupported,msEdgeTranslate,msEdgeUpdatesMoreMenuPill,msEdgeWebCapture,msEdgeWebCaptureUniformExperience,msEdgeWebContentFilteringFeedback,msEdgeWorkSearchBanner,msEnableCustomJobMemoryLimitsOnXbox,msEnableMIPForPDF,msEnablePdfUpsell,msEnableThirdPartyScanning,msEnableWebSignInCta,msEnableWebToBrowserSignIn,msEndpointDlp,msEntityExtraction,msExtensionTelemetryFramework,msExternalTaskManager,msFileSystemAccessDirectoryIterationBlocklistCheck,msForceBrowserSignIn,msForeignSessionsPage,msGeolocationAccessService,msGeolocationOSLocationPermissionFallback,msGeolocationSQMService,msGeolocationService,msGrowthInfraLaunchSourceLogging,msGuidedSwitchAllowed,msHubPinPersist,msImplicitSignin,msIrm,msIrmv2,msKlarnaVirtualCard,msLlmConsumerDlpPurview,msLoadStatistics,msLogIsEdgePinnedToTaskbarOnLaunch,msMIPCrossTenantPdfViewSupport,msMdatpWebSiteDlp,msNotificationPermissionForPWA,msNumberOfSitesToPin,msNurturingGlobalSitePinningOnCloseModal,msNurturingSitePinningCITopSites,msNurturingSitePinningWithWindowsConsent,msOnHoverSearchInSidebar,msOpenOfficeDocumentsInWebViewer,msPageInteractionRestrictionRevoke,msPasswordBreachDetection,msPdfAnnotationsVisibility,msPdfDataRecovery,msPdfDigitalSignatureRead,msPdfFreeText,msPdfFreeTextForCJK,msPdfHighlightMode,msPdfInking,msPdfKeyphraseSupport,msPdfOOUI,msPdfPopupMarkerRenderer,msPdfShare,msPdfSharedLibrary,msPdfTextNote,msPdfTextNoteMoreMenu,msPdfThumbnailCache,msPdfUnderside,msPdfViewRestore,msPersonalizationUMA,msPriceComparison,msPrintInWebView2,msPromptDefaultHandlerForPDF,msReactiveSearch,msReadAloud,msReadAloudPdf,msRedirectToShoreline,msRevokeExtensions,msSaasDlp,msShoppingTrigger,msShorelineSearch,msShorelineSearchFindOnPageWebUI,msShowOfflineGameEntrance,msShowReadAloudIconInAddressBar,msShowUXForAADPrtSSOForNonAADProfile,msSitePinningWithoutUi,msSmartScreenProtection,msSuspendMessageForNewSessionWhenHavingPendingNavigation,msSyncEdgeCollections,msTabResourceStats,msTokenizationAutofillInlineEnabled,msTouchMode,msTriggeringSignalGenerator,msUserUnderstanding,msVideoSuperResolutionUI,msWalletBuyNow,msWalletCheckout,msWalletDiagnosticDataLogger,msWalletHubEntry,msWalletHubIntlP3,msWalletPartialCard,msWalletPasswordCategorization,msWalletPasswordCategorizationPlatformExpansion,msWalletTokenizationCardMetadata,msWalletTokenizedAutofill,msWebAssist,msWebAssistHistorySearchService,msWebOOUI,msWindowsTaskManager,msWindowsUserActivities,msZipPayVirtualCard --variations-seed-version --mojo-platform-channel-handle=4832 /pfhostedapp:b239454542aeb4426687a343f2ad9726df39e1a8 /prefetch:1 List of affected devices: STORAGE\Volume\{c67841dd-cd1b-11f0-8722-806e6f6e6963}#0000000001100000
|
| | System | Warning | 223 | 2025-11-29 04:49:41 | SYSTEM | Microsoft-Windows-Kernel-PnP | 225: The application \Device\HarddiskVolume2\Windows\System32\dwm.exe with process id 2180 stopped the removal or ejection for the device ACPI\PNP0A08\2&daba3ff&0. Process command line: "dwm.exe" List of affected devices: STORAGE\Volume\{c67841dd-cd1b-11f0-8722-806e6f6e6963}#0000000001100000
|
| | System | Warning | 223 | 2025-11-29 04:49:41 | SYSTEM | Microsoft-Windows-Kernel-PnP | 225: The application \Device\HarddiskVolume2\Windows\System32\svchost.exe with process id 2248 stopped the removal or ejection for the device ACPI\PNP0A08\2&daba3ff&0. Process command line: C:\WINDOWS\system32\svchost.exe -k GPSvcGroup List of affected devices: STORAGE\Volume\{c67841dd-cd1b-11f0-8722-806e6f6e6963}#0000000001100000
|
| | System | Warning | 223 | 2025-11-29 04:49:41 | SYSTEM | Microsoft-Windows-Kernel-PnP | 225: The application \Device\HarddiskVolume2\Windows\System32\svchost.exe with process id 2268 stopped the removal or ejection for the device ACPI\PNP0A08\2&daba3ff&0. Process command line: C:\WINDOWS\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog List of affected devices: STORAGE\Volume\{c67841dd-cd1b-11f0-8722-806e6f6e6963}#0000000001100000
|
| | System | Warning | 223 | 2025-11-29 04:49:41 | SYSTEM | Microsoft-Windows-Kernel-PnP | 225: The application \Device\HarddiskVolume2\Windows\System32\msiexec.exe with process id 2328 stopped the removal or ejection for the device ACPI\PNP0A08\2&daba3ff&0. Process command line: C:\WINDOWS\system32\msiexec.exe /V List of affected devices: STORAGE\Volume\{c67841dd-cd1b-11f0-8722-806e6f6e6963}#0000000001100000
|
| | System | Warning | 223 | 2025-11-29 04:49:41 | SYSTEM | Microsoft-Windows-Kernel-PnP | 225: The application \Device\HarddiskVolume2\Windows\System32\svchost.exe with process id 2332 stopped the removal or ejection for the device ACPI\PNP0A08\2&daba3ff&0. Process command line: C:\WINDOWS\system32\svchost.exe -k NetworkService -p List of affected devices: STORAGE\Volume\{c67841dd-cd1b-11f0-8722-806e6f6e6963}#0000000001100000
|
| | System | Warning | 223 | 2025-11-29 04:49:41 | SYSTEM | Microsoft-Windows-Kernel-PnP | 225: The application \Device\HarddiskVolume2\Windows\System32\svchost.exe with process id 2360 stopped the removal or ejection for the device ACPI\PNP0A08\2&daba3ff&0. Process command line: C:\WINDOWS\system32\svchost.exe -k UserProfileService -p -s ProfSvc List of affected devices: STORAGE\Volume\{c67841dd-cd1b-11f0-8722-806e6f6e6963}#0000000001100000
|
| | System | Warning | 223 | 2025-11-29 04:49:41 | SYSTEM | Microsoft-Windows-Kernel-PnP | 225: The application \Device\HarddiskVolume2\Windows\System32\svchost.exe with process id 2368 stopped the removal or ejection for the device ACPI\PNP0A08\2&daba3ff&0. Process command line: C:\WINDOWS\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s SysMain List of affected devices: STORAGE\Volume\{c67841dd-cd1b-11f0-8722-806e6f6e6963}#0000000001100000
|
| | System | Warning | 223 | 2025-11-29 04:49:41 | SYSTEM | Microsoft-Windows-Kernel-PnP | 225: The application \Device\HarddiskVolume2\Windows\System32\svchost.exe with process id 2376 stopped the removal or ejection for the device ACPI\PNP0A08\2&daba3ff&0. Process command line: C:\WINDOWS\System32\svchost.exe -k netsvcs -p -s Themes List of affected devices: STORAGE\Volume\{c67841dd-cd1b-11f0-8722-806e6f6e6963}#0000000001100000
|
| | System | Warning | 223 | 2025-11-29 04:49:41 | SYSTEM | Microsoft-Windows-Kernel-PnP | 225: The application \Device\HarddiskVolume2\Windows\System32\svchost.exe with process id 2384 stopped the removal or ejection for the device ACPI\PNP0A08\2&daba3ff&0. Process command line: C:\WINDOWS\system32\svchost.exe -k LocalService -p -s EventSystem List of affected devices: STORAGE\Volume\{c67841dd-cd1b-11f0-8722-806e6f6e6963}#0000000001100000
|
| | System | Warning | 223 | 2025-11-29 04:49:41 | SYSTEM | Microsoft-Windows-Kernel-PnP | 225: The application \Device\HarddiskVolume2\Windows\System32\svchost.exe with process id 2524 stopped the removal or ejection for the device ACPI\PNP0A08\2&daba3ff&0. Process command line: C:\WINDOWS\system32\svchost.exe -k netsvcs -p -s Schedule List of affected devices: STORAGE\Volume\{c67841dd-cd1b-11f0-8722-806e6f6e6963}#0000000001100000
|
| | System | Warning | 223 | 2025-11-29 04:49:41 | SYSTEM | Microsoft-Windows-Kernel-PnP | 225: The application \Device\HarddiskVolume2\Windows\System32\svchost.exe with process id 2564 stopped the removal or ejection for the device ACPI\PNP0A08\2&daba3ff&0. Process command line: C:\WINDOWS\system32\svchost.exe -k netsvcsRedirectionGuard -p -s SENS List of affected devices: STORAGE\Volume\{c67841dd-cd1b-11f0-8722-806e6f6e6963}#0000000001100000
|
| | System | Warning | 223 | 2025-11-29 04:49:41 | SYSTEM | Microsoft-Windows-Kernel-PnP | 225: The application \Device\HarddiskVolume2\Windows\System32\svchost.exe with process id 2620 stopped the removal or ejection for the device ACPI\PNP0A08\2&daba3ff&0. Process command line: C:\WINDOWS\system32\svchost.exe -k netsvcs -p -s UserManager List of affected devices: STORAGE\Volume\{c67841dd-cd1b-11f0-8722-806e6f6e6963}#0000000001100000
|
| | System | Warning | 223 | 2025-11-29 04:49:41 | SYSTEM | Microsoft-Windows-Kernel-PnP | 225: The application \Device\HarddiskVolume2\Windows\System32\svchost.exe with process id 2696 stopped the removal or ejection for the device ACPI\PNP0A08\2&daba3ff&0. Process command line: C:\WINDOWS\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder List of affected devices: STORAGE\Volume\{c67841dd-cd1b-11f0-8722-806e6f6e6963}#0000000001100000
|
| | System | Warning | 223 | 2025-11-29 04:49:41 | SYSTEM | Microsoft-Windows-Kernel-PnP | 225: The application \Device\HarddiskVolume2\Windows\System32\svchost.exe with process id 2704 stopped the removal or ejection for the device ACPI\PNP0A08\2&daba3ff&0. Process command line: C:\WINDOWS\system32\svchost.exe -k LocalService -p -s FontCache List of affected devices: STORAGE\Volume\{c67841dd-cd1b-11f0-8722-806e6f6e6963}#0000000001100000
|
| | System | Warning | 223 | 2025-11-29 04:49:41 | SYSTEM | Microsoft-Windows-Kernel-PnP | 225: The application \Device\HarddiskVolume2\AMD\AMD-Software-Installer\Bin64\AMDSoftwareInstaller.exe with process id 2756 stopped the removal or ejection for the device ACPI\PNP0A08\2&daba3ff&0. Process command line: "C:\AMD\AMD-Software-Installer\BIN64\AMDSoftwareInstaller.exe" -CLEANAFTERINSTALL -LAUNCHEDFROMNSIS List of affected devices: STORAGE\Volume\{c67841dd-cd1b-11f0-8722-806e6f6e6963}#0000000001100000
|
| | System | Warning | 223 | 2025-11-29 04:49:41 | SYSTEM | Microsoft-Windows-Kernel-PnP | 225: The application \Device\HarddiskVolume2\Windows\System32\wbem\WmiPrvSE.exe with process id 2800 stopped the removal or ejection for the device ACPI\PNP0A08\2&daba3ff&0. Process command line: C:\WINDOWS\system32\wbem\wmiprvse.exe List of affected devices: -Embedding
|
| | System | Warning | 223 | 2025-11-29 04:49:41 | SYSTEM | Microsoft-Windows-Kernel-PnP | 225: The application \Device\HarddiskVolume2\Program Files (x86)\Microsoft\EdgeWebView\Application\140.0.3485.66\msedgewebview2.exe with process id 2932 stopped the removal or ejection for the device ACPI\PNP0A08\2&daba3ff&0. Process command line: "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\140.0.3485.66\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=SearchHost.exe --webview-exe-version=2125.21002.10.0 --user-data-dir="C:\Users\CogiArt\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\LocalState\EBWebView" --noerrdialogs --disable-features=msSmartScreenProtection --edge-webview-enable-mojo-ipcz --enable-features=msEdgeFluentOverlayScrollbar --user-agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64; Cortana 1.18.9.23723; 10.0.0.0.26200.6584) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.26200 IsWebView2/True (WebView2Version 140.0.3485.66)" --lang=en-US --mojo-named-platform-channel-pipe=6792.7200.3786573828812570330 /pfhostedapp:b239454542aeb4426687a343f2ad9726df39e1a8 List of affected devices: STORAGE\Volume\{c67841dd-cd1b-11f0-8722-806e6f6e6963}#0000000001100000
|
| | System | Warning | 223 | 2025-11-29 04:49:41 | SYSTEM | Microsoft-Windows-Kernel-PnP | 225: The application \Device\HarddiskVolume2\Windows\System32\svchost.exe with process id 2964 stopped the removal or ejection for the device ACPI\PNP0A08\2&daba3ff&0. Process command line: C:\WINDOWS\System32\svchost.exe -k LocalServiceNetworkRestricted -p List of affected devices: STORAGE\Volume\{c67841dd-cd1b-11f0-8722-806e6f6e6963}#0000000001100000
|
| | System | Warning | 223 | 2025-11-29 04:49:41 | SYSTEM | Microsoft-Windows-Kernel-PnP | 225: The application \Device\HarddiskVolume2\Windows\System32\svchost.exe with process id 3020 stopped the removal or ejection for the device ACPI\PNP0A08\2&daba3ff&0. Process command line: C:\WINDOWS\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TextInputManagementService List of affected devices: STORAGE\Volume\{c67841dd-cd1b-11f0-8722-806e6f6e6963}#0000000001100000
|
| | System | Warning | 223 | 2025-11-29 04:49:41 | SYSTEM | Microsoft-Windows-Kernel-PnP | 225: The application \Device\HarddiskVolume2\Windows\System32\svchost.exe with process id 3068 stopped the removal or ejection for the device ACPI\PNP0A08\2&daba3ff&0. Process command line: C:\WINDOWS\system32\svchost.exe -k LocalServiceNoNetwork -p List of affected devices: STORAGE\Volume\{c67841dd-cd1b-11f0-8722-806e6f6e6963}#0000000001100000
|
| | System | Warning | 223 | 2025-11-29 04:49:41 | SYSTEM | Microsoft-Windows-Kernel-PnP | 225: The application \Device\HarddiskVolume2\Windows\System32\svchost.exe with process id 3096 stopped the removal or ejection for the device ACPI\PNP0A08\2&daba3ff&0. Process command line: C:\WINDOWS\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s DusmSvc List of affected devices: STORAGE\Volume\{c67841dd-cd1b-11f0-8722-806e6f6e6963}#0000000001100000
|
| | System | Warning | 223 | 2025-11-29 04:49:41 | SYSTEM | Microsoft-Windows-Kernel-PnP | 225: The application \Device\HarddiskVolume2\Windows\System32\svchost.exe with process id 3104 stopped the removal or ejection for the device ACPI\PNP0A08\2&daba3ff&0. Process command line: C:\WINDOWS\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp List of affected devices: STORAGE\Volume\{c67841dd-cd1b-11f0-8722-806e6f6e6963}#0000000001100000
|
| | System | Warning | 223 | 2025-11-29 04:49:41 | SYSTEM | Microsoft-Windows-Kernel-PnP | 225: The application \Device\HarddiskVolume2\Windows\System32\svchost.exe with process id 3156 stopped the removal or ejection for the device ACPI\PNP0A08\2&daba3ff&0. Process command line: C:\WINDOWS\System32\svchost.exe -k netsvcs -p List of affected devices: STORAGE\Volume\{c67841dd-cd1b-11f0-8722-806e6f6e6963}#0000000001100000
|
| | System | Warning | 223 | 2025-11-29 04:49:41 | SYSTEM | Microsoft-Windows-Kernel-PnP | 225: The application \Device\HarddiskVolume2\Windows\System32\svchost.exe with process id 3208 stopped the removal or ejection for the device ACPI\PNP0A08\2&daba3ff&0. Process command line: C:\WINDOWS\system32\svchost.exe -k netsvcs -p -s Winmgmt List of affected devices: STORAGE\Volume\{c67841dd-cd1b-11f0-8722-806e6f6e6963}#0000000001100000
|
| | System | Warning | 223 | 2025-11-29 04:49:41 | SYSTEM | Microsoft-Windows-Kernel-PnP | 225: The application \Device\HarddiskVolume2\Windows\System32\svchost.exe with process id 3240 stopped the removal or ejection for the device ACPI\PNP0A08\2&daba3ff&0. Process command line: C:\WINDOWS\system32\svchost.exe -k LocalServiceNoNetworkFirewall -p List of affected devices: STORAGE\Volume\{c67841dd-cd1b-11f0-8722-806e6f6e6963}#0000000001100000
|
| | System | Warning | 223 | 2025-11-29 04:49:41 | SYSTEM | Microsoft-Windows-Kernel-PnP | 225: The application \Device\HarddiskVolume2\Program Files\Windows Defender\MsMpEng.exe with process id 3292 stopped the removal or ejection for the device ACPI\PNP0A08\2&daba3ff&0. Process command line: "C:\Program Files\Windows Defender\MsMpEng.exe" List of affected devices: STORAGE\Volume\{c67841dd-cd1b-11f0-8722-806e6f6e6963}#0000000001100000
|
| | System | Warning | 223 | 2025-11-29 04:49:41 | SYSTEM | Microsoft-Windows-Kernel-PnP | 225: The application \Device\HarddiskVolume2\Windows\System32\svchost.exe with process id 3296 stopped the removal or ejection for the device ACPI\PNP0A08\2&daba3ff&0. Process command line: C:\WINDOWS\system32\svchost.exe -k appmodel -p -s StateRepository List of affected devices: STORAGE\Volume\{c67841dd-cd1b-11f0-8722-806e6f6e6963}#0000000001100000
|
| | System | Warning | 223 | 2025-11-29 04:49:41 | SYSTEM | Microsoft-Windows-Kernel-PnP | 225: The application \Device\HarddiskVolume2\Windows\System32\svchost.exe with process id 3380 stopped the removal or ejection for the device ACPI\PNP0A08\2&daba3ff&0. Process command line: C:\WINDOWS\system32\svchost.exe -k LocalServiceHttp -p List of affected devices: STORAGE\Volume\{c67841dd-cd1b-11f0-8722-806e6f6e6963}#0000000001100000
|
| | System | Warning | 223 | 2025-11-29 04:49:41 | SYSTEM | Microsoft-Windows-Kernel-PnP | 225: The application \Device\HarddiskVolume2\Windows\System32\svchost.exe with process id 3464 stopped the removal or ejection for the device ACPI\PNP0A08\2&daba3ff&0. Process command line: C:\WINDOWS\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Wcmsvc List of affected devices: STORAGE\Volume\{c67841dd-cd1b-11f0-8722-806e6f6e6963}#0000000001100000
|
| | System | Warning | 223 | 2025-11-29 04:49:41 | SYSTEM | Microsoft-Windows-Kernel-PnP | 225: The application \Device\HarddiskVolume2\Windows\System32\svchost.exe with process id 3508 stopped the removal or ejection for the device ACPI\PNP0A08\2&daba3ff&0. Process command line: C:\WINDOWS\System32\svchost.exe -k netsvcs -p -s ShellHWDetection List of affected devices: STORAGE\Volume\{c67841dd-cd1b-11f0-8722-806e6f6e6963}#0000000001100000
|
| | System | Warning | 223 | 2025-11-29 04:49:41 | SYSTEM | Microsoft-Windows-Kernel-PnP | 225: The application \Device\HarddiskVolume2\Windows\System32\audiodg.exe with process id 3520 stopped the removal or ejection for the device ACPI\PNP0A08\2&daba3ff&0. Process command line: C:\WINDOWS\system32\AUDIODG.EXE 0x00000000000005EC List of affected devices: 72
|
| | System | Warning | 223 | 2025-11-29 04:49:41 | SYSTEM | Microsoft-Windows-Kernel-PnP | 225: The application \Device\HarddiskVolume2\Windows\System32\spoolsv.exe with process id 3740 stopped the removal or ejection for the device ACPI\PNP0A08\2&daba3ff&0. Process command line: C:\WINDOWS\System32\spoolsv.exe List of affected devices: STORAGE\Volume\{c67841dd-cd1b-11f0-8722-806e6f6e6963}#0000000001100000
|
| | System | Warning | 223 | 2025-11-29 04:49:41 | SYSTEM | Microsoft-Windows-Kernel-PnP | 225: The application \Device\HarddiskVolume2\Windows\System32\svchost.exe with process id 3860 stopped the removal or ejection for the device ACPI\PNP0A08\2&daba3ff&0. Process command line: C:\WINDOWS\system32\svchost.exe -k WebThreatDefense -p -s webthreatdefsvc List of affected devices: STORAGE\Volume\{c67841dd-cd1b-11f0-8722-806e6f6e6963}#0000000001100000
|
| | System | Warning | 223 | 2025-11-29 04:49:41 | SYSTEM | Microsoft-Windows-Kernel-PnP | 225: The application \Device\HarddiskVolume2\Windows\System32\svchost.exe with process id 3888 stopped the removal or ejection for the device ACPI\PNP0A08\2&daba3ff&0. Process command line: C:\WINDOWS\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation List of affected devices: STORAGE\Volume\{c67841dd-cd1b-11f0-8722-806e6f6e6963}#0000000001100000
|
| | System | Warning | 223 | 2025-11-29 04:49:41 | SYSTEM | Microsoft-Windows-Kernel-PnP | 225: The application \Device\HarddiskVolume2\Windows\System32\svchost.exe with process id 3932 stopped the removal or ejection for the device ACPI\PNP0A08\2&daba3ff&0. Process command line: C:\WINDOWS\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc List of affected devices: STORAGE\Volume\{c67841dd-cd1b-11f0-8722-806e6f6e6963}#0000000001100000
|
| | System | Warning | 223 | 2025-11-29 04:49:41 | SYSTEM | Microsoft-Windows-Kernel-PnP | 225: The application \Device\HarddiskVolume2\Windows\System32\svchost.exe with process id 4008 stopped the removal or ejection for the device ACPI\PNP0A08\2&daba3ff&0. Process command line: C:\WINDOWS\System32\svchost.exe -k utcsvc -p List of affected devices: SCSI\Disk&Ven_&Prod_KINGSTON_SV300S3\4&fefddb&0&020000 STORAGE\Volume\{c67841dd-cd1b-11f0-8722-806e6f6e6963}#0000000001100000
|
| | System | Warning | 223 | 2025-11-29 04:49:41 | SYSTEM | Microsoft-Windows-Kernel-PnP | 225: The application \Device\HarddiskVolume2\Windows\System32\svchost.exe with process id 4020 stopped the removal or ejection for the device ACPI\PNP0A08\2&daba3ff&0. Process command line: C:\WINDOWS\System32\svchost.exe -k NetSvcs -p -s iphlpsvc List of affected devices: STORAGE\Volume\{c67841dd-cd1b-11f0-8722-806e6f6e6963}#0000000001100000
|
| | System | Warning | 223 | 2025-11-29 04:49:41 | SYSTEM | Microsoft-Windows-Kernel-PnP | 225: The application \Device\HarddiskVolume2\Windows\System32\svchost.exe with process id 4028 stopped the removal or ejection for the device ACPI\PNP0A08\2&daba3ff&0. Process command line: C:\WINDOWS\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks List of affected devices: STORAGE\Volume\{c67841dd-cd1b-11f0-8722-806e6f6e6963}#0000000001100000
|
| | System | Warning | 223 | 2025-11-29 04:49:41 | SYSTEM | Microsoft-Windows-Kernel-PnP | 225: The application \Device\HarddiskVolume2\Windows\System32\svchost.exe with process id 4044 stopped the removal or ejection for the device ACPI\PNP0A08\2&daba3ff&0. Process command line: C:\WINDOWS\system32\svchost.exe -k WSAIFabricSvcGroup -p -s WSAIFabricSvc List of affected devices: STORAGE\Volume\{c67841dd-cd1b-11f0-8722-806e6f6e6963}#0000000001100000
|
| | System | Warning | 223 | 2025-11-29 04:49:41 | SYSTEM | Microsoft-Windows-Kernel-PnP | 225: The application \Device\HarddiskVolume2\Windows\System32\svchost.exe with process id 4052 stopped the removal or ejection for the device ACPI\PNP0A08\2&daba3ff&0. Process command line: C:\WINDOWS\system32\svchost.exe -k netsvcs -p -s WpnService List of affected devices: STORAGE\Volume\{c67841dd-cd1b-11f0-8722-806e6f6e6963}#0000000001100000
|
| | System | Warning | 223 | 2025-11-29 04:49:41 | SYSTEM | Microsoft-Windows-Kernel-PnP | 225: The application \Device\HarddiskVolume2\Windows\System32\svchost.exe with process id 4060 stopped the removal or ejection for the device ACPI\PNP0A08\2&daba3ff&0. Process command line: C:\WINDOWS\System32\svchost.exe -k LocalServiceNoNetwork -p -s DPS List of affected devices: STORAGE\Volume\{c67841dd-cd1b-11f0-8722-806e6f6e6963}#0000000001100000
|
| | System | Warning | 223 | 2025-11-29 04:49:41 | SYSTEM | Microsoft-Windows-Kernel-PnP | 225: The application \Device\HarddiskVolume2\Windows\System32\taskhostw.exe with process id 4088 stopped the removal or ejection for the device ACPI\PNP0A08\2&daba3ff&0. Process command line: taskhostw.exe $(Arg0) List of affected devices: STORAGE\Volume\{c67841dd-cd1b-11f0-8722-806e6f6e6963}#0000000001100000
|
| | System | Warning | 223 | 2025-11-29 04:49:41 | SYSTEM | Microsoft-Windows-Kernel-PnP | 225: The application \Device\HarddiskVolume2\Windows\System32\svchost.exe with process id 4308 stopped the removal or ejection for the device ACPI\PNP0A08\2&daba3ff&0. Process command line: C:\WINDOWS\system32\svchost.exe -k netsvcs -p -s LanmanServer List of affected devices: STORAGE\Volume\{c67841dd-cd1b-11f0-8722-806e6f6e6963}#0000000001100000
|
| | System | Warning | 223 | 2025-11-29 04:49:41 | SYSTEM | Microsoft-Windows-Kernel-PnP | 225: The application \Device\HarddiskVolume2\Windows\System32\DriverStore\FileRepository\amdfendr.inf_amd64_5f2cd636dbc40dd2\amdfendrsr.exe with process id 4348 stopped the removal or ejection for the device ACPI\PNP0A08\2&daba3ff&0. Process command line: C:\WINDOWS\System32\DriverStore\FileRepository\amdfendr.inf_amd64_5f2cd636dbc40dd2\amdfendrsr.exe List of affected devices: STORAGE\Volume\{c67841dd-cd1b-11f0-8722-806e6f6e6963}#0000000001100000
|
| | System | Warning | 223 | 2025-11-29 04:49:41 | SYSTEM | Microsoft-Windows-Kernel-PnP | 225: The application \Device\HarddiskVolume2\Windows\System32\wbem\WmiPrvSE.exe with process id 4612 stopped the removal or ejection for the device ACPI\PNP0A08\2&daba3ff&0. Process command line: C:\WINDOWS\system32\wbem\wmiprvse.exe List of affected devices: 72
|
| | System | Warning | 223 | 2025-11-29 04:49:41 | SYSTEM | Microsoft-Windows-Kernel-PnP | 225: The application \Device\HarddiskVolume2\Windows\System32\svchost.exe with process id 4724 stopped the removal or ejection for the device ACPI\PNP0A08\2&daba3ff&0. Process command line: C:\WINDOWS\system32\svchost.exe -k netsvcs -p -s wisvc List of affected devices: STORAGE\Volume\{c67841dd-cd1b-11f0-8722-806e6f6e6963}#0000000001100000
|
| | System | Warning | 223 | 2025-11-29 04:49:41 | SYSTEM | Microsoft-Windows-Kernel-PnP | 225: The application \Device\HarddiskVolume2\Windows\System32\sihost.exe with process id 4788 stopped the removal or ejection for the device ACPI\PNP0A08\2&daba3ff&0. Process command line: sihost.exe List of affected devices: STORAGE\Volume\{c67841dd-cd1b-11f0-8722-806e6f6e6963}#0000000001100000
|
| | System | Warning | None | 2025-11-29 04:49:42 | | e1i68x64 | 27: Intel(R) 82574L Gigabit Network Connection Network link is disconnected.
|
| | System | Warning | None | 2025-11-29 04:49:53 | | e1i68x64 | 27: Intel(R) 82574L Gigabit Network Connection #2 Network link is disconnected.
|
| | System | Error | None | 2025-11-29 04:50:10 | CogiArt | DCOM | 10010: The server {544C4C52-DE0B-4D14-9510-21745381D5CA} did not register with DCOM within the required timeout.
|
| | System | Warning | None | 2025-11-29 04:50:33 | | e1i68x64 | 27: Intel(R) 82574L Gigabit Network Connection Network link is disconnected.
|
| | System | Error | None | 2025-11-29 04:50:39 | LOCAL SERVICE | Microsoft-Windows-WHEA-Logger | 1: A fatal hardware error has occurred. A record describing the condition is contained in the data section of this event.
|
| | System | Warning | None | 2025-11-29 04:50:39 | | e1i68x64 | 27: Intel(R) 82574L Gigabit Network Connection #2 Network link is disconnected.
|
| | System | Error | None | 2025-11-29 04:51:48 | | Service Control Manager | 7030: The AMD User Experience Program Data Uploader service is marked as an interactive service. However, the system is configured to not allow interactive services. This service may not function properly.
|
| | System | Warning | None | 2025-11-29 04:53:20 | SYSTEM | DCOM | 10016: The application-specific permission settings do not grant Local Launch permission for the COM Server application with CLSID Windows.SecurityCenter.SecurityAppBroker and APPID Unavailable to the user NT AUTHORITY\SYSTEM SID (S-1-5-18) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool.
|
| | System | Warning | None | 2025-11-29 04:53:20 | SYSTEM | DCOM | 10016: The application-specific permission settings do not grant Local Launch permission for the COM Server application with CLSID Windows.SecurityCenter.WscBrokerManager and APPID Unavailable to the user NT AUTHORITY\SYSTEM SID (S-1-5-18) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool.
|
| | System | Warning | None | 2025-11-29 04:53:20 | SYSTEM | DCOM | 10016: The application-specific permission settings do not grant Local Launch permission for the COM Server application with CLSID Windows.SecurityCenter.WscDataProtection and APPID Unavailable to the user NT AUTHORITY\SYSTEM SID (S-1-5-18) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool.
|
| | System | Error | 276 | 2025-11-29 05:08:02 | | Microsoft-Windows-Kernel-Power | 137: The system tried to delete the substitution of a drive that is not substituted.
|
| | System | Warning | None | 2025-11-29 07:35:09 | | e1i68x64 | 27: Intel(R) 82574L Gigabit Network Connection #2 Network link is disconnected.
|
| | System | Warning | None | 2025-11-29 07:35:09 | | e1i68x64 | 27: Intel(R) 82574L Gigabit Network Connection Network link is disconnected.
|
| | System | Warning | None | 2025-11-29 07:35:56 | | e1i68x64 | 27: Intel(R) 82574L Gigabit Network Connection Network link is disconnected.
|
| | System | Error | None | 2025-11-29 07:36:01 | | EventLog | 6008: The previous system shutdown at 4:50:38 AM on 11/29/2025 was unexpected.
|
| | System | Error | 100 | 2025-11-29 07:36:01 | LOCAL SERVICE | Microsoft-Windows-Eventlog | 23: The event logging service encountered an error (res=1500) while initializing logging resources for channel Microsoft-Windows-Kernel-Cache/Operational.
|
| | System | Error | None | 2025-11-29 07:36:02 | LOCAL SERVICE | Microsoft-Windows-WHEA-Logger | 1: A fatal hardware error has occurred. A record describing the condition is contained in the data section of this event.
|
| | System | Warning | None | 2025-11-29 07:36:02 | | e1i68x64 | 27: Intel(R) 82574L Gigabit Network Connection #2 Network link is disconnected.
|
| | System | Warning | None | 2025-11-29 09:17:50 | SYSTEM | DCOM | 10016: The application-specific permission settings do not grant Local Launch permission for the COM Server application with CLSID Windows.SecurityCenter.SecurityAppBroker and APPID Unavailable to the user NT AUTHORITY\SYSTEM SID (S-1-5-18) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool.
|
| | System | Warning | None | 2025-11-29 09:17:50 | SYSTEM | DCOM | 10016: The application-specific permission settings do not grant Local Launch permission for the COM Server application with CLSID Windows.SecurityCenter.WscBrokerManager and APPID Unavailable to the user NT AUTHORITY\SYSTEM SID (S-1-5-18) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool.
|
| | System | Warning | None | 2025-11-29 09:17:50 | SYSTEM | DCOM | 10016: The application-specific permission settings do not grant Local Launch permission for the COM Server application with CLSID Windows.SecurityCenter.WscDataProtection and APPID Unavailable to the user NT AUTHORITY\SYSTEM SID (S-1-5-18) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool.
|
| | System | Error | 1 | 2025-11-29 09:33:17 | SYSTEM | Microsoft-Windows-WindowsUpdateClient | 20: Installation Failure: Windows failed to install the following update with error 0x80073d02: 9NMPJ99VJBWV-Microsoft.YourPhone.
|
| | System | Warning | None | 2025-11-29 09:43:55 | SYSTEM | winsrvext | 100: Process C:\Windows\explorer.exe is delaying system shutdown after 5000 milliseconds.
|
| | System | Warning | None | 2025-11-29 09:45:46 | | e1i68x64 | 27: Intel(R) 82574L Gigabit Network Connection Network link is disconnected.
|
| | System | Warning | None | 2025-11-29 09:45:52 | | e1i68x64 | 27: Intel(R) 82574L Gigabit Network Connection #2 Network link is disconnected.
|
| | System | Error | None | 2025-11-29 09:46:06 | LOCAL SERVICE | Microsoft-Windows-WHEA-Logger | 1: A fatal hardware error has occurred. A record describing the condition is contained in the data section of this event.
|
| | System | Warning | None | 2025-11-29 09:48:42 | | e1i68x64 | 27: Intel(R) 82574L Gigabit Network Connection Network link is disconnected.
|
| | System | Error | None | 2025-11-29 09:48:48 | LOCAL SERVICE | Microsoft-Windows-WHEA-Logger | 1: A fatal hardware error has occurred. A record describing the condition is contained in the data section of this event.
|
| | System | Warning | None | 2025-11-29 09:48:48 | | e1i68x64 | 27: Intel(R) 82574L Gigabit Network Connection #2 Network link is disconnected.
|
| | System | Warning | None | 2025-11-29 09:51:31 | SYSTEM | DCOM | 10016: The application-specific permission settings do not grant Local Launch permission for the COM Server application with CLSID Windows.SecurityCenter.WscBrokerManager and APPID Unavailable to the user NT AUTHORITY\SYSTEM SID (S-1-5-18) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool.
|
| | System | Warning | None | 2025-11-29 09:51:31 | SYSTEM | DCOM | 10016: The application-specific permission settings do not grant Local Launch permission for the COM Server application with CLSID Windows.SecurityCenter.WscDataProtection and APPID Unavailable to the user NT AUTHORITY\SYSTEM SID (S-1-5-18) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool.
|
| | System | Warning | None | 2025-11-29 09:51:31 | SYSTEM | DCOM | 10016: The application-specific permission settings do not grant Local Launch permission for the COM Server application with CLSID Windows.SecurityCenter.SecurityAppBroker and APPID Unavailable to the user NT AUTHORITY\SYSTEM SID (S-1-5-18) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool.
|
| | System | Error | None | 2025-11-29 09:53:49 | SYSTEM | Microsoft-Windows-TPM-WMI | 1801: Secure Boot CA/keys need to be updated. This device signature information is included here. DeviceAttributes: BaseBoardManufacturer:;FirmwareManufacturer:Apple Inc.;FirmwareVersion:9999.999.999.999.999;OEMModelNumber:MacPro5,1;OEMModelBaseBoard:Mac-27AD2F918AE68F61;OEMModelSystemFamily:MacPro;OEMManufacturerName:Apple Inc.;OEMModelSKU:System SKU#;OSArchitecture:amd64; BucketId: 982dda53de876a2880a587ae94f5edb9e2d91a89012060b836349ffe8b64ebaa BucketConfidenceLevel: UpdateType: 0 HResult: 0
|
| | System | Warning | None | 2025-11-29 09:55:45 | | BTHUSB | 34: The local adapter does not support an important Low Energy controller state to support peripheral mode. The minimum required supported state mask is 0x2491f7fffff, got 0x1fffffff. Low Energy peripheral role functionality will not be available.
|
| | System | Warning | None | 2025-11-29 09:55:46 | LOCAL SERVICE | DCOM | 10016: The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID {6B3B8D23-FA8D-40B9-8DBD-B950333E2C52} and APPID {4839DDB7-58C2-48F5-8283-E1D1807D0D7D} to the user NT AUTHORITY\LOCAL SERVICE SID (S-1-5-19) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool.
|
| | System | Warning | None | 2025-11-29 09:55:46 | LOCAL SERVICE | DCOM | 10016: The machine-default permission settings do not grant Local Activation permission for the COM Server application with CLSID {C2F03A33-21F5-47FA-B4BB-156362A2F239} and APPID {316CDED5-E4AE-4B15-9113-7055D84DCC97} to the user NT AUTHORITY\LOCAL SERVICE SID (S-1-5-19) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool.
|
| | System | Warning | None | 2025-11-29 09:55:46 | LOCAL SERVICE | DCOM | 10016: The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID {6B3B8D23-FA8D-40B9-8DBD-B950333E2C52} and APPID {4839DDB7-58C2-48F5-8283-E1D1807D0D7D} to the user NT AUTHORITY\LOCAL SERVICE SID (S-1-5-19) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool.
|
| | System | Warning | None | 2025-11-29 09:55:46 | LOCAL SERVICE | DCOM | 10016: The machine-default permission settings do not grant Local Activation permission for the COM Server application with CLSID {C2F03A33-21F5-47FA-B4BB-156362A2F239} and APPID {316CDED5-E4AE-4B15-9113-7055D84DCC97} to the user NT AUTHORITY\LOCAL SERVICE SID (S-1-5-19) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool.
|
| | System | Warning | None | 2025-11-29 09:56:03 | LOCAL SERVICE | Microsoft-Windows-EnhancedPhishingProtection-Events | 8265: Aggregated Threat assessment of current system instance
|
| | System | Warning | None | 2025-11-29 09:56:10 | LOCAL SERVICE | Microsoft-Windows-EnhancedPhishingProtection-Events | 8265: Aggregated Threat assessment of current system instance
|
| | System | Warning | None | 2025-11-29 09:56:15 | LOCAL SERVICE | Microsoft-Windows-EnhancedPhishingProtection-Events | 8265: Aggregated Threat assessment of current system instance
|
| | System | Warning | None | 2025-11-29 09:56:21 | LOCAL SERVICE | Microsoft-Windows-EnhancedPhishingProtection-Events | 8265: Aggregated Threat assessment of current system instance
|
| | System | Warning | None | 2025-11-29 09:56:25 | LOCAL SERVICE | Microsoft-Windows-EnhancedPhishingProtection-Events | 8265: Aggregated Threat assessment of current system instance
|
| | System | Warning | None | 2025-11-29 09:56:43 | CogiArt | DCOM | 10016: The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID {2593F8B9-4EAF-457C-B68A-50F6B8EA6B54} and APPID {15C20B67-12E7-4BB6-92BB-7AFF07997402} to the user DESKTOP-0JV7HJV\CogiArt SID (S-1-5-21-2954332259-1466799094-2054226798-1001) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool.
|
| | System | Warning | None | 2025-11-29 10:04:18 | | BTHUSB | 48: The local adapter does not support reading the encryption key size for a connected device. Insecure devices may be able to connect to this system.
|
| | System | Warning | None | 2025-11-29 10:04:18 | | BTHUSB | 28: The local adapter does not support Bluetooth Low Energy.
|
| | System | Warning | None | 2025-11-29 10:06:13 | CogiArt | DCOM | 10016: The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID {2593F8B9-4EAF-457C-B68A-50F6B8EA6B54} and APPID {15C20B67-12E7-4BB6-92BB-7AFF07997402} to the user DESKTOP-0JV7HJV\CogiArt SID (S-1-5-21-2954332259-1466799094-2054226798-1001) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool.
|
| | System | Warning | None | 2025-11-29 10:12:23 | CogiArt | DCOM | 10016: The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID {2593F8B9-4EAF-457C-B68A-50F6B8EA6B54} and APPID {15C20B67-12E7-4BB6-92BB-7AFF07997402} to the user DESKTOP-0JV7HJV\CogiArt SID (S-1-5-21-2954332259-1466799094-2054226798-1001) from address LocalHost (Using LRPC) running in the application container MicrosoftWindows.Client.WebExperience_525.31002.150.0_x64__cw5n1h2txyewy SID (Unavailable). This security permission can be modified using the Component Services administrative tool.
|
| | System | Warning | None | 2025-11-29 10:13:14 | LOCAL SERVICE | Microsoft-Windows-EnhancedPhishingProtection-Events | 8265: Aggregated Threat assessment of current system instance
|
| | System | Warning | None | 2025-11-29 10:48:35 | CogiArt | DCOM | 10016: The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID {2593F8B9-4EAF-457C-B68A-50F6B8EA6B54} and APPID {15C20B67-12E7-4BB6-92BB-7AFF07997402} to the user DESKTOP-0JV7HJV\CogiArt SID (S-1-5-21-2954332259-1466799094-2054226798-1001) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool.
|
| | System | Warning | None | 2025-11-29 10:49:25 | CogiArt | DCOM | 10016: The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID {2593F8B9-4EAF-457C-B68A-50F6B8EA6B54} and APPID {15C20B67-12E7-4BB6-92BB-7AFF07997402} to the user DESKTOP-0JV7HJV\CogiArt SID (S-1-5-21-2954332259-1466799094-2054226798-1001) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool.
|
| | System | Warning | None | 2025-11-29 10:51:57 | LOCAL SERVICE | Microsoft-Windows-EnhancedPhishingProtection-Events | 8265: Aggregated Threat assessment of current system instance
|
| | System | Warning | None | 2025-11-29 10:53:13 | | disk | 158: Disk 2 has the same disk identifiers as one or more disks connected to the system. Go to Microsoft's support website (http://support.microsoft.com) and search for KB2983588 to resolve the issue.
|
| | System | Warning | None | 2025-11-29 10:54:13 | | e1i68x64 | 27: Intel(R) 82574L Gigabit Network Connection Network link is disconnected.
|
| | System | Warning | None | 2025-11-29 11:38:06 | CogiArt | DCOM | 10016: The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID {2593F8B9-4EAF-457C-B68A-50F6B8EA6B54} and APPID {15C20B67-12E7-4BB6-92BB-7AFF07997402} to the user DESKTOP-0JV7HJV\CogiArt SID (S-1-5-21-2954332259-1466799094-2054226798-1001) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool.
|
| | System | Error | None | 2025-11-29 11:39:38 | | Service Control Manager | 7009: A timeout was reached (30000 milliseconds) while waiting for the Steam Client Service service to connect.
|
| | System | Error | None | 2025-11-29 11:39:38 | | Service Control Manager | 7000: The Steam Client Service service failed to start due to the following error: %%1053
|
| | System | Warning | None | 2025-11-29 11:40:10 | CogiArt | DCOM | 10016: The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID {2593F8B9-4EAF-457C-B68A-50F6B8EA6B54} and APPID {15C20B67-12E7-4BB6-92BB-7AFF07997402} to the user DESKTOP-0JV7HJV\CogiArt SID (S-1-5-21-2954332259-1466799094-2054226798-1001) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool.
|
| | System | Warning | None | 2025-11-29 23:52:07 | | e1i68x64 | 27: Intel(R) 82574L Gigabit Network Connection Network link is disconnected.
|
| | System | Warning | None | 2025-11-29 23:52:10 | | BTHUSB | 48: The local adapter does not support reading the encryption key size for a connected device. Insecure devices may be able to connect to this system.
|
| | System | Warning | None | 2025-11-29 23:52:10 | | BTHUSB | 28: The local adapter does not support Bluetooth Low Energy.
|
| | System | Error | None | 2025-11-29 23:52:13 | LOCAL SERVICE | Microsoft-Windows-WHEA-Logger | 1: A fatal hardware error has occurred. A record describing the condition is contained in the data section of this event.
|
| | System | Warning | None | 2025-11-29 23:52:13 | | e1i68x64 | 27: Intel(R) 82574L Gigabit Network Connection #2 Network link is disconnected.
|
| | System | Warning | None | 2025-11-29 23:52:19 | LOCAL SERVICE | DCOM | 10016: The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID {6B3B8D23-FA8D-40B9-8DBD-B950333E2C52} and APPID {4839DDB7-58C2-48F5-8283-E1D1807D0D7D} to the user NT AUTHORITY\LOCAL SERVICE SID (S-1-5-19) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool.
|
| | System | Warning | None | 2025-11-29 23:52:19 | LOCAL SERVICE | DCOM | 10016: The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID {6B3B8D23-FA8D-40B9-8DBD-B950333E2C52} and APPID {4839DDB7-58C2-48F5-8283-E1D1807D0D7D} to the user NT AUTHORITY\LOCAL SERVICE SID (S-1-5-19) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool.
|
| | System | Warning | None | 2025-11-29 23:53:25 | CogiArt | DCOM | 10016: The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID {2593F8B9-4EAF-457C-B68A-50F6B8EA6B54} and APPID {15C20B67-12E7-4BB6-92BB-7AFF07997402} to the user DESKTOP-0JV7HJV\CogiArt SID (S-1-5-21-2954332259-1466799094-2054226798-1001) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool.
|
| | System | Warning | None | 2025-11-29 23:54:17 | SYSTEM | DCOM | 10016: The application-specific permission settings do not grant Local Launch permission for the COM Server application with CLSID Windows.SecurityCenter.WscBrokerManager and APPID Unavailable to the user NT AUTHORITY\SYSTEM SID (S-1-5-18) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool.
|
| | System | Warning | None | 2025-11-29 23:54:17 | SYSTEM | DCOM | 10016: The application-specific permission settings do not grant Local Launch permission for the COM Server application with CLSID Windows.SecurityCenter.SecurityAppBroker and APPID Unavailable to the user NT AUTHORITY\SYSTEM SID (S-1-5-18) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool.
|
| | System | Warning | None | 2025-11-29 23:54:17 | SYSTEM | DCOM | 10016: The application-specific permission settings do not grant Local Launch permission for the COM Server application with CLSID Windows.SecurityCenter.WscDataProtection and APPID Unavailable to the user NT AUTHORITY\SYSTEM SID (S-1-5-18) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool.
|
| | System | Error | None | 2025-11-29 23:57:13 | SYSTEM | Microsoft-Windows-TPM-WMI | 1801: Secure Boot CA/keys need to be updated. This device signature information is included here. DeviceAttributes: BaseBoardManufacturer:;FirmwareManufacturer:Apple Inc.;FirmwareVersion:9999.999.999.999.999;OEMModelNumber:MacPro5,1;OEMModelBaseBoard:Mac-27AD2F918AE68F61;OEMModelSystemFamily:MacPro;OEMManufacturerName:Apple Inc.;OEMModelSKU:System SKU#;OSArchitecture:amd64; BucketId: 982dda53de876a2880a587ae94f5edb9e2d91a89012060b836349ffe8b64ebaa BucketConfidenceLevel: UpdateType: 0 HResult: 0
|
| | System | Warning | None | 2025-11-30 00:18:38 | | e1i68x64 | 27: Intel(R) 82574L Gigabit Network Connection Network link is disconnected.
|
| | System | Warning | None | 2025-11-30 00:18:41 | | BTHUSB | 48: The local adapter does not support reading the encryption key size for a connected device. Insecure devices may be able to connect to this system.
|
| | System | Warning | None | 2025-11-30 00:18:41 | | BTHUSB | 28: The local adapter does not support Bluetooth Low Energy.
|
| | System | Error | None | 2025-11-30 00:18:44 | LOCAL SERVICE | Microsoft-Windows-WHEA-Logger | 1: A fatal hardware error has occurred. A record describing the condition is contained in the data section of this event.
|
| | System | Warning | None | 2025-11-30 00:18:44 | | e1i68x64 | 27: Intel(R) 82574L Gigabit Network Connection #2 Network link is disconnected.
|
| | System | Error | None | 2025-11-30 00:41:12 | SYSTEM | Microsoft-Windows-TPM-WMI | 1801: Secure Boot CA/keys need to be updated. This device signature information is included here. DeviceAttributes: BaseBoardManufacturer:;FirmwareManufacturer:Apple Inc.;FirmwareVersion:9999.999.999.999.999;OEMModelNumber:MacPro5,1;OEMModelBaseBoard:Mac-27AD2F918AE68F61;OEMModelSystemFamily:MacPro;OEMManufacturerName:Apple Inc.;OEMModelSKU:System SKU#;OSArchitecture:amd64; BucketId: 982dda53de876a2880a587ae94f5edb9e2d91a89012060b836349ffe8b64ebaa BucketConfidenceLevel: UpdateType: 0 HResult: 0
|
| | System | Warning | None | 2025-11-30 00:41:16 | LOCAL SERVICE | DCOM | 10016: The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID {6B3B8D23-FA8D-40B9-8DBD-B950333E2C52} and APPID {4839DDB7-58C2-48F5-8283-E1D1807D0D7D} to the user NT AUTHORITY\LOCAL SERVICE SID (S-1-5-19) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool.
|
| | System | Warning | None | 2025-11-30 00:41:16 | LOCAL SERVICE | DCOM | 10016: The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID {6B3B8D23-FA8D-40B9-8DBD-B950333E2C52} and APPID {4839DDB7-58C2-48F5-8283-E1D1807D0D7D} to the user NT AUTHORITY\LOCAL SERVICE SID (S-1-5-19) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool.
|
| | System | Warning | None | 2025-11-30 00:43:14 | SYSTEM | DCOM | 10016: The application-specific permission settings do not grant Local Launch permission for the COM Server application with CLSID Windows.SecurityCenter.WscBrokerManager and APPID Unavailable to the user NT AUTHORITY\SYSTEM SID (S-1-5-18) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool.
|
| | System | Warning | None | 2025-11-30 00:43:14 | SYSTEM | DCOM | 10016: The application-specific permission settings do not grant Local Launch permission for the COM Server application with CLSID Windows.SecurityCenter.SecurityAppBroker and APPID Unavailable to the user NT AUTHORITY\SYSTEM SID (S-1-5-18) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool.
|
| | System | Warning | None | 2025-11-30 00:43:14 | SYSTEM | DCOM | 10016: The application-specific permission settings do not grant Local Launch permission for the COM Server application with CLSID Windows.SecurityCenter.WscDataProtection and APPID Unavailable to the user NT AUTHORITY\SYSTEM SID (S-1-5-18) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool.
|
| | System | Warning | None | 2025-11-30 00:49:34 | SYSTEM | Microsoft-Windows-HAL | 17: The clock interrupt is backed by a platform timer instead of a per-processor source. System performance may be degraded.
|
| | System | Warning | None | 2025-11-30 00:49:42 | | e1i68x64 | 27: Intel(R) 82574L Gigabit Network Connection Network link is disconnected.
|
| | System | Warning | None | 2025-11-30 00:49:45 | | BTHUSB | 48: The local adapter does not support reading the encryption key size for a connected device. Insecure devices may be able to connect to this system.
|
| | System | Warning | None | 2025-11-30 00:49:45 | | BTHUSB | 28: The local adapter does not support Bluetooth Low Energy.
|
| | System | Warning | None | 2025-11-30 00:49:49 | | e1i68x64 | 27: Intel(R) 82574L Gigabit Network Connection #2 Network link is disconnected.
|
| | System | Error | None | 2025-11-30 00:49:53 | LOCAL SERVICE | Microsoft-Windows-WHEA-Logger | 1: A fatal hardware error has occurred. A record describing the condition is contained in the data section of this event.
|
| | System | Error | None | 2025-11-30 00:56:15 | SYSTEM | Microsoft-Windows-TPM-WMI | 1801: Secure Boot CA/keys need to be updated. This device signature information is included here. DeviceAttributes: BaseBoardManufacturer:;FirmwareManufacturer:Apple Inc.;FirmwareVersion:9999.999.999.999.999;OEMModelNumber:MacPro5,1;OEMModelBaseBoard:Mac-27AD2F918AE68F61;OEMModelSystemFamily:MacPro;OEMManufacturerName:Apple Inc.;OEMModelSKU:System SKU#;OSArchitecture:amd64; BucketId: 982dda53de876a2880a587ae94f5edb9e2d91a89012060b836349ffe8b64ebaa BucketConfidenceLevel: UpdateType: 0 HResult: 0
|
| | System | Warning | None | 2025-11-30 00:56:17 | LOCAL SERVICE | DCOM | 10016: The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID {6B3B8D23-FA8D-40B9-8DBD-B950333E2C52} and APPID {4839DDB7-58C2-48F5-8283-E1D1807D0D7D} to the user NT AUTHORITY\LOCAL SERVICE SID (S-1-5-19) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool.
|
| | System | Warning | None | 2025-11-30 00:56:17 | LOCAL SERVICE | DCOM | 10016: The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID {6B3B8D23-FA8D-40B9-8DBD-B950333E2C52} and APPID {4839DDB7-58C2-48F5-8283-E1D1807D0D7D} to the user NT AUTHORITY\LOCAL SERVICE SID (S-1-5-19) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool.
|
| | System | Warning | None | 2025-11-30 00:57:27 | CogiArt | DCOM | 10016: The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID {2593F8B9-4EAF-457C-B68A-50F6B8EA6B54} and APPID {15C20B67-12E7-4BB6-92BB-7AFF07997402} to the user DESKTOP-0JV7HJV\CogiArt SID (S-1-5-21-2954332259-1466799094-2054226798-1001) from address LocalHost (Using LRPC) running in the application container MicrosoftWindows.Client.WebExperience_525.31002.150.0_x64__cw5n1h2txyewy SID (Unavailable). This security permission can be modified using the Component Services administrative tool.
|
| | System | Warning | None | 2025-11-30 00:58:20 | SYSTEM | DCOM | 10016: The application-specific permission settings do not grant Local Launch permission for the COM Server application with CLSID Windows.SecurityCenter.WscBrokerManager and APPID Unavailable to the user NT AUTHORITY\SYSTEM SID (S-1-5-18) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool.
|
| | System | Warning | None | 2025-11-30 00:58:20 | SYSTEM | DCOM | 10016: The application-specific permission settings do not grant Local Launch permission for the COM Server application with CLSID Windows.SecurityCenter.SecurityAppBroker and APPID Unavailable to the user NT AUTHORITY\SYSTEM SID (S-1-5-18) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool.
|
| | System | Warning | None | 2025-11-30 00:58:20 | SYSTEM | DCOM | 10016: The application-specific permission settings do not grant Local Launch permission for the COM Server application with CLSID Windows.SecurityCenter.WscDataProtection and APPID Unavailable to the user NT AUTHORITY\SYSTEM SID (S-1-5-18) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool.
|
| | System | Warning | None | 2025-11-30 01:00:12 | SYSTEM | winsrvext | 100: Process C:\Program Files\AMD\CNext\CNext\RadeonSoftware.exe is delaying system shutdown after 5046 milliseconds.
|
| | System | Warning | None | 2025-11-30 01:00:18 | SYSTEM | Microsoft-Windows-HAL | 17: The clock interrupt is backed by a platform timer instead of a per-processor source. System performance may be degraded.
|
| | System | Warning | None | 2025-11-30 01:00:22 | | e1i68x64 | 27: Intel(R) 82574L Gigabit Network Connection Network link is disconnected.
|
| | System | Warning | None | 2025-11-30 01:00:25 | | BTHUSB | 48: The local adapter does not support reading the encryption key size for a connected device. Insecure devices may be able to connect to this system.
|
| | System | Warning | None | 2025-11-30 01:00:25 | | BTHUSB | 28: The local adapter does not support Bluetooth Low Energy.
|
| | System | Error | None | 2025-11-30 01:01:10 | LOCAL SERVICE | Microsoft-Windows-WHEA-Logger | 1: A fatal hardware error has occurred. A record describing the condition is contained in the data section of this event.
|
| | System | Warning | None | 2025-11-30 01:01:10 | | e1i68x64 | 27: Intel(R) 82574L Gigabit Network Connection #2 Network link is disconnected.
|
| | System | Warning | None | 2025-11-30 01:01:14 | LOCAL SERVICE | DCOM | 10016: The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID {6B3B8D23-FA8D-40B9-8DBD-B950333E2C52} and APPID {4839DDB7-58C2-48F5-8283-E1D1807D0D7D} to the user NT AUTHORITY\LOCAL SERVICE SID (S-1-5-19) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool.
|
| | System | Warning | None | 2025-11-30 01:01:14 | LOCAL SERVICE | DCOM | 10016: The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID {6B3B8D23-FA8D-40B9-8DBD-B950333E2C52} and APPID {4839DDB7-58C2-48F5-8283-E1D1807D0D7D} to the user NT AUTHORITY\LOCAL SERVICE SID (S-1-5-19) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool.
|
| | System | Error | None | 2025-11-30 01:03:43 | | Service Control Manager | 7009: A timeout was reached (30000 milliseconds) while waiting for the Sync Host_581e4 service to connect.
|
| | System | Error | None | 2025-11-30 01:08:02 | | Service Control Manager | 7011: A timeout (30000 milliseconds) was reached while waiting for a transaction response from the WerSvc service.
|
| | System | Error | None | 2025-11-30 01:08:03 | | Service Control Manager | 7009: A timeout was reached (30000 milliseconds) while waiting for the Software Protection service to connect.
|
| | System | Error | None | 2025-11-30 01:08:03 | | Service Control Manager | 7000: The Software Protection service failed to start due to the following error: %%1053
|
| | System | Error | None | 2025-11-30 01:08:04 | | Service Control Manager | 7009: A timeout was reached (30000 milliseconds) while waiting for the Microsoft Edge Update Service (edgeupdate) service to connect.
|
| | System | Error | None | 2025-11-30 01:08:04 | | Service Control Manager | 7000: The Microsoft Edge Update Service (edgeupdate) service failed to start due to the following error: %%1053
|
| | System | Warning | None | 2025-11-30 01:09:44 | SYSTEM | Microsoft-Windows-HAL | 17: The clock interrupt is backed by a platform timer instead of a per-processor source. System performance may be degraded.
|
| | System | Warning | None | 2025-11-30 01:09:48 | | e1i68x64 | 27: Intel(R) 82574L Gigabit Network Connection Network link is disconnected.
|
| | System | Warning | None | 2025-11-30 01:09:51 | | BTHUSB | 48: The local adapter does not support reading the encryption key size for a connected device. Insecure devices may be able to connect to this system.
|
| | System | Warning | None | 2025-11-30 01:09:51 | | BTHUSB | 28: The local adapter does not support Bluetooth Low Energy.
|
| | System | Error | None | 2025-11-30 01:09:54 | | EventLog | 6008: The previous system shutdown at 1:00:27 AM on 11/30/2025 was unexpected.
|
| | System | Warning | None | 2025-11-30 01:09:54 | | e1i68x64 | 27: Intel(R) 82574L Gigabit Network Connection #2 Network link is disconnected.
|
| | System | Error | None | 2025-11-30 01:09:55 | LOCAL SERVICE | Microsoft-Windows-WHEA-Logger | 1: A fatal hardware error has occurred. A record describing the condition is contained in the data section of this event.
|
| | System | Warning | None | 2025-11-30 01:11:11 | LOCAL SERVICE | DCOM | 10016: The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID {6B3B8D23-FA8D-40B9-8DBD-B950333E2C52} and APPID {4839DDB7-58C2-48F5-8283-E1D1807D0D7D} to the user NT AUTHORITY\LOCAL SERVICE SID (S-1-5-19) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool.
|
| | System | Warning | None | 2025-11-30 01:11:11 | LOCAL SERVICE | DCOM | 10016: The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID {6B3B8D23-FA8D-40B9-8DBD-B950333E2C52} and APPID {4839DDB7-58C2-48F5-8283-E1D1807D0D7D} to the user NT AUTHORITY\LOCAL SERVICE SID (S-1-5-19) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool.
|
| | System | Warning | None | 2025-11-30 01:13:08 | SYSTEM | DCOM | 10016: The application-specific permission settings do not grant Local Launch permission for the COM Server application with CLSID Windows.SecurityCenter.SecurityAppBroker and APPID Unavailable to the user NT AUTHORITY\SYSTEM SID (S-1-5-18) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool.
|
| | System | Warning | None | 2025-11-30 01:13:08 | SYSTEM | DCOM | 10016: The application-specific permission settings do not grant Local Launch permission for the COM Server application with CLSID Windows.SecurityCenter.WscDataProtection and APPID Unavailable to the user NT AUTHORITY\SYSTEM SID (S-1-5-18) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool.
|
| | System | Warning | None | 2025-11-30 01:13:08 | SYSTEM | DCOM | 10016: The application-specific permission settings do not grant Local Launch permission for the COM Server application with CLSID Windows.SecurityCenter.WscBrokerManager and APPID Unavailable to the user NT AUTHORITY\SYSTEM SID (S-1-5-18) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool.
|
| | System | Error | None | 2025-11-30 01:14:55 | SYSTEM | Microsoft-Windows-TPM-WMI | 1801: Secure Boot CA/keys need to be updated. This device signature information is included here. DeviceAttributes: BaseBoardManufacturer:;FirmwareManufacturer:Apple Inc.;FirmwareVersion:9999.999.999.999.999;OEMModelNumber:MacPro5,1;OEMModelBaseBoard:Mac-27AD2F918AE68F61;OEMModelSystemFamily:MacPro;OEMManufacturerName:Apple Inc.;OEMModelSKU:System SKU#;OSArchitecture:amd64; BucketId: 982dda53de876a2880a587ae94f5edb9e2d91a89012060b836349ffe8b64ebaa BucketConfidenceLevel: UpdateType: 0 HResult: 0
|
| | System | Warning | None | 2025-11-30 01:19:58 | | e1i68x64 | 27: Intel(R) 82574L Gigabit Network Connection Network link is disconnected.
|
| | System | Warning | None | 2025-11-30 01:20:00 | | BTHUSB | 48: The local adapter does not support reading the encryption key size for a connected device. Insecure devices may be able to connect to this system.
|
| | System | Warning | None | 2025-11-30 01:20:01 | | BTHUSB | 28: The local adapter does not support Bluetooth Low Energy.
|
| | System | Error | None | 2025-11-30 01:20:04 | LOCAL SERVICE | Microsoft-Windows-WHEA-Logger | 1: A fatal hardware error has occurred. A record describing the condition is contained in the data section of this event.
|
| | System | Warning | None | 2025-11-30 01:20:04 | | e1i68x64 | 27: Intel(R) 82574L Gigabit Network Connection #2 Network link is disconnected.
|
| | System | Warning | None | 2025-11-30 01:24:03 | LOCAL SERVICE | DCOM | 10016: The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID {6B3B8D23-FA8D-40B9-8DBD-B950333E2C52} and APPID {4839DDB7-58C2-48F5-8283-E1D1807D0D7D} to the user NT AUTHORITY\LOCAL SERVICE SID (S-1-5-19) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool.
|
| | System | Warning | None | 2025-11-30 01:24:03 | LOCAL SERVICE | DCOM | 10016: The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID {6B3B8D23-FA8D-40B9-8DBD-B950333E2C52} and APPID {4839DDB7-58C2-48F5-8283-E1D1807D0D7D} to the user NT AUTHORITY\LOCAL SERVICE SID (S-1-5-19) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool.
|
| | System | Error | None | 2025-11-30 01:25:06 | SYSTEM | Microsoft-Windows-TPM-WMI | 1801: Secure Boot CA/keys need to be updated. This device signature information is included here. DeviceAttributes: BaseBoardManufacturer:;FirmwareManufacturer:Apple Inc.;FirmwareVersion:9999.999.999.999.999;OEMModelNumber:MacPro5,1;OEMModelBaseBoard:Mac-27AD2F918AE68F61;OEMModelSystemFamily:MacPro;OEMManufacturerName:Apple Inc.;OEMModelSKU:System SKU#;OSArchitecture:amd64; BucketId: 982dda53de876a2880a587ae94f5edb9e2d91a89012060b836349ffe8b64ebaa BucketConfidenceLevel: UpdateType: 0 HResult: 0
|
| | System | Warning | None | 2025-11-30 01:26:04 | SYSTEM | DCOM | 10016: The application-specific permission settings do not grant Local Launch permission for the COM Server application with CLSID Windows.SecurityCenter.SecurityAppBroker and APPID Unavailable to the user NT AUTHORITY\SYSTEM SID (S-1-5-18) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool.
|
| | System | Warning | None | 2025-11-30 01:26:04 | SYSTEM | DCOM | 10016: The application-specific permission settings do not grant Local Launch permission for the COM Server application with CLSID Windows.SecurityCenter.WscBrokerManager and APPID Unavailable to the user NT AUTHORITY\SYSTEM SID (S-1-5-18) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool.
|
| | System | Warning | None | 2025-11-30 01:26:04 | SYSTEM | DCOM | 10016: The application-specific permission settings do not grant Local Launch permission for the COM Server application with CLSID Windows.SecurityCenter.WscDataProtection and APPID Unavailable to the user NT AUTHORITY\SYSTEM SID (S-1-5-18) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool.
|